# maturity-engine — NetKingdom security layer declaration
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
# Assent:    INTENT.md frontmatter (this repository's own voice, §11)
# Validate:  python3 scripts/check_layer_conformance.py
#
# §11 requires a machine-readable declaration: prose cannot distinguish a
# declaration from a transcribed review. Form adapted from ops-warden's
# reference and kings-guard's no-contact Engine-adjacent shape.
#
# This repository is an Engine (PIP). Computing a level is not a protected
# side effect, so there is no pep_stance path. Catalogued Tooling (OpenBao,
# key-cape) is not contacted. Persistence is this PIP's own SQLite store.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
repository: maturity-engine
layer: engine
role: pip
declared_by: INTENT.md
declared_at: "2026-08-29"

# §4 catalog entry, transcribed so drift between the catalog and this file is
# visible. The standard is authoritative for the row; this records what we
# understand ourselves to have been assigned.
catalog_entry:
  owns:
    - graded progression against declared criteria and evidence
    - the gap register
    - capability readiness
  does_not_own:
    - authorization decisions
    - approval objects
    - observation in production
    - actuation / containment

# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling row).
# Empty is a claim. This is an Engine API over state it owns, not Staff
# reaching into OpenBao.
tooling_contacts: []

# §11 requires non-Tooling clients to be recorded so the check is total.
# Neither target is a §4 Tooling row. Recorded, not policed as §5.
non_tooling_clients:
  - id: state-hub-work-records
    target: state-hub
    layer: not-catalogued
    operation: "HTTP to the Custodian State Hub for work records and progress events"
    write: true
    note: >-
      Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4
      Tooling row, and state-hub is not one. Carries no security authority
      and no secret payload.
  - id: sqlite-own-store
    target: sqlite
    layer: not-catalogued
    operation: "this PIP's own transactional store (assessments, register, local outbox)"
    write: true
    note: >-
      Engine-owned persistence, not Lifecycle over catalogued Tooling.
      Consumers read claims through this engine's API, not by opening the
      file. Listed so the client account is total. Review: 2027-02-28
      (two intervals from 2026-08-29).

# No PEP stance: this engine does not cause a protected side effect.
declared_shapes:
  "5.1": []
  "5.2": []
  "5.3": []