tegwick
4cde4e489a
Declare layer.yaml, add a Python engine over a local SQLite store, and cover deterministic assessment, the §13 gap register, stance-map inventory, claim guardrails, and the gate-house review path with tests. Assistant: grok Assistant-Session: 01a04ceb-150e-7e80-a542-ec8b1372e164
70 lines
2.6 KiB
YAML
70 lines
2.6 KiB
YAML
# maturity-engine — NetKingdom security layer declaration
|
|
#
|
|
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
|
|
# Assent: INTENT.md frontmatter (this repository's own voice, §11)
|
|
# Validate: python3 scripts/check_layer_conformance.py
|
|
#
|
|
# §11 requires a machine-readable declaration: prose cannot distinguish a
|
|
# declaration from a transcribed review. Form adapted from ops-warden's
|
|
# reference and kings-guard's no-contact Engine-adjacent shape.
|
|
#
|
|
# This repository is an Engine (PIP). Computing a level is not a protected
|
|
# side effect, so there is no pep_stance path. Catalogued Tooling (OpenBao,
|
|
# key-cape) is not contacted. Persistence is this PIP's own SQLite store.
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-security-layer-model
|
|
standard_version: "0.7"
|
|
repository: maturity-engine
|
|
layer: engine
|
|
role: pip
|
|
declared_by: INTENT.md
|
|
declared_at: "2026-08-29"
|
|
|
|
# §4 catalog entry, transcribed so drift between the catalog and this file is
|
|
# visible. The standard is authoritative for the row; this records what we
|
|
# understand ourselves to have been assigned.
|
|
catalog_entry:
|
|
owns:
|
|
- graded progression against declared criteria and evidence
|
|
- the gap register
|
|
- capability readiness
|
|
does_not_own:
|
|
- authorization decisions
|
|
- approval objects
|
|
- observation in production
|
|
- actuation / containment
|
|
|
|
# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling row).
|
|
# Empty is a claim. This is an Engine API over state it owns, not Staff
|
|
# reaching into OpenBao.
|
|
tooling_contacts: []
|
|
|
|
# §11 requires non-Tooling clients to be recorded so the check is total.
|
|
# Neither target is a §4 Tooling row. Recorded, not policed as §5.
|
|
non_tooling_clients:
|
|
- id: state-hub-work-records
|
|
target: state-hub
|
|
layer: not-catalogued
|
|
operation: "HTTP to the Custodian State Hub for work records and progress events"
|
|
write: true
|
|
note: >-
|
|
Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4
|
|
Tooling row, and state-hub is not one. Carries no security authority
|
|
and no secret payload.
|
|
- id: sqlite-own-store
|
|
target: sqlite
|
|
layer: not-catalogued
|
|
operation: "this PIP's own transactional store (assessments, register, local outbox)"
|
|
write: true
|
|
note: >-
|
|
Engine-owned persistence, not Lifecycle over catalogued Tooling.
|
|
Consumers read claims through this engine's API, not by opening the
|
|
file. Listed so the client account is total. Review: 2027-02-28
|
|
(two intervals from 2026-08-29).
|
|
|
|
# No PEP stance: this engine does not cause a protected side effect.
|
|
declared_shapes:
|
|
"5.1": []
|
|
"5.2": []
|
|
"5.3": []
|