62 lines
4 KiB
Markdown
62 lines
4 KiB
Markdown
|
# Security-layer v0.8 publication acceptance — 2026-10-11
|
||
|
|
|
||
|
|
NetKingdom, the publication owner, accepts and publishes the exact finalized
|
||
|
|
cut adopted by confirmed native human memo `infd-20261010-security-layer-v08`,
|
||
|
|
version 2, approval `8432d0dc-adc0-42d0-9a5b-6b71ff492e15`, accepted at
|
||
|
|
2026-10-10T23:23:53Z. The approved proposed source SHA256 is
|
||
|
|
`103a635f19ab9fe53094d69c3eeebcccd8e87ac9588846167e7e204a7c6de167`.
|
||
|
|
The final accepted artifact adds acceptance frontmatter and §14 notice only;
|
||
|
|
its approved normative provisions are unchanged. Native disposition `disp-43e051e9-b12f-4c34-b26e-40b85a96c2e8` is confirmed, non-stale and accepts
|
||
|
|
the exact source above. The native disposition receipt remains in `the-custodian/docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json`, rather than being
|
||
|
|
replaced by a fabricated owner approval. This source acceptance approves no
|
||
|
|
live workload, credential, privilege, MFA journey or SecurityCase execution.
|
||
|
|
|
||
|
|
## Gates verified
|
||
|
|
|
||
|
|
GH-DEC-2026-019's three closing conditions are evidenced in the current
|
||
|
|
GateHouse owner record: T09 exact A11 r2/A12 r3 returns dispositioned, T07/T12
|
||
|
|
AuditCore findings returned and ruled, and T08 four declarations or dated gaps
|
||
|
|
supplied. Publication-readiness sources pin each receipt and amendment. The
|
||
|
|
human memo expressly adopts the bounded A13 completed-rename adaptation. No
|
||
|
|
prior-revision assent is promoted into blanket review of the final cut.
|
||
|
|
|
||
|
|
NetKingdom flips v0.8 to accepted and README to the governing source. Historical
|
||
|
|
v0.7 canon is unchanged. Policy-nexus registers v0.8 at
|
||
|
|
`standards/security-layer-model/v0.8/` with immutable `accepted-1` revision;
|
||
|
|
the old v0.7 current route gains a superseded notice pointing to v0.8, leaving
|
||
|
|
its historical immutable revision untouched. The derived working companion
|
||
|
|
moves to v0.3, with the statute continuing to govern any discrepancy.
|
||
|
|
Registration/build verification is source publication preparation; serving the
|
||
|
|
new site is a separate PolicyNexus release, never inferred from a local build.
|
||
|
|
|
||
|
|
## Post-flip owner migration handoff
|
||
|
|
|
||
|
|
GateHouse GH-WP-0004-T10 may record this exact publisher acceptance. T11 remains
|
||
|
|
open until all eight implementers re-point VALIDATED_AGAINST and converge on the
|
||
|
|
OpsWarden reference detector, or retain a dated reason. These are executable
|
||
|
|
checker changes, not declaration-version pins. Preserve old versions in detector
|
||
|
|
negative fixtures: they prove rejection of pins and must not be mechanically
|
||
|
|
replaced just because the normative version changed.
|
||
|
|
|
||
|
|
| Owner | Checker implementation | Verification |
|
||
|
|
| --- | --- | --- |
|
||
|
|
| kings-guard | `scripts/check_layer_conformance.py` | `tests/test_layer_conformance.py` |
|
||
|
|
| user-engine | `scripts/check_layer_conformance.py` | `tests/test_layer_conformance.py` |
|
||
|
|
| zone-engine | `tools/check_layer_conformance.py` | `tests/test_layer_conformance.py` |
|
||
|
|
| secrets-engine | `scripts/check_layer_conformance.py` | `tests/test_layer_conformance.py` |
|
||
|
|
| maturity-engine | `scripts/check_layer_conformance.py` | `tests/test_layer_conformance.py` |
|
||
|
|
| ops-warden | `scripts/check_layer_conformance.py` (reference) | `tests/test_layer_conformance.py` |
|
||
|
|
| tenant-engine | `scripts/check_layer_conformance.py` | `tests/test_layer_conformance.py` |
|
||
|
|
| access-engine (historical flex-auth) | `internal/layer/conformance.go`, `tools/check_layer_conformance.go` | `internal/layer/conformance_test.go` |
|
||
|
|
|
||
|
|
Each run must report accepted v0.8 plus its explicit declared scope. Different
|
||
|
|
source detectors remain owner-specific; convergence means the same declaration
|
||
|
|
pin/provenance semantics, authoritative INTENT and derived-sidecar disagreement
|
||
|
|
findings. It does not require replacing meaningful local detectors by a generic
|
||
|
|
copy. WhitehatSecurity's remaining `conformance_state` declaration removal is
|
||
|
|
also GH T11 and is not closed by these eight migrations.
|
||
|
|
|
||
|
|
GateHouse retains the separate §3.4 doctrine row question (GH T06) and KingsGuard
|
||
|
|
§9.5 review nonclaim. This acceptance waives neither. Existing runtime capabilities,
|
||
|
|
zero-capability gaps and native security acceptance stay in their owner plans.
|