coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Assemble the accepted engine rule into the proposed layer-model successor.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Section 3.3 of security-layer-model v0.9 now states that an engine enables one capability, that several engines may share a store, and that operator use is a separate access rule. Accepted v0.8 is unchanged.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
This commit is contained in:
tegwick 2026-10-22 14:34:24 +02:00
parent e1f7491e31
commit 68066346ef
1 changed files with 58 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

69
canon/standards/security-layer-model_v0.9.md
View file

@ -10,7 +10,7 @@ supersedes: canon/standards/security-layer-model_v0.8.md
owner: gate-house
publication_owner: net-kingdom
created: "2026-08-28"
updated: "2026-10-11"
updated: "2026-10-22"
last_reviewed: "2026-10-10"
review_interval: 3m
source_revision: "GH-DEC-2026-025; GH-WP-0004-T06-r1"
@ -233,14 +233,48 @@ performant, scalable keeping of state. Much of it is third-party.
### 3.3 Engines
Deterministic APIs for a modeled concept — a user, a tenant, a zone, a secret,
an access rule. An engine's defining property is that **the same authoritative
input state yields the same result**. Engines are where the estate's
deterministic guarantees live, and therefore where every enforcement boundary
MUST sit.
An engine is a tool of automation for one capability — a user, a tenant, a
zone, a secret, an access rule. It encapsulates that capability in a
consistent, often simpler interface than doing the work by hand. Its defining
property is that **the same authoritative input state yields the same
result**. That determinism is where the estate's deterministic guarantees
live. It reduces failure modes and makes the work more reliable and more
efficient. Accepted in gate-house ADR-015 (2026-10-22).
A repository whose core function is inference or judgment fails this test by
construction and is Staff, however much of its work happens at runtime.
The canon states the domain. The engine implements the capability. Tooling
holds the records. Several engines may use one store, each for a different
capability. An engine does not hold the records, and being an engine does not
make it the store's only client.
An engine enables its capability. It is not, by being an engine, an
access-control mechanism. Restricting who may act is `access-engine`'s domain
(§6). `access-engine` is an engine because deciding is its capability, not
because the engine layer restricts.
A repository whose core function is inference or judgment fails the
determinism test by construction and is Staff, however much of its work
happens at runtime.
One library has three manifestations. The library performs the capability.
The CLI runs that library in a process. A service is the same process kept
running for one scoped environment. At start, the process is injected with
the credential for that one environment. The credential enables the capability
and is not returned to the caller. A kept-running process is required only
when a scoped environment needs a standing manifestation. A one-task
environment uses the CLI.
An operator is a Staff actor who starts or calls an engine. Authentication
establishes who the operator is. Permission to use one named instance, or a
named set of instances, is an access rule rendered by `access-engine`. That
use-privilege does not confer the injected credential. The engine does not
decide the permission and does not become a gate on the store.
An operator allowed to delegate may assign a task to another operator who
holds a use-privilege the delegator does not hold. Delegation assigns the
work. It transfers neither the use-privilege nor the injected credential. The
delegate must already hold the use-privilege. Operators stay flexible and are
expected to be reliable in what they choose and assign. That reliability does
not add a restriction inside the engine.
**Engines are typed.** "Engine" is one layer but four roles, and collapsing them
hides different failure modes. Every §4 Engine row carries a role:
@ -250,7 +284,7 @@ hides different failure modes. Every §4 Engine row carries a role:
| **PDP** | renders the authorization decision — `access-engine`, and only it (§6) | consumer residue (§9.3) |
| **PIP** | supplies facts a decision consumes as claims — user, tenant, zone, approval, maturity | input degradation, engine's own fallback (§9.3) |
| **Evidence** | records what happened and proves integrity of what it holds — `audit-core` | MUST NOT block the operation being recorded — a default, not a property; see below |
| **Lifecycle** | a deterministic API over Tooling it owns — `secrets-engine` | the owning engine's failure semantics |
| **Lifecycle** | a deterministic capability over a Tooling store — `secrets-engine`. The store may serve other engines. | that engine's failure semantics |
The roles are why *"we need an engine for X"* does not mean *"X now decides"*.
A new engine is a PIP unless this standard is amended to say otherwise, and §6
@ -1567,8 +1601,12 @@ follow-up. Settled in `GH-DEC-2026-006`.
Status is **proposed**. Accepted v0.8 at SHA256
`3d8298560069ef471fba28d2b1245fb2309328f231dad1a667cdf0ce5a5a7c8b` remains
operative and immutable. This successor source assembles only GH-DEC-2026-025's
approved bounded §3.4 and §4 candidate. Confirmed founder acceptance of memo
operative and immutable. This successor source assembles GH-DEC-2026-025's
approved bounded §3.4 and §4 candidate, and, separately, the §3.3 engine
wording of accepted gate-house ADR-015. The bounded-doctrine pin covers the
staff-evidence candidate only. ADR-015 does not adopt this revision.
Confirmed founder acceptance of memo
`infd-20261011-staff-evidence-tension`, version1, approval
`d90c899b-f25c-4e66-a003-808ee5b1324f`, at2026-10-11T01:46:25Z is the bounded
doctrine disposition, not acceptance of this whole revision. Source-owner
@ -1669,6 +1707,15 @@ basis. Declaration requests are open as intakes in each.
## 15. Change log
**2026-10-22 §3.3 engine amendment:** Accepted gate-house ADR-015 replaces the
§3.3 opening and the Lifecycle role. An engine enables one capability. Tooling
holds the records. Several engines may use one store. An engine is not an
access-control mechanism by being an engine. Library, CLI, and service are
manifestations of one implementation. Operator use is an access-engine rule
and does not confer the credential injected at start. Delegation assigns work
and transfers neither privilege. Accepted v0.8 is not patched. The §4 catalog
is unchanged. This entry does not adopt the revision.
**2026-10-11 proposed successor assembly:** GH-DEC-2026-025's exact approved
candidate adds the carried Staff/deterministic-presentation-evidence tension in
§3.4, the informed-decision Staff/PEP-shaped evidence-source=yes row, explicit