Security Layer Model v0.7 — write the rule v0.6 only announced

Four reviews. kings-guard found that v0.6 claimed a human/agent principal
separation in §1 and §15 while §3.4 was byte-identical to v0.5: a silent edit
failure, and their framing is the right one — a rule stated about a standard in
its own change log is not a rule, which is §11's principle turned on the
standard. The same failure had dropped two §16 entries. Both restored.

§3.4 is now written: no standing credential, conduit or engine API only, agent
memory is not a state plane, every action reconstructable as the caller's, and
the seam with glas-harness for session semantics.

The rest are collisions between rules each written for its own clean case:

- §6.4(1) forbade what §6.4(3) blesses. A PEP may proceed under its declared
  §9.3 stance where the application of that stance is recorded in place of the
  decision — stricter than v0.6, since a fail-open result becomes metadata
  rather than silence. Raised by ops-warden, the reference shape it made a
  violation.
- §6.4(2) forbade the session-bound allow §9.7.1 permits. Now scoped to replay
  outside the decision's own binding and lifetime, with access-engine's
  canonical request digest as the mechanical test. Negative caching ruled
  permitted where the refusal is recorded and the lifetime declared.
- §13.1 now exists: v0.6 mandated a stance-map register and implemented none.
  Its first inventory has one row, which is the finding.
- §9.6 gained a threat decomposition after audit-core corrected its own remedy:
  atomicity prevents accidental omission, cadence and reconciliation detect the
  adversarial case, nothing prevents it at a compromised source. Cadence is now
  MUST for load-bearing sources, with heartbeat or reconciliation required for
  low-volume classes where rate monitoring cannot work.
- §9.7.2 splits by role: per input class at a PDP, one boundary deadline at a
  PEP.
- §17 moves the decision-record schema to access-engine, which argued it against
  its own interest.
- §13 stops attributing the actuation gap to kings-guard; §19 removed, since a
  verdict inside a standard grades the document it lives in.

§20 records the Railiance interaction boundary on railiance-master's own
definitions: the four axes, that a workload is a managed running deployable so
approvals are never one, and that rein-* is not a fifth axis but a glas-harness
concern. What is unsettled is listed as unsettled.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9

README.md

@@ -12,7 +12,7 @@ The dynamic, self-optimizing security platform is the long-term direction in
 ## Orientation
 
 - [SCOPE.md](SCOPE.md) — what this repo owns, current state, and when it is relevant
-- [Security layer model](canon/standards/security-layer-model_v0.6.md) — how the
+- [Security layer model](canon/standards/security-layer-model_v0.7.md) — how the
   security estate is layered (Taxonomy / Tooling / Engines / Staff) and what each
   layer may own
 - [Agent companion](canon/standards/security-layer-model-companion_v0.1.md) — the

canon/standards/security-layer-model-companion_v0.1.md

@@ -5,7 +5,7 @@ title: "NetKingdom Security Layer Model — Agent Companion v0.1"
 domain: netkingdom
 status: proposed
 version: "0.1"
-companion_to: canon/standards/security-layer-model_v0.6.md
+companion_to: canon/standards/security-layer-model_v0.7.md
 owner: gate-house
 publication_owner: net-kingdom
 created: "2026-08-29"
@@ -16,7 +16,7 @@ standard_token: security-layer-model-companion_v0.1
 
 # Security Layer Model — Agent Companion
 
-**This is the operative form of `security-layer-model_v0.6.md`.** Same rules, no
+**This is the operative form of `security-layer-model_v0.7.md`.** Same rules, no
 change log, no review history. The statute governs where the two disagree; if you
 find a disagreement, report it — that is a finding, not a formatting problem.
 
@@ -187,6 +187,10 @@ Stated so nobody plans around a capability that does not exist:
 
 ---
 
-**Statute:** `canon/standards/security-layer-model_v0.6.md`.
+**Statute:** `canon/standards/security-layer-model_v0.7.md`.
+**Known gap in this version:** §5.3 says publish your stance map but not *where*,
+and omits the statute's §6.4 inventory obligation — a repository could satisfy
+this document and no register would learn of its stance. Fixed in v0.2; until
+then read statute §6.4 and §13.1.
 **Owner:** gate-house. **Report a disagreement between this and the statute as a
 finding.**

canon/standards/security-layer-model_v0.6.md

@@ -3,7 +3,7 @@ id: netkingdom-security-layer-model-v0.6
 type: standard
 title: "NetKingdom Security Layer Model v0.6"
 domain: netkingdom
-status: proposed
+status: superseded
 version: "0.6"
 supersedes: canon/standards/security-layer-model_v0.5.md
 owner: gate-house
@@ -14,6 +14,7 @@ last_reviewed: "2026-08-28"
 review_interval: 3m
 source_revision: "gate-house@516ed4e"
 standard_token: security-layer-model_v0.6
+superseded_by: canon/standards/security-layer-model_v0.7.md
 assented_by:
   - "flex-auth FLEX-DEC-2026-001"
   - "kings-guard KG-DEC-2026-001"
@@ -33,6 +34,12 @@ related:
 
 # NetKingdom Security Layer Model v0.6
 
+> **Superseded 2026-08-29 by [v0.7](security-layer-model_v0.7.md).** This version
+> announced a human/agent principal separation in its change log and never wrote
+> it into §3.4 — a silent edit failure found by `kings-guard`. Its §6.4 also
+> forbade both the fail-open stance §9.3 sanctions and the session-bound allow
+> §9.7.1 permits. Do not cite §3.4 or §6.4 from this version.
+
 ## 1. Purpose
 
 This standard states how NetKingdom's IT-security estate is layered, and what