NK-WP-0055-T10: founder production-scope decisions; ADR-0018 defers Topaz

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354

docs/adr/ADR-0018-access-engine-core-as-production-pdp.md

@@ -0,0 +1,65 @@
+---
+id: NK-ADR-0018
+type: architecture-decision-record
+title: "The access-engine Core Is the Production PDP; Topaz Is Deferred"
+status: accepted
+owner: net-kingdom
+revision: "1"
+decided: "2026-10-27"
+last_reviewed: "2026-10-27"
+review_interval: 12m
+amends: [NK-ADR-0006]
+---
+
+# ADR-0018 - access-engine Core as Production PDP
+
+**Status:** Accepted by Bernd Worsch on 2026-10-27, as hub decision `37464824-a939-415f-8a7a-5f81cbf498c8`
+(NK-WP-0055-T10).
+**Date:** 2026-10-27
+**Decider:** Bernd Worsch
+
+## Context
+
+ADR-0006 and `docs/platform-identity-security-architecture.md` name Topaz as the first delegated policy decision point
+(PDP) behind flex-auth, now access-engine. In practice Topaz exists only as an adapter shape (FLEX-WP-0004), and nothing
+deploys it. Every live decision comes from the access-engine Go core.
+
+The core already provides:
+
+- tenant scope;
+- relationship facts and inherited access;
+- check, list-allowed and explain;
+- caller authentication.
+
+The core was shaped to Topaz's policy-plus-directory model from the start. The production readiness ledger (NK-WP-0055-T01)
+lists the Topaz runtime as an open area.
+
+## Decision
+
+- The access-engine Go core is the production PDP. A delegated Topaz runtime is not required for production readiness, and
+  that readiness area is an accepted exception.
+- The PDP readiness checks still apply, but they are now run against the core:
+  - health;
+  - data freshness;
+  - policy load status;
+  - fail-closed behaviour, verified per consumer through each consumer's `pep-stance.yaml`.
+- The policy import gap that Topaz bundles would have closed moves to NK-WP-0055-T14. Either policies load without an image
+  rebuild, or rebuild-and-deploy is accepted as the import path.
+- Topaz is no longer an expected audit source (NK-WP-0055-T11).
+- Topaz is deferred, not rejected. ADR-0006's rule still holds for any future delegated PDP: it evaluates policy, and it
+  never becomes the canonical policy model, the identity provider or the control plane.
+
+## Revisit when
+
+- a tenant needs per-object sharing, or relationship data outgrows the core's relationship facts;
+- the number of tenants or the depth of group nesting makes core evaluation a bottleneck;
+- policy changes become too frequent for the T14 import path;
+- the production declaration (NK-WP-0055-T09) reviews its accepted exceptions.
+
+## Consequences
+
+- There is one less runtime to operate, back up, audit and drill.
+- Authorization availability is coupled to access-engine. HA is out of scope by the same decision.
+- Reversibility is high: adding Topaz later extends the system rather than rebuilding it.
+- Where `docs/platform-identity-security-architecture.md` describes Topaz as the first delegated PDP, read it with this
+  amendment.

docs/evidence/2026-10-27-production-readiness-ledger.md

@@ -15,18 +15,30 @@ Builder-mode acceptances count as **partial**. The definition is in
 
 | # | Area | Status | Gap carried by |
 |---|---|---|---|
-| 1 | Platform root custody | partial | T10 (decisions), NK-WP-0054-T07 |
+| 1 | Platform root custody | partial (single-holder custody: accepted exception) | T13, NK-WP-0054-T07 |
 | 2 | MFA and identity | partial | RPF-WP-0065-T04 (SI-X4), NK-WP-0054-T04/T05/T06, T12 |
 | 3 | Bootstrap and recovery | partial | T02–T04, T07 (NK-WP-0053), T08 |
-| 4 | OpenBao runtime secrets | partial | T10, T07 (RPF-WP-0036-T03), T12 |
+| 4 | OpenBao runtime secrets | partial (manual Shamir unseal approved) | T07 (RPF-WP-0036-T03), T12 |
 | 5 | Secret rotation | partial | T06, T15, RPF-WP-0035, RPF-WP-0055-T01 |
 | 6 | flex-auth (access-engine) policy state | partial | T14, FLEX-WP-0031, FLEX-WP-0024 |
-| 7 | Topaz runtime | open | T10 (is Topaz required?), then T14 |
+| 7 | Topaz runtime | **accepted exception** (ADR-0018: the core is the production PDP) | T12 (core checks), T14 |
 | 8 | Tenant onboarding | partial | T11, T12 |
 | 9 | Audit sink | open | T11, AUDIT-WP-0013-T02, AUDIT-WP-0015-T01 |
 | 10 | Break-glass | open | T13 |
 
-None of the ten areas is met. Three are open.
+None of the ten areas is met. One is an accepted exception (7), and two are open (9, 10).
+
+
+## Founder decisions, 2026-10-27 (hub decision `37464824`, NK-WP-0055-T10)
+
+| Decision | Effect on the ledger |
+|---|---|
+| (a) Manual Shamir unseal is the approved production mechanism for now. | Area 4's unseal gap is closed. Its other gaps remain. |
+| (b) Topaz is not required. The access-engine Go core is the production PDP ([ADR-0018](../adr/ADR-0018-access-engine-core-as-production-pdp.md)). | Area 7 is an accepted exception. Its health, freshness, load and fail-closed checks move to the core under T12, and Topaz leaves the T11 audit sources. |
+| (c) The founder, as platform-root, holds all OpenBao unseal shares. This is an accepted exception to two-of-three custody. | Area 1's escrow gap becomes an exception. Item 4 (the offline king path with SSO down) stays open under T13. |
+| (d) HA is out of scope for now. | No area changes. |
+
+Each exception is reviewed at the production declaration (T09).
 
 ## Per area