NK-WP-0055-T10: founder production-scope decisions; ADR-0018 defers Topaz

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354

WORK-RECORDS.md

@@ -327,7 +327,7 @@
 | task | NK-WP-0055-T07 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | task | NK-WP-0055-T08 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | task | NK-WP-0055-T09 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
-| task | NK-WP-0055-T10 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
+| task | NK-WP-0055-T10 | done | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | task | NK-WP-0055-T11 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | task | NK-WP-0055-T12 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | task | NK-WP-0055-T13 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md |

docs/adr/ADR-0018-access-engine-core-as-production-pdp.md

@@ -0,0 +1,65 @@
+---
+id: NK-ADR-0018
+type: architecture-decision-record
+title: "The access-engine Core Is the Production PDP; Topaz Is Deferred"
+status: accepted
+owner: net-kingdom
+revision: "1"
+decided: "2026-10-27"
+last_reviewed: "2026-10-27"
+review_interval: 12m
+amends: [NK-ADR-0006]
+---
+
+# ADR-0018 - access-engine Core as Production PDP
+
+**Status:** Accepted by Bernd Worsch on 2026-10-27, as hub decision `37464824-a939-415f-8a7a-5f81cbf498c8`
+(NK-WP-0055-T10).
+**Date:** 2026-10-27
+**Decider:** Bernd Worsch
+
+## Context
+
+ADR-0006 and `docs/platform-identity-security-architecture.md` name Topaz as the first delegated policy decision point
+(PDP) behind flex-auth, now access-engine. In practice Topaz exists only as an adapter shape (FLEX-WP-0004), and nothing
+deploys it. Every live decision comes from the access-engine Go core.
+
+The core already provides:
+
+- tenant scope;
+- relationship facts and inherited access;
+- check, list-allowed and explain;
+- caller authentication.
+
+The core was shaped to Topaz's policy-plus-directory model from the start. The production readiness ledger (NK-WP-0055-T01)
+lists the Topaz runtime as an open area.
+
+## Decision
+
+- The access-engine Go core is the production PDP. A delegated Topaz runtime is not required for production readiness, and
+  that readiness area is an accepted exception.
+- The PDP readiness checks still apply, but they are now run against the core:
+  - health;
+  - data freshness;
+  - policy load status;
+  - fail-closed behaviour, verified per consumer through each consumer's `pep-stance.yaml`.
+- The policy import gap that Topaz bundles would have closed moves to NK-WP-0055-T14. Either policies load without an image
+  rebuild, or rebuild-and-deploy is accepted as the import path.
+- Topaz is no longer an expected audit source (NK-WP-0055-T11).
+- Topaz is deferred, not rejected. ADR-0006's rule still holds for any future delegated PDP: it evaluates policy, and it
+  never becomes the canonical policy model, the identity provider or the control plane.
+
+## Revisit when
+
+- a tenant needs per-object sharing, or relationship data outgrows the core's relationship facts;
+- the number of tenants or the depth of group nesting makes core evaluation a bottleneck;
+- policy changes become too frequent for the T14 import path;
+- the production declaration (NK-WP-0055-T09) reviews its accepted exceptions.
+
+## Consequences
+
+- There is one less runtime to operate, back up, audit and drill.
+- Authorization availability is coupled to access-engine. HA is out of scope by the same decision.
+- Reversibility is high: adding Topaz later extends the system rather than rebuilding it.
+- Where `docs/platform-identity-security-architecture.md` describes Topaz as the first delegated PDP, read it with this
+  amendment.

docs/evidence/2026-10-27-production-readiness-ledger.md

@@ -15,18 +15,30 @@ Builder-mode acceptances count as **partial**. The definition is in
 
 | # | Area | Status | Gap carried by |
 |---|---|---|---|
-| 1 | Platform root custody | partial | T10 (decisions), NK-WP-0054-T07 |
+| 1 | Platform root custody | partial (single-holder custody: accepted exception) | T13, NK-WP-0054-T07 |
 | 2 | MFA and identity | partial | RPF-WP-0065-T04 (SI-X4), NK-WP-0054-T04/T05/T06, T12 |
 | 3 | Bootstrap and recovery | partial | T02–T04, T07 (NK-WP-0053), T08 |
-| 4 | OpenBao runtime secrets | partial | T10, T07 (RPF-WP-0036-T03), T12 |
+| 4 | OpenBao runtime secrets | partial (manual Shamir unseal approved) | T07 (RPF-WP-0036-T03), T12 |
 | 5 | Secret rotation | partial | T06, T15, RPF-WP-0035, RPF-WP-0055-T01 |
 | 6 | flex-auth (access-engine) policy state | partial | T14, FLEX-WP-0031, FLEX-WP-0024 |
-| 7 | Topaz runtime | open | T10 (is Topaz required?), then T14 |
+| 7 | Topaz runtime | **accepted exception** (ADR-0018: the core is the production PDP) | T12 (core checks), T14 |
 | 8 | Tenant onboarding | partial | T11, T12 |
 | 9 | Audit sink | open | T11, AUDIT-WP-0013-T02, AUDIT-WP-0015-T01 |
 | 10 | Break-glass | open | T13 |
 
-None of the ten areas is met. Three are open.
+None of the ten areas is met. One is an accepted exception (7), and two are open (9, 10).
+
+
+## Founder decisions, 2026-10-27 (hub decision `37464824`, NK-WP-0055-T10)
+
+| Decision | Effect on the ledger |
+|---|---|
+| (a) Manual Shamir unseal is the approved production mechanism for now. | Area 4's unseal gap is closed. Its other gaps remain. |
+| (b) Topaz is not required. The access-engine Go core is the production PDP ([ADR-0018](../adr/ADR-0018-access-engine-core-as-production-pdp.md)). | Area 7 is an accepted exception. Its health, freshness, load and fail-closed checks move to the core under T12, and Topaz leaves the T11 audit sources. |
+| (c) The founder, as platform-root, holds all OpenBao unseal shares. This is an accepted exception to two-of-three custody. | Area 1's escrow gap becomes an exception. Item 4 (the offline king path with SSO down) stays open under T13. |
+| (d) HA is out of scope for now. | No area changes. |
+
+Each exception is reviewed at the production declaration (T09).
 
 ## Per area
 

workplans/NK-WP-0055-security-platform-production-readiness.md

@@ -233,10 +233,11 @@ their recorded hashes, or the founder accepts single-copy custody as an exceptio
 
 ```task
 id: NK-WP-0055-T10
-status: todo
+status: done
 priority: high
 assignee: claude-code
 needs_human: true
+decision_id: "37464824-a939-415f-8a7a-5f81cbf498c8"
 ```
 
 Decide what production requires:
@@ -249,6 +250,8 @@ Decide what production requires:
 
 
 2026-10-27 founder answers: (a) manual Shamir unseal is the approved mechanism for now; (c) the founder, as platform-root, holds the OpenBao unseal shares (single holder; two-of-three escrow holders not named); (d) HA stays out of scope for now. (b) Topaz is pending an explanation of the accepted-exception consequences.
+
+2026-10-27: done. (b) accepted as an exception: the access-engine core is the production PDP, Topaz is deferred ([ADR-0018](../docs/adr/ADR-0018-access-engine-core-as-production-pdp.md)); (c) single-holder custody accepted as an exception. All answers are in hub decision `37464824` and the ledger. Exceptions are reviewed at T09.
 ## Get every audit source into the durable sink with one correlation id
 
 ```task
@@ -261,7 +264,7 @@ state_hub_task_id: "93caa9e0-3d28-58ac-808a-47e15fe6d6ab"
 
 Owners are audit-core (receiving), railiance-platform (OpenBao audit forwarding), railiance-cluster (Kubernetes API audit),
 access-engine (AUDIT-WP-0013-T02 registration) and NetKingdom (identity-provider events and the correlation-id contract).
-Topaz joins only if T10 keeps it.
+Topaz is not a source (ADR-0018).
 
 **Done when:** each owner has a task in its own workplan; identity, authorization, OpenBao, Kubernetes and workload records land
 durably; one correlation id is defined and tested across the onboarding chain; audit-core has a recurring restore drill and
@@ -278,7 +281,8 @@ state_hub_task_id: "c93fa290-663a-582c-a5b2-beb876fcff1e"
 ```
 
 **Done when:** dated receipts exist for the live IAM issuer conformance run (NK-WP-0054-T04), caller-auth enforcement on every
-access-engine release unit (only ops-warden is proven today), the live OpenBao auth methods and mounts against the committed
+access-engine release unit (only ops-warden is proven today), the access-engine core's health, data freshness, policy load
+status and per-consumer fail-closed stance (ADR-0018), the live OpenBao auth methods and mounts against the committed
 policies, and the tenant onboarding completion test for `tenant:coulomb`.
 
 ## Record and drill break-glass with SSO down