From f9e1611cc7090f76314de5134f1b548a1903cc64 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 9 Sep 2026 23:20:22 +0200 Subject: [PATCH] Register the tenant-provenance gap in 13 (GH-DEC-2026-013) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One row, no doctrine change. key-cape has no adapter populating the directory user tenant, so a client registration supplies a human principal's tenant. gate-house ruled that admissible as a declared bounded gap rather than as the answer, on the ground that its distinguishing case fails closed: where registration and directory disagree, issuance is refused rather than resolved either way. Registered here because condition 3 of that ruling requires it — a transitional shape not held in a register becomes the permanent answer by nobody minding it. Intended owner is left unnamed per 13's own rule that an intended owner is a proposal to a repository rather than an assignment onto it. The standard stays proposed and this changes no normative text. 21 tests pass. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm Assistant: claude-code Assistant-Model: opus Assistant-Process: 1754332@bnt-lap001 Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0 --- canon/standards/security-layer-model_v0.8.md | 1 + 1 file changed, 1 insertion(+) diff --git a/canon/standards/security-layer-model_v0.8.md b/canon/standards/security-layer-model_v0.8.md index 8061b8a..392b11c 100644 --- a/canon/standards/security-layer-model_v0.8.md +++ b/canon/standards/security-layer-model_v0.8.md @@ -1319,6 +1319,7 @@ register distinguishes proposed from assented. | Stance-map register had no implementation | declared-contact | ops-warden, access-engine | gate-house | resolved in §13.1 | | Registry-snapshot digest in decision provenance | declared-contact | flex-auth | flex-auth | self-declared | | Decision-record authenticity — a PEP cannot attribute a decision to `access-engine` (§6.4 obligation 1); unsigned envelope, plain-HTTP pins | declared-contact | flex-auth | flex-auth | self-declared (`FLEX-DEC-2026-010`, `FLEX-WP-0024`) | +| Human principal's tenant is unresolvable from the directory, so a client registration supplies it (`GH-DEC-2026-013`) | declared-contact | key-cape | directory adapter — unnamed | proposed | | Approval storage and lifecycle | — | flex-auth | approval-engine | assigned (§9.4) | | Approval evidence | — | gate-house | audit-core | **assented** (`AUDIT-IN-0001`) | | Approval evidence custody stronger than the shipped bound — WORM, object lock, transparency log | unowned-capability | audit-core | — | unassigned |