One row, no doctrine change. key-cape has no adapter populating the
directory user tenant, so a client registration supplies a human
principal's tenant. gate-house ruled that admissible as a declared
bounded gap rather than as the answer, on the ground that its
distinguishing case fails closed: where registration and directory
disagree, issuance is refused rather than resolved either way.
Registered here because condition 3 of that ruling requires it — a
transitional shape not held in a register becomes the permanent answer
by nobody minding it. Intended owner is left unnamed per 13's own rule
that an intended owner is a proposal to a repository rather than an
assignment onto it.
The standard stays proposed and this changes no normative text.
21 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
The round returned findings from access-engine, approval-engine,
ops-warden and net-kingdom. v0.8 stayed proposed throughout, so these
are corrections to an uncut standard rather than amendments to an
accepted one. §15 items 12-20 list them; §14 records what the round
did and did not cover.
The load-bearing one is §6.4 obligation 1. The obligation said a PEP
must hold "a decision from access-engine", and obligation 2 supplied a
digest test emphatic that it was mechanical rather than a matter of
judgement. That test establishes which request a decision is for and
nothing about who issued it, and it cannot: every input to it is either
sent by the caller or published. Fail-closed protects against a
decision point that is absent, not against one that lies. Obligation 5
was then written over a pair of artifacts whose authenticity only one
half of could be validated, since §9.4 requires the approval object to
have authenticated entries and nothing required it of the decision.
The obligation now requires attribution, states that the digest
comparison does not discharge it, and carries a declared §13 gap with
access-engine as owner rather than a mechanism the standard does not
get to choose.
Obligation 3 gains three things: the drift test promoted SHOULD to MUST
(the strongest obligation in the section had the weakest verification,
in a paragraph arguing that drift is worse than no publication), a
prohibition on totality satisfied by a catch-all, and the requirement
that an absent scope be distinguishable in the record from an unknown
one. The last closes the §16 question opened at the cut: absent fails
closed too, for the stronger reason, and the distinction is in the
record rather than in the stance.
ops-warden asked for a dated transitional unknown: fail_open converting
on coverage. Declined, with its reasons in §6.4: a sanctioned
transitional fail_open is indistinguishable at runtime from the stance
the rule forbids, and would make the rule optional at the only moment
it costs anything. Its second preference is adopted instead — §13.1
records a dated classification-coverage figure beside each stance, so a
strict consumer and an unclassified one stop reading alike. Its measured
figures are in the register, and ops-mason's unpublished map is now
marked as the plainer violation of the same obligation it always was.
§6.4 announced four obligations and listed five. §17 called ownership
of three artifacts unsettled while settling one of them in the same
sentence. §14's tally could not be checked because item 2b's numbering
left a reader unable to tell whether it was a change or a sub-clause.
§19's hole was explained where nobody looks. All four found by
approval-engine.
21 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
Updated by fix-consistency on 2026-09-07:
- update .custodian-brief.md for net-kingdom
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a
Written back by statehub fix-consistency after NK-WP-0035-T05 was added.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ek3zTdfMa35bPVDjVUyhxx
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a
Updated by fix-consistency on 2026-09-07:
- update .custodian-brief.md for net-kingdom
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a
Updated by fix-consistency on 2026-09-07:
- update .custodian-brief.md for net-kingdom
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a
gate-house circulated v0.8 with two questions for this repository as owner of
the NetKingdom emission-cadence security profile: whether §17's ownership
paragraph reads in our own voice, and whether §11's new conformance item
follows the profile or diverges from it.
§17 is confirmed as written. It assigns the generic EmissionCadenceDeclaration
contract to info-tech-canon and to net-kingdom the MUST/SHOULD split, the
rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation
obligation — which is emission-cadence-security-profile_v0.1.md §3, conjunction
included. No change.
§11 diverged in both directions and is corrected. Requiring a detection surface
of "heartbeat or reconciliation" of every load-bearing source withholds from a
volume class the expected-rate form the profile permits, and accepts for a rare
class either control alone where the profile — and the checker in
tools/emission-cadence-profile — require both. A rare class covered by a
heartbeat alone has no reconciliation to catch divergence, and one covered by
reconciliation alone produces no claim that can go missing, which is the whole
reason §9.6 rejects rate monitoring there. The item also contradicted its own
following paragraph, which admits rate monitoring except where the class is
rare.
The check now defers the form to the governing profile rather than restating a
split that is §17's to assign, carries the volume/rare distinction explicitly,
and states that classification is the source's published inventory and never the
checker's to infer from a name, payload, or observed rate — otherwise omission
detection is circular.
Change log item 6 and §14 record the review. The standard stays proposed;
publication and the acceptance flip wait on the close of the circulation round.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ek3zTdfMa35bPVDjVUyhxx
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a
secrets-engine found, and access-engine and approval-engine reported
independently within hours, that GH-DEC-2026-008 as written was
unimplementable. Where a claim travels inside the hashed request — the
dual-control pattern it was written for — embedding the claim changes the
digest of the request carrying it, so a digest recorded at issue can
never equal the final one. It is a hash cycle. A fail-closed consumer
obeying the rule would have denied destroy permanently.
The comparison is now against the digest the PDP publishes for the
request with the approval evidence excluded (flex-auth's
binding.approval_binding_digest, verified present in its schema and
tests). The exclusion rule is the PDP's to publish and a consumer MUST
NOT guess it: a digest computed under an assumed rule fails open toward
accepting a claim bound to a different request — the same failure
direction as an invented vocabulary mapping, by another road.
§6.4 obligation 5 gains the general property access-engine flagged as a
near miss rather than a request: an evidence-bearing input may be
excluded from a correspondence digest but never from the replay identity.
Two requests differing only in which approval was presented decide
differently, so collapsing them lets an allow obtained with a valid claim
be replayed against a request carrying none — a fail-open hole reached by
a refactor that looks like simplification.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
Authored by gate-house under GH-WP-0003-T06; published here. v0.7 stays
accepted and unedited until v0.8 is accepted in its place.
Eleven changes across §6.4, §8, §9.5, §9.7.3, §11, §12, §13.1, §16 and
§17, each carrying the decision record that already governs its
implementers. Three correct a rule that was unsafe or unfalsifiable as
written — consume ordering, the volatility boundary, and a permissive
unknown. Three close gaps between rules already made. One corrects an
ownership paragraph that a later decision made false, and §11/§12 gain
the general form of that failure after six instances in one week.
Ten of the eleven were requested by another repository, seven by a
repository arguing against its own interest. §14 is therefore rewritten:
this version is circulated for review rather than accepted on the owner's
decision as v0.7 was, because it imposes costs on named repositories —
ops-warden acquires a non-conformant stance cell, approval-engine an
issue-time obligation — and a cost imposed without a review round is what
§12 exists to catch late.
Section numbering is unchanged; the estate cites it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
Requested by tenant-engine TEN-WP-0011-T06 after the v0.7 Engine/PIP
declaration and shipped guardrails.
Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
The standard is accepted at v0.7 on the owner's decision. §14 keeps two things
apart, as ops-warden asked: boundary assent, given by four repositories at the
version named in each record and undisturbed since; and revision review, where
all four reviewed v0.6 and every change in v0.7 is the adopted remedy of a
finding they raised. What is not claimed: nobody has reviewed v0.7 as text.
Accepting a standard nobody has re-read is deliberate. The estate will learn
more from using it than from another round of prose, and the v0.7 changes were
requested rather than invented. Findings against the accepted text stay
welcome — that is §12's normal business, not an exception.
The companion moves from canon/standards to the repository root as
SECURITY-COMPANION.md and becomes v0.2, so onboarding starts at the front door
rather than three directories down. One copy, not two: a second copy of a fact
is how the estate gets two sources for it.
v0.2 closes the gap access-engine found in v0.1 — it said publish your stance
map without saying where, and omitted the inventory obligation, so a repository
could satisfy it faithfully and no register would learn of its stance. It also
carries what v0.7 added: the corrected PEP obligations, the evidence threat
decomposition with its stated residual, cadence as MUST for load-bearing
sources with heartbeat for rare ones, the four agent rules and the glas-harness
seam, and the Railiance axes with their unsettled mapping.
It points readers at ops-warden for how to get things done. The companion says
what the rules are; ops-warden stewards the paths through them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
Four reviews. kings-guard found that v0.6 claimed a human/agent principal
separation in §1 and §15 while §3.4 was byte-identical to v0.5: a silent edit
failure, and their framing is the right one — a rule stated about a standard in
its own change log is not a rule, which is §11's principle turned on the
standard. The same failure had dropped two §16 entries. Both restored.
§3.4 is now written: no standing credential, conduit or engine API only, agent
memory is not a state plane, every action reconstructable as the caller's, and
the seam with glas-harness for session semantics.
The rest are collisions between rules each written for its own clean case:
- §6.4(1) forbade what §6.4(3) blesses. A PEP may proceed under its declared
§9.3 stance where the application of that stance is recorded in place of the
decision — stricter than v0.6, since a fail-open result becomes metadata
rather than silence. Raised by ops-warden, the reference shape it made a
violation.
- §6.4(2) forbade the session-bound allow §9.7.1 permits. Now scoped to replay
outside the decision's own binding and lifetime, with access-engine's
canonical request digest as the mechanical test. Negative caching ruled
permitted where the refusal is recorded and the lifetime declared.
- §13.1 now exists: v0.6 mandated a stance-map register and implemented none.
Its first inventory has one row, which is the finding.
- §9.6 gained a threat decomposition after audit-core corrected its own remedy:
atomicity prevents accidental omission, cadence and reconciliation detect the
adversarial case, nothing prevents it at a compromised source. Cadence is now
MUST for load-bearing sources, with heartbeat or reconciliation required for
low-volume classes where rate monitoring cannot work.
- §9.7.2 splits by role: per input class at a PDP, one boundary deadline at a
PEP.
- §17 moves the decision-record schema to access-engine, which argued it against
its own interest.
- §13 stops attributing the actuation gap to kings-guard; §19 removed, since a
verdict inside a standard grades the document it lives in.
§20 records the Railiance interaction boundary on railiance-master's own
definitions: the four axes, that a workload is a managed running deployable so
approvals are never one, and that rein-* is not a fifth axis but a glas-harness
concern. What is unsettled is listed as unsettled.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
v0.6 is dense, self-referential, and written for readers who already live in the
estate. That is acceptable in canon and poor as a contract for the nine
repositories yet to declare and for the Staff agents expected to conform.
The companion is the operative form: the rules, no change log, no review
archaeology. Machine-readable layer key, the three sanctioned Tooling shapes as
a table, the PEP obligations, the evidence bound with the two unsound claims
written out, the four agent rules, and the four conformance states. The statute
governs on disagreement, and a disagreement is reportable as a finding.
Its §9 records that operations is HelixForge's responsibility — reef, rail,
rapp, rein — consuming the NetKingdom security and approval framework, and that
the interface is NOT yet specified. What holds today is only what holds for any
consumer. No mapping of those concepts onto the layer model should be assumed
until it is written; the statute's §16 carries the same open question.
Its §10 states the two things the estate cannot do yet — nothing is observed in
production, nothing can be contained automatically — so no reader plans around
a capability that does not exist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
From the independent assessment of 2026-08-29, which found the model sound as a
layering constitution and incomplete as a self-healing one: cognition,
authority, and execution are specified, but the two verbs that close a healing
loop — observe in production, actuate through a deterministic surface — are
pending, and one is unstaffed.
Section numbers below §14 are unchanged; the estate cites them.
- §3.3 types the Engine layer: PDP, PIP, Evidence, Lifecycle, with a role column
in §4. Collapsing them hid different failure modes — a PIP outage is input
degradation, a PDP outage is consumer residue, an evidence-plane outage must
not block the operation it records. A new engine is a PIP unless amended.
- §6.4 names the enforcement point. The standard was precise about the decision
and silent about the gate, so enforcement lived in Staff runbooks. Four
obligations: no side effect without a decision record, no local recaching of
the verdict, a declared unreachable-engine stance, reconstructability.
- §9.2 replaced. Containment was marked pending against kings-guard, the right
mark on the wrong repository: reduce, step-up, and isolate are
authority-changing operations, so they are rendered by an Engine and enforced
by a PEP. Actuation is an unowned Engine concept held at zero. Staff proposes
containment and never performs it.
- §3.4 separates human and agent principals inside Staff — same permissions,
different blast radius. No standing credential, conduit or engine API only,
agent memory is not a state plane, every action reconstructable as the
caller's.
- §9.7 puts time into the model: explicit lifetimes, revocation visibility
deadlines, consumption as a state change never inferred from a decision
record, and the three race modes named. §9.8 states what holds under
partition.
- §17 requires the Taxonomy artifacts — claim, decision-record, gap-record, and
emission-cadence schemas — without which §6.2 and §11 are reviewable but not
compileable. Ownership proposed, not assigned.
- §18 composes the sibling standards, which had been cited in frontmatter and
nowhere in the rules.
- §5 sunsets the uncatalogued-infrastructure carve-out. §5.3 declines a proposed
fourth "operator of third-party Tooling" shape: it would convert a tracked gap
into a permanent allowance, which is the relabelling failure this standard
exists to prevent.
- §10 gains the six artifacts a layer change must carry, written from the
zone-engine case, including a permission freeze during the cut.
- §2 lifts the observation rule so it cannot be lost in a summary. §13 separates
its three normative rules from the table, now a snapshot due to move into
maturity-engine. §16 decides the approval custody question: no. §19 records
the fitness verdict.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
All four reviewing repositories returned findings on v0.4 and one contested a
rule. Every change below came from a reviewer, not from gate-house.
- §9.1 split into `pending` (no route, capability zero) and `declared-gap`
(route exists under §5.3, capability works). v0.4's single mark would have
forced a false "pending" onto ops-warden's production SSH issuance —
the fix was worse than the defect, and the defect was in this section.
- §9.3 rewritten. flex-auth contested it and was right: it collapsed "engine
reachable but degraded" with "engine unreachable", and the second has no
evaluator in the path to express anything. Input degradation is the engine's;
unreachability is the consumer's, bounded by a declared auditable total
stance — which ops-warden ADR-0009 already satisfies. v0.4 had ruled against
shipped behaviour in a repository that assented to it.
- §5 scoped: "Tooling-layer system" means a §4 Tooling row. Without this every
Staff repository was in undeclared violation for writing progress events.
- §9.4 requires the outbox to be local — no synchronous audit-core dependency
inside the state-change transaction, so an audit outage cannot block a
revocation.
- §9.5 forbids compiling maturity levels into registry content while decision
provenance carries no registry-snapshot digest.
- §9.6 gained load-bearing versus attributive evidence, the mirror rule that
absence is not evidence of non-occurrence, and kings-guard's finding that
suppression biases posture optimistic and silently.
- §11 gained a fourth state: blocked-clean, which MUST NOT rank below
conforming. A repository that declined a break-glass path and left a
capability at zero complied at cost; one that quietly opened a client and
declared nothing did not.
- §11 gained a machine-readable declaration form; ops-warden's layer.yaml is
the reference implementation.
- §13 gained state and owner-status columns; access-engine's decline of
authentication evidence is recorded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
Regenerated by fix-consistency; adds the inbound layer-declaration intake.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
Conformance sweep across the §4 catalog found two defects in this standard.
§11 required every catalogued repository to declare its layer in INTENT.md,
which OpenBao cannot do — the estate catalogues it but does not author it. That
is the §9.1 defect applied to conformance rather than capability: a rule
assigning an obligation the holder cannot discharge. For components the estate
does not author, the catalog row is the declaration.
§11 also did not say what a declaration is. A layer stated about a repository
by another repository is not one. The nine repositories carrying gate-house's
layering review note appear to declare a layer, but the words are gate-house's
and sit above a line admitting the body is unadapted — assertion, not assent,
which is the pattern this estate rejects.
§14 now records the honest count: seven of fifteen estate-authored repositories
have declared in their own voice. Adoption is not claimed on the basis of notes
gate-house wrote into other repositories.
Amended in place rather than versioned: v0.4 is proposed and unassented.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
