lane.py setup/verify/teardown (attended; CCR-2026-0057 sha256-bound):
generates password and TOTP seed in memory, KV CAS=0 with coding agents
fenced, LLDAP user syn-journey with no groups, privacyIDEA TOTP token with
enrollment confirmation, live journey as proof. SecurityCase for the public
KeyCape client nk-synthetic-journey; syn-journey declared SERVICE (planned);
proposed syn-<check> naming row in the SI standard; founder runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
All five NK-WP-0053 stages passed on generation 20261031T034845Z-a13dc92e2c61,
the first capture after the 2026-10-30 bind split, operated by admin. Uncounted
attempts are kept with their causes. The drill document gains the OpenBao
platform-admin login that stage 1 silently requires. The LLDAP declaration moves
ld-admin and the svc-* binds to active and admin to human-only; SI-X1 is closed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Option A is phase 1 with no hub_core change; session/run id equality only; phase 3 observes
tokens and enforcement is decided later; no backfill. Sent to state-hub. Decision c926a190
resolved.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
The founder ratified the standard (status accepted) on 2026-10-25 and accepted the
emergent-security start card 0.2.7. Ratification applies no exception's elimination path,
changes no live service and does not make any declaration owner-confirmed. T02 done.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
security-canon confirmed all five mode readings and found citation errors, now
corrected in section 4 and 8 (anti-patterns cited as rules, a MUST resting on a SHOULD,
INV-001 for SI-9, SI-15 beyond AUDIT-001). Environment of platform-root, GOVERN for a
single-tier service admin (SI-4 allows it), principal_type ownership wording. Records
railiance-platform's prepared F-1 and aal2 changes (source only), key-cape's agent
token mechanism, glas-harness's harness-launched-only scope and state-hub's attribution
design. A hub decision routes ratification and the workers' open choices. No founder
decision changed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
The founder accepted the SecurityCanon-profile approach and confirmed the platform-root
and admin definitions. T02 now waits on railiance-platform (F-1, aal2) and security-canon
(mode readings) before ratification as v0.1. The review decision is resolved.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Schema, validator, fixtures, declarations and tests (40 pass) now use the imported
principal_type and authority grants MODE @ SCOPE with activation and environments,
estate conventions bind and service-admin, unknown placeholders, and an elimination
path on every exception. SI-4 and SI-7 became decidable. Before/after over the same
declarations: 1/11/2/5/6 to 1/10/2/5/7 (non-conformant/unknown/excepted/planned/
conformant); the only move is KeyCape's secrets-engine-openbao client, whose scope is
established. lldap/admin is now also excepted under SI-4.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Review against security-canon (Mode of Authority, SEC-DSM 1.0.0) showed the draft
restated canon rules and invented a parallel taxonomy. Draft-3 imports principal_type
and MODE @ SCOPE grants, treats break-glass as an activation, cites SEC-DSM per rule,
states the estate identities in canon terms and adds SI-15 (accountable automation:
prepare, admit, execute, verify, retain). Founder decisions and rule ids are kept.
For agents: tools/security-tools.json and make security-tools list each security tool,
the question it answers and whether an agent may run it; a test keeps the index
complete. AGENTS.md and CLAUDE.md carry the same quickstart block. Validator migration
to grants is T03b. Review record in history/.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Founder clarifications: the SI-14 token ceiling is 60 minutes (3600 s); ld-admin is for
LLDAP only and the name admin remains the human platform administrator's wherever it
appears. The LLDAP rehearsal is now introducing ld-admin by configuration and demoting
admin, not renaming. The validator rejects a service-admin named admin.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Applied the founder's four decisions: OpenBao platform-admin binds aal2 (SI-8 MUST);
the human administrator keeps directory admin rights through an admin group (SI-5);
declarations start in this repository and move to the services; agents get their own
class and rule SI-14. Finding F-1: the coding-agent role presents as a service against
IAM Profile v0.3. Schema, validator and tests follow (37 pass). Rehearsals listed, not
decided. Not ratified; owner review still open.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Schema, validator (30 tests), make targets and eight declarations authored from the
inventory, all unconfirmed by their owners. First run: 0 non-conformant, 12 unknown,
2 excepted, 5 planned, 6 conformant. Provisional: built against draft-1 before the
founder's review. Building it changed the draft: custody is a list, SI-X1 now covers
SI-9 and NAMING, and the reserved-name rule applies only to credential-holding
identities (open question 7). Unknown is a finding for every class.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Thirteen rules (one identity one class, people and services never share a
credential, read-only per-service bind identities, one service-admin per
service, break-glass is not routine, assurance on privileged roles, custody
class, declaration, recovery, validation run by the operator identity), naming
svc-<service> and <short>-admin, five initial exceptions and six open questions.
Proposed; extends IAM Profile v0.3 and Credential Management v0.2. Hub decision
routes the review.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Section 3.3 of security-layer-model v0.9 now states that an engine enables one capability, that several engines may share a store, and that operator use is a separate access rule. Accepted v0.8 is unchanged.
Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
Folds NK-1.3-C1/C2, RPF-1.3-C1/C2, RAPPS-1.3-C3, KC-1.3-C1 and the OW-1.3-C1 lane names.
Parameters untouched (fingerprint unchanged). The execution_descriptors map is
regenerated after the adapter changes land.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
Canon section 3 defines warden_executes narrowly and adds per-step lane,
value_handling and ready_check; catalog entries need a templated body. The
type gets lanes, generated-in-custody minting, a Ready gate before bind-env,
memberships only from the accepted case, mfa-pinned and secret-delivered
checks, and the R4-prime catalog body. 110 tests pass. Memo r3 supersedes r2
and validates on both sides.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
Derive custody at platform/workloads/keycape/{client_id} (secret_ref is no
longer case-settable), reuse the workload-kv-read-keycape-* policy family with
templated bodies, add the external-secrets-keycape-{client_id} ESO role, name
the catalog entry {consuming_service}-keycape-client and collapse the duplicate
KV-path rollback. Schema and validator require a body on policy/role items.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 330051@bnt-lap001
Assistant-Session: b98d4912-95a3-4619-b7fb-57aa1db7407b
security-case-types_v0.1 accepted by the founder 2026-10-08. Adds JSON schemas
for types and cases, tools/security-case-types/security_case_validator.py
(validate-type, validate-case, render via the scenario composer, plan-only),
and a runnable _template type with README sections, an example case and tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
security-case-types_v0.1 (proposed): types designed once with docs, tests and
an informed-decision; known cases light (accept, ops-mason materializes,
ops-warden follows through). Founder direction 2026-10-08.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
- playbook-capability-contract_v0.2.md (proposed): adds the
execution-attribution receipt field list (NK-WP-0040-T01).
- iam-profile_v0.4.md (proposed): adds the workload-requested step-up
contract (acr_values, no-factor refusal, assurance.level to flex-auth)
(NK-WP-0042-T01).
- Route the remaining externally-owned decisions (NK-WP-0040-T02 to
audit-core/Railiance, NK-WP-0042-T02 to user-engine, NK-WP-0039-T04 to
flex-auth/tenant-engine) and mark those workplans blocked.
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 321494@bnt-lap001
Assistant-Session: 2c8a5cd1-573e-4bae-ab2b-29bc6c8ed4e9
One row, no doctrine change. key-cape has no adapter populating the
directory user tenant, so a client registration supplies a human
principal's tenant. gate-house ruled that admissible as a declared
bounded gap rather than as the answer, on the ground that its
distinguishing case fails closed: where registration and directory
disagree, issuance is refused rather than resolved either way.
Registered here because condition 3 of that ruling requires it — a
transitional shape not held in a register becomes the permanent answer
by nobody minding it. Intended owner is left unnamed per 13's own rule
that an intended owner is a proposal to a repository rather than an
assignment onto it.
The standard stays proposed and this changes no normative text.
21 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
The round returned findings from access-engine, approval-engine,
ops-warden and net-kingdom. v0.8 stayed proposed throughout, so these
are corrections to an uncut standard rather than amendments to an
accepted one. §15 items 12-20 list them; §14 records what the round
did and did not cover.
The load-bearing one is §6.4 obligation 1. The obligation said a PEP
must hold "a decision from access-engine", and obligation 2 supplied a
digest test emphatic that it was mechanical rather than a matter of
judgement. That test establishes which request a decision is for and
nothing about who issued it, and it cannot: every input to it is either
sent by the caller or published. Fail-closed protects against a
decision point that is absent, not against one that lies. Obligation 5
was then written over a pair of artifacts whose authenticity only one
half of could be validated, since §9.4 requires the approval object to
have authenticated entries and nothing required it of the decision.
The obligation now requires attribution, states that the digest
comparison does not discharge it, and carries a declared §13 gap with
access-engine as owner rather than a mechanism the standard does not
get to choose.
Obligation 3 gains three things: the drift test promoted SHOULD to MUST
(the strongest obligation in the section had the weakest verification,
in a paragraph arguing that drift is worse than no publication), a
prohibition on totality satisfied by a catch-all, and the requirement
that an absent scope be distinguishable in the record from an unknown
one. The last closes the §16 question opened at the cut: absent fails
closed too, for the stronger reason, and the distinction is in the
record rather than in the stance.
ops-warden asked for a dated transitional unknown: fail_open converting
on coverage. Declined, with its reasons in §6.4: a sanctioned
transitional fail_open is indistinguishable at runtime from the stance
the rule forbids, and would make the rule optional at the only moment
it costs anything. Its second preference is adopted instead — §13.1
records a dated classification-coverage figure beside each stance, so a
strict consumer and an unclassified one stop reading alike. Its measured
figures are in the register, and ops-mason's unpublished map is now
marked as the plainer violation of the same obligation it always was.
§6.4 announced four obligations and listed five. §17 called ownership
of three artifacts unsettled while settling one of them in the same
sentence. §14's tally could not be checked because item 2b's numbering
left a reader unable to tell whether it was a change or a sub-clause.
§19's hole was explained where nobody looks. All four found by
approval-engine.
21 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
gate-house circulated v0.8 with two questions for this repository as owner of
the NetKingdom emission-cadence security profile: whether §17's ownership
paragraph reads in our own voice, and whether §11's new conformance item
follows the profile or diverges from it.
§17 is confirmed as written. It assigns the generic EmissionCadenceDeclaration
contract to info-tech-canon and to net-kingdom the MUST/SHOULD split, the
rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation
obligation — which is emission-cadence-security-profile_v0.1.md §3, conjunction
included. No change.
§11 diverged in both directions and is corrected. Requiring a detection surface
of "heartbeat or reconciliation" of every load-bearing source withholds from a
volume class the expected-rate form the profile permits, and accepts for a rare
class either control alone where the profile — and the checker in
tools/emission-cadence-profile — require both. A rare class covered by a
heartbeat alone has no reconciliation to catch divergence, and one covered by
reconciliation alone produces no claim that can go missing, which is the whole
reason §9.6 rejects rate monitoring there. The item also contradicted its own
following paragraph, which admits rate monitoring except where the class is
rare.
The check now defers the form to the governing profile rather than restating a
split that is §17's to assign, carries the volume/rare distinction explicitly,
and states that classification is the source's published inventory and never the
checker's to infer from a name, payload, or observed rate — otherwise omission
detection is circular.
Change log item 6 and §14 record the review. The standard stays proposed;
publication and the acceptance flip wait on the close of the circulation round.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ek3zTdfMa35bPVDjVUyhxx
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a
secrets-engine found, and access-engine and approval-engine reported
independently within hours, that GH-DEC-2026-008 as written was
unimplementable. Where a claim travels inside the hashed request — the
dual-control pattern it was written for — embedding the claim changes the
digest of the request carrying it, so a digest recorded at issue can
never equal the final one. It is a hash cycle. A fail-closed consumer
obeying the rule would have denied destroy permanently.
The comparison is now against the digest the PDP publishes for the
request with the approval evidence excluded (flex-auth's
binding.approval_binding_digest, verified present in its schema and
tests). The exclusion rule is the PDP's to publish and a consumer MUST
NOT guess it: a digest computed under an assumed rule fails open toward
accepting a claim bound to a different request — the same failure
direction as an invented vocabulary mapping, by another road.
§6.4 obligation 5 gains the general property access-engine flagged as a
near miss rather than a request: an evidence-bearing input may be
excluded from a correspondence digest but never from the replay identity.
Two requests differing only in which approval was presented decide
differently, so collapsing them lets an allow obtained with a valid claim
be replayed against a request carrying none — a fail-open hole reached by
a refactor that looks like simplification.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
Authored by gate-house under GH-WP-0003-T06; published here. v0.7 stays
accepted and unedited until v0.8 is accepted in its place.
Eleven changes across §6.4, §8, §9.5, §9.7.3, §11, §12, §13.1, §16 and
§17, each carrying the decision record that already governs its
implementers. Three correct a rule that was unsafe or unfalsifiable as
written — consume ordering, the volatility boundary, and a permissive
unknown. Three close gaps between rules already made. One corrects an
ownership paragraph that a later decision made false, and §11/§12 gain
the general form of that failure after six instances in one week.
Ten of the eleven were requested by another repository, seven by a
repository arguing against its own interest. §14 is therefore rewritten:
this version is circulated for review rather than accepted on the owner's
decision as v0.7 was, because it imposes costs on named repositories —
ops-warden acquires a non-conformant stance cell, approval-engine an
issue-time obligation — and a cost imposed without a review round is what
§12 exists to catch late.
Section numbering is unchanged; the estate cites it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
The standard is accepted at v0.7 on the owner's decision. §14 keeps two things
apart, as ops-warden asked: boundary assent, given by four repositories at the
version named in each record and undisturbed since; and revision review, where
all four reviewed v0.6 and every change in v0.7 is the adopted remedy of a
finding they raised. What is not claimed: nobody has reviewed v0.7 as text.
Accepting a standard nobody has re-read is deliberate. The estate will learn
more from using it than from another round of prose, and the v0.7 changes were
requested rather than invented. Findings against the accepted text stay
welcome — that is §12's normal business, not an exception.
The companion moves from canon/standards to the repository root as
SECURITY-COMPANION.md and becomes v0.2, so onboarding starts at the front door
rather than three directories down. One copy, not two: a second copy of a fact
is how the estate gets two sources for it.
v0.2 closes the gap access-engine found in v0.1 — it said publish your stance
map without saying where, and omitted the inventory obligation, so a repository
could satisfy it faithfully and no register would learn of its stance. It also
carries what v0.7 added: the corrected PEP obligations, the evidence threat
decomposition with its stated residual, cadence as MUST for load-bearing
sources with heartbeat for rare ones, the four agent rules and the glas-harness
seam, and the Railiance axes with their unsettled mapping.
It points readers at ops-warden for how to get things done. The companion says
what the rules are; ops-warden stewards the paths through them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
Four reviews. kings-guard found that v0.6 claimed a human/agent principal
separation in §1 and §15 while §3.4 was byte-identical to v0.5: a silent edit
failure, and their framing is the right one — a rule stated about a standard in
its own change log is not a rule, which is §11's principle turned on the
standard. The same failure had dropped two §16 entries. Both restored.
§3.4 is now written: no standing credential, conduit or engine API only, agent
memory is not a state plane, every action reconstructable as the caller's, and
the seam with glas-harness for session semantics.
The rest are collisions between rules each written for its own clean case:
- §6.4(1) forbade what §6.4(3) blesses. A PEP may proceed under its declared
§9.3 stance where the application of that stance is recorded in place of the
decision — stricter than v0.6, since a fail-open result becomes metadata
rather than silence. Raised by ops-warden, the reference shape it made a
violation.
- §6.4(2) forbade the session-bound allow §9.7.1 permits. Now scoped to replay
outside the decision's own binding and lifetime, with access-engine's
canonical request digest as the mechanical test. Negative caching ruled
permitted where the refusal is recorded and the lifetime declared.
- §13.1 now exists: v0.6 mandated a stance-map register and implemented none.
Its first inventory has one row, which is the finding.
- §9.6 gained a threat decomposition after audit-core corrected its own remedy:
atomicity prevents accidental omission, cadence and reconciliation detect the
adversarial case, nothing prevents it at a compromised source. Cadence is now
MUST for load-bearing sources, with heartbeat or reconciliation required for
low-volume classes where rate monitoring cannot work.
- §9.7.2 splits by role: per input class at a PDP, one boundary deadline at a
PEP.
- §17 moves the decision-record schema to access-engine, which argued it against
its own interest.
- §13 stops attributing the actuation gap to kings-guard; §19 removed, since a
verdict inside a standard grades the document it lives in.
§20 records the Railiance interaction boundary on railiance-master's own
definitions: the four axes, that a workload is a managed running deployable so
approvals are never one, and that rein-* is not a fifth axis but a glas-harness
concern. What is unsettled is listed as unsettled.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
v0.6 is dense, self-referential, and written for readers who already live in the
estate. That is acceptable in canon and poor as a contract for the nine
repositories yet to declare and for the Staff agents expected to conform.
The companion is the operative form: the rules, no change log, no review
archaeology. Machine-readable layer key, the three sanctioned Tooling shapes as
a table, the PEP obligations, the evidence bound with the two unsound claims
written out, the four agent rules, and the four conformance states. The statute
governs on disagreement, and a disagreement is reportable as a finding.
Its §9 records that operations is HelixForge's responsibility — reef, rail,
rapp, rein — consuming the NetKingdom security and approval framework, and that
the interface is NOT yet specified. What holds today is only what holds for any
consumer. No mapping of those concepts onto the layer model should be assumed
until it is written; the statute's §16 carries the same open question.
Its §10 states the two things the estate cannot do yet — nothing is observed in
production, nothing can be contained automatically — so no reader plans around
a capability that does not exist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
From the independent assessment of 2026-08-29, which found the model sound as a
layering constitution and incomplete as a self-healing one: cognition,
authority, and execution are specified, but the two verbs that close a healing
loop — observe in production, actuate through a deterministic surface — are
pending, and one is unstaffed.
Section numbers below §14 are unchanged; the estate cites them.
- §3.3 types the Engine layer: PDP, PIP, Evidence, Lifecycle, with a role column
in §4. Collapsing them hid different failure modes — a PIP outage is input
degradation, a PDP outage is consumer residue, an evidence-plane outage must
not block the operation it records. A new engine is a PIP unless amended.
- §6.4 names the enforcement point. The standard was precise about the decision
and silent about the gate, so enforcement lived in Staff runbooks. Four
obligations: no side effect without a decision record, no local recaching of
the verdict, a declared unreachable-engine stance, reconstructability.
- §9.2 replaced. Containment was marked pending against kings-guard, the right
mark on the wrong repository: reduce, step-up, and isolate are
authority-changing operations, so they are rendered by an Engine and enforced
by a PEP. Actuation is an unowned Engine concept held at zero. Staff proposes
containment and never performs it.
- §3.4 separates human and agent principals inside Staff — same permissions,
different blast radius. No standing credential, conduit or engine API only,
agent memory is not a state plane, every action reconstructable as the
caller's.
- §9.7 puts time into the model: explicit lifetimes, revocation visibility
deadlines, consumption as a state change never inferred from a decision
record, and the three race modes named. §9.8 states what holds under
partition.
- §17 requires the Taxonomy artifacts — claim, decision-record, gap-record, and
emission-cadence schemas — without which §6.2 and §11 are reviewable but not
compileable. Ownership proposed, not assigned.
- §18 composes the sibling standards, which had been cited in frontmatter and
nowhere in the rules.
- §5 sunsets the uncatalogued-infrastructure carve-out. §5.3 declines a proposed
fourth "operator of third-party Tooling" shape: it would convert a tracked gap
into a permanent allowance, which is the relabelling failure this standard
exists to prevent.
- §10 gains the six artifacts a layer change must carry, written from the
zone-engine case, including a permission freeze during the cut.
- §2 lifts the observation rule so it cannot be lost in a summary. §13 separates
its three normative rules from the table, now a snapshot due to move into
maturity-engine. §16 decides the approval custody question: no. §19 records
the fitness verdict.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
All four reviewing repositories returned findings on v0.4 and one contested a
rule. Every change below came from a reviewer, not from gate-house.
- §9.1 split into `pending` (no route, capability zero) and `declared-gap`
(route exists under §5.3, capability works). v0.4's single mark would have
forced a false "pending" onto ops-warden's production SSH issuance —
the fix was worse than the defect, and the defect was in this section.
- §9.3 rewritten. flex-auth contested it and was right: it collapsed "engine
reachable but degraded" with "engine unreachable", and the second has no
evaluator in the path to express anything. Input degradation is the engine's;
unreachability is the consumer's, bounded by a declared auditable total
stance — which ops-warden ADR-0009 already satisfies. v0.4 had ruled against
shipped behaviour in a repository that assented to it.
- §5 scoped: "Tooling-layer system" means a §4 Tooling row. Without this every
Staff repository was in undeclared violation for writing progress events.
- §9.4 requires the outbox to be local — no synchronous audit-core dependency
inside the state-change transaction, so an audit outage cannot block a
revocation.
- §9.5 forbids compiling maturity levels into registry content while decision
provenance carries no registry-snapshot digest.
- §9.6 gained load-bearing versus attributive evidence, the mirror rule that
absence is not evidence of non-occurrence, and kings-guard's finding that
suppression biases posture optimistic and silently.
- §11 gained a fourth state: blocked-clean, which MUST NOT rank below
conforming. A repository that declined a break-glass path and left a
capability at zero complied at cost; one that quietly opened a client and
declared nothing did not.
- §11 gained a machine-readable declaration form; ops-warden's layer.yaml is
the reference implementation.
- §13 gained state and owner-status columns; access-engine's decline of
authentication evidence is recorded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
Conformance sweep across the §4 catalog found two defects in this standard.
§11 required every catalogued repository to declare its layer in INTENT.md,
which OpenBao cannot do — the estate catalogues it but does not author it. That
is the §9.1 defect applied to conformance rather than capability: a rule
assigning an obligation the holder cannot discharge. For components the estate
does not author, the catalog row is the declaration.
§11 also did not say what a declaration is. A layer stated about a repository
by another repository is not one. The nine repositories carrying gate-house's
layering review note appear to declare a layer, but the words are gate-house's
and sit above a line admitting the body is unadapted — assertion, not assent,
which is the pattern this estate rejects.
§14 now records the honest count: seven of fifteen estate-authored repositories
have declared in their own voice. Adoption is not claimed on the basis of notes
gate-house wrote into other repositories.
Amended in place rather than versioned: v0.4 is proposed and unassented.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
