net-kingdom/docs/security-layer-v0.8-acceptance.md

Security-layer v0.8 publication acceptance — 2026-10-11

NetKingdom, the publication owner, accepts and publishes the exact finalized cut adopted by confirmed native human memo infd-20261010-security-layer-v08, version 2, approval 8432d0dc-adc0-42d0-9a5b-6b71ff492e15, accepted at 2026-10-10T23:23:53Z. The approved proposed source SHA256 is 103a635f19ab9fe53094d69c3eeebcccd8e87ac9588846167e7e204a7c6de167. The final accepted artifact adds acceptance frontmatter and §14 notice only; its approved normative provisions are unchanged. Native disposition disp-43e051e9-b12f-4c34-b26e-40b85a96c2e8 is confirmed, non-stale and accepts the exact source above. The native disposition receipt remains in the-custodian/docs/evidence/2026-10-10-security-consolidation/human-acceptance-receipts.json, rather than being replaced by a fabricated owner approval. This source acceptance approves no live workload, credential, privilege, MFA journey or SecurityCase execution.

Gates verified

GH-DEC-2026-019's three closing conditions are evidenced in the current GateHouse owner record: T09 exact A11 r2/A12 r3 returns dispositioned, T07/T12 AuditCore findings returned and ruled, and T08 four declarations or dated gaps supplied. Publication-readiness sources pin each receipt and amendment. The human memo expressly adopts the bounded A13 completed-rename adaptation. No prior-revision assent is promoted into blanket review of the final cut.

NetKingdom flips v0.8 to accepted and README to the governing source. Historical v0.7 canon is unchanged. Policy-nexus registers v0.8 at standards/security-layer-model/v0.8/ with immutable accepted-1 revision; the old v0.7 current route gains a superseded notice pointing to v0.8, leaving its historical immutable revision untouched. The derived working companion moves to v0.3, with the statute continuing to govern any discrepancy. Registration/build verification is source publication preparation; serving the new site is a separate PolicyNexus release, never inferred from a local build.

Post-flip owner migration handoff

GateHouse GH-WP-0004-T10 may record this exact publisher acceptance. T11 remains open until all eight implementers re-point VALIDATED_AGAINST and converge on the OpsWarden reference detector, or retain a dated reason. These are executable checker changes, not declaration-version pins. Preserve old versions in detector negative fixtures: they prove rejection of pins and must not be mechanically replaced just because the normative version changed.

Owner	Checker implementation	Verification
kings-guard	scripts/check_layer_conformance.py	tests/test_layer_conformance.py
user-engine	scripts/check_layer_conformance.py	tests/test_layer_conformance.py
zone-engine	tools/check_layer_conformance.py	tests/test_layer_conformance.py
secrets-engine	scripts/check_layer_conformance.py	tests/test_layer_conformance.py
maturity-engine	scripts/check_layer_conformance.py	tests/test_layer_conformance.py
ops-warden	scripts/check_layer_conformance.py (reference)	tests/test_layer_conformance.py
tenant-engine	scripts/check_layer_conformance.py	tests/test_layer_conformance.py
access-engine (historical flex-auth)	internal/layer/conformance.go, tools/check_layer_conformance.go	internal/layer/conformance_test.go

Each run must report accepted v0.8 plus its explicit declared scope. Different source detectors remain owner-specific; convergence means the same declaration pin/provenance semantics, authoritative INTENT and derived-sidecar disagreement findings. It does not require replacing meaningful local detectors by a generic copy. WhitehatSecurity's remaining conformance_state declaration removal is also GH T11 and is not closed by these eight migrations.

GateHouse retains the separate §3.4 doctrine row question (GH T06) and KingsGuard §9.5 review nonclaim. This acceptance waives neither. Existing runtime capabilities, zero-capability gaps and native security acceptance stay in their owner plans.