Assent to the NetKingdom security layer model (WARDEN-IN-0001)

gate-house asked ops-warden to assent to three boundary items ratified in
GH-DEC-2026-001. All three are assented in ADR-0010.

Staff: accepted. Grepping section 5 as it invites turned up a real
non-conformance — src/warden/vault.py is a direct OpenBao client performing a
write, and so is `warden desk`'s `bao kv put`. Section 5's only escape hatch is
read-only diagnostics, which does not cover a signing write, so both are
declared in INTENT.md as an engine gap with intended owner secrets-engine and
the blocker "no engine exposes an SSH-CA surface" — ADR-0003 turned inward
rather than an exemption argued for. taint.py is metadata-only and declared
under the read-only allowance; `warden access` proxies run under the caller's
identity and supply no authority of their own.

Doctrine versus runbook: accepted. NetKingdom Security Literacy becomes a lane
routing runbook that references gate-house doctrine instead of restating it. It
had also become a prose second source for registry/routing/catalog.yaml, which
ADR-0001 already rules against.

Lane versus rule: assented unconditionally, and the access-engine veto is not
exercised. One request on sequencing only — a window where both names resolve.

gate-house added to the routing tables in INTENT.md and SCOPE.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c

docs/adr/ADR-0010-ops-warden-is-staff.md

@@ -0,0 +1,109 @@
+---
+id: ops-warden-adr-0010
+type: adr
+title: "ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap"
+domain: infotech
+repo: ops-warden
+status: accepted
+version: "1.0"
+revision: "1"
+owner: ops-warden
+binds: "ops-warden"
+created: "2026-08-28"
+updated: "2026-08-28"
+last_reviewed: "2026-08-28"
+review_interval: 3m
+enforced_by: "INTENT.md layer declaration; docs/adr/ADR-0002; docs/adr/ADR-0003; docs/adr/ADR-0005; registry/routing/catalog.yaml delegation fields"
+supersedes: ""
+successor: ""
+---
+
+# ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap
+
+## Status
+
+Accepted 2026-08-28, answering intake `WARDEN-IN-0001` from gate-house, which
+carries decision `GH-DEC-2026-001`. The standard being adopted —
+`net-kingdom/canon/standards/security-layer-model_v0.1.md` — is `proposed`, and was
+proposed pending assent from flex-auth, kings-guard, and ops-warden. This ADR is
+ops-warden's half of that assent.
+
+## Context
+
+The estate acquired overlapping claims to the same responsibility, most visibly two
+repositories describing themselves as the authorization control plane. The layer
+model resolves the overlap by layering repositories on determinism — Taxonomy,
+Tooling, Engines, Staff — and by two rules: Staff never touches Tooling directly
+(§5), and `access-engine` is the only policy decision point (§6).
+
+ops-warden is assigned Staff. Two demarcations follow that touch this repository:
+the security curriculum it had been carrying belongs to gate-house, and the words
+*access lane* and *access rule* are bound to different owners.
+
+Full reasoning: `history/2026-08-28-security-layer-model-assent.md`.
+
+## Decision
+
+**1. ops-warden is Staff and declares it.** `INTENT.md` carries the layer label and
+the §5 invariant. ops-warden holds no state another layer depends on at runtime and
+renders no authorization decision — it consumes them.
+
+**2. Lanes, not rules.** ops-warden owns *how* a worker reaches a host: SSH
+certificate issuance, the routing catalog, `warden access`, `warden plan`,
+`cert_command`. It never owns *whether* a worker may — that is `access-engine`
+(today `flex-auth`), and ops-warden neither renders nor caches that decision. This
+restates what `ADR-0002` and `ADR-0005` already bind; it is recorded here because
+the demarcation is now normative estate-wide and other repositories rely on
+ops-warden holding to it. The ruled rename `flex-auth` → `access-engine` is assented
+to; ops-warden asks only for a window in which both names resolve.
+
+**3. Doctrine goes to gate-house; runbooks stay here.** ops-warden does not restate
+security doctrine, the authority model, or the curriculum. It references
+gate-house's. It keeps everything operational about the lanes it stewards: which
+subsystem owns which need, how to obtain a credential lane by lane, and conformance
+evidence for its own lanes. `.claude/rules/credential-routing.md` is runbook, not
+curriculum, and stays inlined in this and every other repository.
+
+**4. One declared engine gap, not an exemption.** `src/warden/vault.py` (`VaultCA`)
+is a direct OpenBao client performing a write from a Staff repository. It is a §5
+non-conformance. ops-warden declares it rather than arguing it away:
+
+- **intended owner:** `secrets-engine` (credential abstraction, custody, lifecycle)
+- **blocked on:** no engine exposes an SSH certificate signing surface
+- **review:** with this ADR, every 3 months
+
+Until that surface exists, ops-warden continues to sign — refusing to would remove
+production host access to close a documentation gap — and reports the position as
+open. `warden desk`'s `bao kv put` is declared on the same terms. `taint.py` is
+metadata-only observation, declared under §5's read-only allowance. `proxy.py`
+supplies no authority of its own: it runs the owner's tool under the caller's
+identity and is governed by `ADR-0002`.
+
+This is `ADR-0003` turned inward. ops-warden has required an intended owner and a
+blocker on 27 catalog lanes it holds for other repositories; it holds itself to the
+same record.
+
+## Consequences
+
+ops-warden's conformance under §10 is *declared non-conformant with a tracked
+closure path*, not clean. That is the accurate state and it is the state that gets
+fixed, because it names an owner who can fix it.
+
+An amendment to §5 has been offered to gate-house — a second sanctioned shape
+alongside read-only diagnostics: a declared engine gap carrying intended owner,
+blocker, and review date, machine-readable so §10 can tell a tracked gap from an
+undeclared violation. It is offered, not assumed; §5 stays gate-house's to write. If
+gate-house declines it, ops-warden's position is a plain non-conformance and is
+reported as one.
+
+The `NetKingdom Security Literacy` section stops being a prose second source for
+`registry/routing/catalog.yaml`, which `ADR-0001` had already ruled against for
+catalog procedure.
+
+## Related
+
+- `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed, gate-house)
+- `gate-house/decisions/decisions.md` — `GH-DEC-2026-001`
+- `history/2026-08-28-security-layer-model-assent.md`
+- `ADR-0001`, `ADR-0002`, `ADR-0003`, `ADR-0005`, `ADR-0009`
+- `WARDEN-IN-0001`

docs/adr/README.md

@@ -71,3 +71,4 @@ and the publication is a defect.
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure | ops-warden |
 | `ADR-0008` | A lane's risk grade covers every field its path discloses | ops-warden |
 | `ADR-0009` | Adopt security-zones v0.1; compile explicit membership and select PEP failure mode per zone | ops-warden |
+| `ADR-0010` | ops-warden is Staff: it owns access lanes, never access rules; the direct OpenBao client is a declared engine gap | ops-warden, and gate-house as the standard's owner |