Assent to the NetKingdom security layer model (WARDEN-IN-0001)

gate-house asked ops-warden to assent to three boundary items ratified in
GH-DEC-2026-001. All three are assented in ADR-0010.

Staff: accepted. Grepping section 5 as it invites turned up a real
non-conformance — src/warden/vault.py is a direct OpenBao client performing a
write, and so is `warden desk`'s `bao kv put`. Section 5's only escape hatch is
read-only diagnostics, which does not cover a signing write, so both are
declared in INTENT.md as an engine gap with intended owner secrets-engine and
the blocker "no engine exposes an SSH-CA surface" — ADR-0003 turned inward
rather than an exemption argued for. taint.py is metadata-only and declared
under the read-only allowance; `warden access` proxies run under the caller's
identity and supply no authority of their own.

Doctrine versus runbook: accepted. NetKingdom Security Literacy becomes a lane
routing runbook that references gate-house doctrine instead of restating it. It
had also become a prose second source for registry/routing/catalog.yaml, which
ADR-0001 already rules against.

Lane versus rule: assented unconditionally, and the access-engine veto is not
exercised. One request on sequencing only — a window where both names resolve.

gate-house added to the routing tables in INTENT.md and SCOPE.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c

.claude/rules/architecture.md

@@ -16,6 +16,8 @@ distinction that matters here.
 | `ADR-0006` | Enforcement is zone-scoped, never a global flag |
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure; every lane carries an explicit `risk` grade |
 | `ADR-0008` | A lane's risk grade covers every field its path discloses, not just the field it is named after |
+| `ADR-0009` | Adopt security-zones v0.1 as a consumer; membership is compiled, never inferred |
+| `ADR-0010` | ops-warden is Staff: it owns access lanes, never access rules; doctrine belongs to gate-house |
 
 ### Owned versus inherited — check `owner:` before changing anything
 

INTENT.md

@@ -1,19 +1,26 @@
 # INTENT
 
-> **NetKingdom layering review — 2026-08-28.** This repository's role was reviewed
+> **Layer: Staff.** ops-warden is a Staff repository under the NetKingdom
-> against the NetKingdom IT-security layer model: **Taxonomy → Tooling → Engines →
+> IT-security layer model (Taxonomy -> Tooling -> Engines -> Staff, layered by
-> Staff**, layered by determinism and by the kind of artifact each layer produces.
+> determinism and by the kind of artifact each layer produces):
-> Findings and the argument behind them:
+> `net-kingdom/canon/standards/security-layer-model_v0.1.md`, owned by gate-house,
-> `gate-house/history/2026-08-28-security-layer-model-and-gate-house-recut.md`.
+> ratified as `gate-house/decisions/decisions.md` GH-DEC-2026-001.
-> The model is `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed),
-> ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001.
 >
-> The layer rule that binds every repository: **Staff never touches tooling
+> **The binding rule: Staff never touches Tooling directly. It acts only through
-> directly. It acts only through engine APIs.**
+> Engine APIs.** ops-warden holds no state another layer depends on at runtime and
+> renders no authorization decision — it consumes them from access-engine.
 >
-> **This repository is Staff — interactive, non-deterministic; operational stewardship.** Add the layer label and the Staff invariant. Two substantive changes. (1) The **"NetKingdom Security Literacy"** section is evidence that the security curriculum had no owner; it now has one. Doctrine and curriculum move to gate-house, and this section becomes lane-specific runbooks that reference gate-house doctrine rather than restating it. The boundary is **doctrine versus runbook**. (2) The literacy and routing tables should add gate-house — currently every plane is listed and gate-house appears nowhere — routing doctrine and authority-model questions there, while continuing to route policy decisions to access-engine. Record the lane/rule demarcation as in ops-mason.
+> **Declared exception (standard section 5).** `src/warden/vault.py` (`VaultCA`) is a
+> direct OpenBao client that performs a write, and `warden desk` shells `bao kv put`
+> for paste-once provisioning. Both are non-conformant. Intended owner:
+> **secrets-engine**; blocked on: no engine exposes an SSH certificate signing
+> surface; reviewed quarterly. `src/warden/taint.py` reads KV metadata only, declared
+> under the read-only observation allowance. `warden access --fetch/--exec/--wrap`
+> runs the owner's tool under **the caller's** identity and supplies no authority of
+> its own (`ADR-0002`).
 >
-> *This note records what should change. The body below is not yet adapted.*
+> Assent, reasoning, and the amendment offered back to gate-house:
+> `history/2026-08-28-security-layer-model-assent.md` and `ADR-0010`.
 
 > This file captures **why this repository exists**, the **direction it is
 > moving toward**, and the **kind of system it is meant to become**.
@@ -92,30 +99,51 @@ owns one lane and points at the rest:
 
 ---
 
-## NetKingdom Security Literacy
+## Lane routing — who owns which need
 
-ops-warden should be fluent in the platform architecture documented in
+**This is a runbook, not doctrine.** Security doctrine, the authority model, and the
-`net-kingdom` — especially:
+security curriculum are **gate-house's** (`security-layer-model_v0.1` section 8).
+ops-warden references them and does not restate them. What follows is lane
+stewardship: which subsystem owns which need, and what ops-warden does about it.
 
-| Plane / component | Role in access | ops-warden relationship |
+The machine-readable form is `registry/routing/catalog.yaml`, and the executable form
-| --- | --- | --- |
+is `warden plan "<need>"` / `warden route find`. Prefer either over this table — it is
-| **key-cape / Keycloak** | Identity — who is the actor, MFA, IAM Profile claims | Instruct identity path; do not re-implement OIDC |
+orientation, and the catalog is the source of truth (`ADR-0001`).
-| **flex-auth + Topaz** | Authorization — may this actor perform this action | Caller-side policy gate shipped (opt-in); production flip is flex-auth's |
+
-| **OpenBao** | Runtime secrets — API keys, dynamic creds, leases, audit | Instruct custody paths; SSH engine is signing backend only; proxy reads as caller when `exec_capable` |
+| Component | Layer | Owns | ops-warden relationship |
-| **secrets-engine** | Owner-native secret-exec (`secrets-engine exec`) | Route provisioned exec lanes (e.g. npm publish); ops-warden does not hold tokens |
+| --- | --- | --- | --- |
-| **railiance-platform** (credential broker) | Scoped lease grants (`credential exec`) | Route `warden-sign` token needs; ops-warden does not mint OpenBao tokens |
+| **gate-house** | Staff | Security doctrine, invariants, authority ceilings, authority context, conformance review, curriculum | **Route doctrine and authority-model questions here.** Not policy decisions — those go to access-engine |
-| **tenant-engine** | Tenant/client secret custody and front door | Route tenant lanes once fronted; ops-warden's current tenant proxies are interim (§9) |
+| **access-engine** (`flex-auth`) | Engine | **The policy decision** — whether an actor may act. The only decision point in NetKingdom | Consume decisions; caller-side pre-sign gate. ops-warden never renders or caches one |
-| **user-engine** | End-user identity and account lifecycle | No ops-warden lane today; route rather than absorb |
+| **key-cape / Keycloak** | Tooling | Identity — who the actor is, MFA, IAM Profile claims | Instruct the identity path; do not re-implement OIDC |
-| **ops-warden** | Operational SSH certificates — short-lived host access | **Own and issue** this lane |
+| **OpenBao** | Tooling | Runtime secrets — API keys, dynamic creds, leases, audit | Instruct custody paths; proxy reads as the caller when `exec_capable`. Direct client use is the declared exception above |
-| **ops-bridge** | Tunnel transport — consumes certs via `cert_command` | Primary consumer; document integration |
+| **secrets-engine** | Engine | Credential abstraction, custody, lifecycle; owner-native exec | Route provisioned exec lanes (e.g. npm publish). **Intended owner of the SSH-CA surface** |
-| **railiance-infra** | Host principals, force-command, SSH hardening | Instruct host-side deployment; do not own Ansible |
+| **tenant-engine** | Engine | Tenant/client secret custody and front door | Route tenant lanes once fronted; current tenant proxies are interim (section 9) |
-| **railiance-platform** (deploy) | OpenBao/K8s/platform service deployment | Instruct production endpoints; do not deploy clusters |
+| **user-engine** | Engine | Users, accounts, memberships | No ops-warden lane today; route rather than absorb |
+| **zone-engine** | Engine | Zone identity and membership | Consume compiled membership; ops-warden declares `z1-operational` (`ADR-0009`) |
+| **railiance-platform** (broker) | — | Scoped lease grants (`credential exec`) | Route `warden-sign` token needs; ops-warden does not mint OpenBao tokens |
+| **ops-mason** | Staff | Building and tearing down access routes and perimeters | Peer lane owner; same lane/rule demarcation applies |
+| **ops-warden** | Staff | **Operational access lanes** — short-lived SSH certificates, routing, stewardship, runbooks | **Own and issue** the SSH lane |
+| **ops-bridge** | Staff | Tunnel transport — consumes certs via `cert_command` | Primary consumer; document integration |
+| **railiance-infra** | — | Host principals, force-command, SSH hardening | Instruct host-side deployment; do not own Ansible |
+| **kings-guard** | Staff | Adaptive defence, observation, containment; publishes posture | Posture may reduce authority, never manufacture it |
+
+### Access lane versus access rule
+
+Normative, per `security-layer-model_v0.1` section 8 and assented to in `ADR-0010`:
+
+- **access lane** — ops-warden and ops-mason. *How* a worker reaches a host.
+- **access rule** — access-engine. *Whether* they may.
+
+ops-warden owns the route and never the decision. A question about whether an actor
+may do something is not an ops-warden question, however it arrives.
 
 Canonical references:
 
+- `net-kingdom/canon/standards/security-layer-model_v0.1.md` (layers, section 5, section 8)
 - `net-kingdom/docs/platform-identity-security-architecture.md`
 - `net-kingdom/docs/responsibility-map.md`
 - `wiki/AccessManagementDirective.md` (ops SSH actor model)
+- `.claude/rules/credential-routing.md` (agent-facing runbook — stays inline by design)
 
 ---
 
@@ -138,7 +166,8 @@ Canonical references:
 | Need | Route to |
 | --- | --- |
 | OIDC login, MFA, human identity claims | key-cape / Keycloak (NetKingdom IAM Profile) |
-| Policy decision — may actor X access resource Y | flex-auth |
+| Security doctrine, invariants, authority model | gate-house |
+| Policy decision — may actor X access resource Y | access-engine (`flex-auth`) |
 | API keys, provider secrets, DB creds, object-storage STS | OpenBao (+ flex-auth policy where required) |
 | Inter-Hub operator keys, LLM provider credentials | OpenBao or approved operator secret store |
 | Tunnel lifecycle, port forwarding | ops-bridge |

SCOPE.md

@@ -156,6 +156,7 @@ superseding ADR, never an in-place edit.
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure; every lane carries an explicit `risk` grade |
 | `ADR-0008` | A lane's risk grade covers every field its path discloses, not just the field it is named after |
 | `ADR-0009` | Adopt security-zones v0.1 and compile explicit workload membership; PEP failure mode is per zone |
+| `ADR-0010` | ops-warden is Staff — it owns access lanes, never access rules; the direct OpenBao client is a declared engine gap, not an exemption |
 
 Rules we follow but do not own — NetKingdom canon, the IAM profile, the
 credential-management standard, the-custodian's ADR-001 workplan convention — are
@@ -433,11 +434,12 @@ Downstream: `ops-bridge` (primary), kaizen agents, CI automations, human operato
 
 | Repo | Relationship |
 | --- | --- |
+| `gate-house` | Owns security doctrine, invariants, authority context, and conformance review; ops-warden routes doctrine questions there and references rather than restates them (`ADR-0010`) |
 | `net-kingdom` | Canonical security architecture; ops-warden aligns to it |
 | `ops-bridge` | Primary cert_command consumer |
 | `railiance-infra` | Host-side SSH principals and hardening |
 | `railiance-platform` | OpenBao deployment and platform secrets |
-| `flex-auth` | Authorization; policy package shipped (FLEX-WP-0006); runtime deploy FLEX-WP-0007 |
+| `flex-auth` | Authorization — ruled name `access-engine`; the only policy decision point. Policy package shipped (FLEX-WP-0006); runtime deploy FLEX-WP-0007 |
 | `key-cape` | Identity / IAM Profile lightweight mode |
 | `secrets-engine` | Owner-native secret-exec front door (`secrets-engine exec/route`); ops-warden routes provisioned secret lanes to it (WP-0019) and holds 6 more as interim proxies pending its front doors |
 | `tenant-engine` | Intended owner of tenant/client secret front doors; ops-warden holds 3 tenant lanes as interim proxies (WP-0028 pattern, WP-0030 register) |

docs/adr/ADR-0010-ops-warden-is-staff.md

@@ -0,0 +1,109 @@
+---
+id: ops-warden-adr-0010
+type: adr
+title: "ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap"
+domain: infotech
+repo: ops-warden
+status: accepted
+version: "1.0"
+revision: "1"
+owner: ops-warden
+binds: "ops-warden"
+created: "2026-08-28"
+updated: "2026-08-28"
+last_reviewed: "2026-08-28"
+review_interval: 3m
+enforced_by: "INTENT.md layer declaration; docs/adr/ADR-0002; docs/adr/ADR-0003; docs/adr/ADR-0005; registry/routing/catalog.yaml delegation fields"
+supersedes: ""
+successor: ""
+---
+
+# ADR-0010 — ops-warden is Staff: lanes, not rules, and one declared engine gap
+
+## Status
+
+Accepted 2026-08-28, answering intake `WARDEN-IN-0001` from gate-house, which
+carries decision `GH-DEC-2026-001`. The standard being adopted —
+`net-kingdom/canon/standards/security-layer-model_v0.1.md` — is `proposed`, and was
+proposed pending assent from flex-auth, kings-guard, and ops-warden. This ADR is
+ops-warden's half of that assent.
+
+## Context
+
+The estate acquired overlapping claims to the same responsibility, most visibly two
+repositories describing themselves as the authorization control plane. The layer
+model resolves the overlap by layering repositories on determinism — Taxonomy,
+Tooling, Engines, Staff — and by two rules: Staff never touches Tooling directly
+(§5), and `access-engine` is the only policy decision point (§6).
+
+ops-warden is assigned Staff. Two demarcations follow that touch this repository:
+the security curriculum it had been carrying belongs to gate-house, and the words
+*access lane* and *access rule* are bound to different owners.
+
+Full reasoning: `history/2026-08-28-security-layer-model-assent.md`.
+
+## Decision
+
+**1. ops-warden is Staff and declares it.** `INTENT.md` carries the layer label and
+the §5 invariant. ops-warden holds no state another layer depends on at runtime and
+renders no authorization decision — it consumes them.
+
+**2. Lanes, not rules.** ops-warden owns *how* a worker reaches a host: SSH
+certificate issuance, the routing catalog, `warden access`, `warden plan`,
+`cert_command`. It never owns *whether* a worker may — that is `access-engine`
+(today `flex-auth`), and ops-warden neither renders nor caches that decision. This
+restates what `ADR-0002` and `ADR-0005` already bind; it is recorded here because
+the demarcation is now normative estate-wide and other repositories rely on
+ops-warden holding to it. The ruled rename `flex-auth` → `access-engine` is assented
+to; ops-warden asks only for a window in which both names resolve.
+
+**3. Doctrine goes to gate-house; runbooks stay here.** ops-warden does not restate
+security doctrine, the authority model, or the curriculum. It references
+gate-house's. It keeps everything operational about the lanes it stewards: which
+subsystem owns which need, how to obtain a credential lane by lane, and conformance
+evidence for its own lanes. `.claude/rules/credential-routing.md` is runbook, not
+curriculum, and stays inlined in this and every other repository.
+
+**4. One declared engine gap, not an exemption.** `src/warden/vault.py` (`VaultCA`)
+is a direct OpenBao client performing a write from a Staff repository. It is a §5
+non-conformance. ops-warden declares it rather than arguing it away:
+
+- **intended owner:** `secrets-engine` (credential abstraction, custody, lifecycle)
+- **blocked on:** no engine exposes an SSH certificate signing surface
+- **review:** with this ADR, every 3 months
+
+Until that surface exists, ops-warden continues to sign — refusing to would remove
+production host access to close a documentation gap — and reports the position as
+open. `warden desk`'s `bao kv put` is declared on the same terms. `taint.py` is
+metadata-only observation, declared under §5's read-only allowance. `proxy.py`
+supplies no authority of its own: it runs the owner's tool under the caller's
+identity and is governed by `ADR-0002`.
+
+This is `ADR-0003` turned inward. ops-warden has required an intended owner and a
+blocker on 27 catalog lanes it holds for other repositories; it holds itself to the
+same record.
+
+## Consequences
+
+ops-warden's conformance under §10 is *declared non-conformant with a tracked
+closure path*, not clean. That is the accurate state and it is the state that gets
+fixed, because it names an owner who can fix it.
+
+An amendment to §5 has been offered to gate-house — a second sanctioned shape
+alongside read-only diagnostics: a declared engine gap carrying intended owner,
+blocker, and review date, machine-readable so §10 can tell a tracked gap from an
+undeclared violation. It is offered, not assumed; §5 stays gate-house's to write. If
+gate-house declines it, ops-warden's position is a plain non-conformance and is
+reported as one.
+
+The `NetKingdom Security Literacy` section stops being a prose second source for
+`registry/routing/catalog.yaml`, which `ADR-0001` had already ruled against for
+catalog procedure.
+
+## Related
+
+- `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed, gate-house)
+- `gate-house/decisions/decisions.md` — `GH-DEC-2026-001`
+- `history/2026-08-28-security-layer-model-assent.md`
+- `ADR-0001`, `ADR-0002`, `ADR-0003`, `ADR-0005`, `ADR-0009`
+- `WARDEN-IN-0001`

docs/adr/README.md

@@ -71,3 +71,4 @@ and the publication is a defect.
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure | ops-warden |
 | `ADR-0008` | A lane's risk grade covers every field its path discloses | ops-warden |
 | `ADR-0009` | Adopt security-zones v0.1; compile explicit membership and select PEP failure mode per zone | ops-warden |
+| `ADR-0010` | ops-warden is Staff: it owns access lanes, never access rules; the direct OpenBao client is a declared engine gap | ops-warden, and gate-house as the standard's owner |

history/2026-08-28-security-layer-model-assent.md

@@ -0,0 +1,171 @@
+# Security layer model — ops-warden's assent (WARDEN-IN-0001)
+
+**Date:** 2026-08-28
+**Intake:** `WARDEN-IN-0001`
+**Requested by:** gate-house, ratified as `GH-DEC-2026-001`
+**Standard:** `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed)
+**Outcome:** assent to all three items; one declared non-conformance and one
+proposed amendment to the standard.
+
+---
+
+## What was asked
+
+gate-house asked ops-warden to assent to three boundary items:
+
+1. **ops-warden is Staff**, bound by §5 — Staff acts only through Engine APIs and
+   never holds a direct Tooling client.
+2. **Doctrine versus runbook** — the security curriculum moves to gate-house; the
+   `NetKingdom Security Literacy` section in `INTENT.md` becomes lane-specific
+   runbooks that reference gate-house doctrine rather than restating it.
+3. **The access lane / access rule demarcation** (§8) — ops-warden and ops-mason own
+   *lanes* (how a worker reaches a host); access-engine owns *rules* (whether they
+   may). This is the condition attached to renaming flex-auth to access-engine, so
+   ops-warden effectively holds a veto on that name.
+
+Plus: add gate-house to the literacy and routing tables, and say so if moving the
+curriculum out leaves ops-warden unable to instruct its own workers.
+
+---
+
+## Item 1 — Staff, and the §5 problem it exposes
+
+**Assent to the layer.** Staff is the right assignment and not a demotion.
+ops-warden's artifacts are exactly what §3.4 describes: routing decisions,
+workplans, runbooks, an audit trail. Its one production lane is non-deterministic
+in the sense that matters — it is an operator front door, not a contract.
+
+**But §5 is violated today, and by the one lane ops-warden permanently owns.**
+The rule is deliberately greppable, so grepping is the honest response:
+
+| Path | Tooling contact | Kind | Whose credential |
+| --- | --- | --- | --- |
+| `src/warden/vault.py` (`VaultCA.sign`) | `POST <bao>/v1/<mount>/sign/<role>` | **write** | broker-issued token held by ops-warden's process |
+| `src/warden/desk.py` | `bao kv put` (paste-once provisioning) | **write** | founder's, at the desk |
+| `src/warden/taint.py` | `bao kv metadata get` | read (metadata only, never data) | caller's |
+| `src/warden/proxy.py` (`warden access --fetch/--exec/--wrap`) | catalog `fetch_command` | read | **the caller's own** |
+
+Two of these are not really ops-warden's clients. `proxy.py` runs the owner's tool
+under the caller's identity and supplies no authority of its own — that is
+`ADR-0002`, conduit not broker, and it is arguably outside §5's target. `taint.py`
+reads metadata only, and fits §5's read-only-observation allowance once declared.
+
+**`VaultCA` does not have that defence.** It is a direct OpenBao client, in a Staff
+repository, performing a write, presenting a token from its own environment. It is
+production-verified and it is the SSH lane — the single thing ops-warden owns
+permanently. Under §5 as written, adopting this standard puts ops-warden's core
+lane in violation on the day it is adopted.
+
+The escape hatch §5 offers does not fit: it covers *read-only observation for
+diagnostics*, and signing is a write. The route §5 prescribes does fit —
+
+> *A Staff repository needing a capability no engine exposes MUST raise that as an
+> engine gap, not solve it locally.*
+
+— and no engine exposes SSH certificate signing. `secrets-engine` owns credential
+abstraction, custody and lifecycle, which is the layer this belongs in, but it
+fronts no SSH-CA API today.
+
+**So ops-warden assents and declares the non-conformance rather than negotiating an
+exemption.** `VaultCA` is recorded in `INTENT.md` as a declared §5 exception with a
+named intended owner (`secrets-engine`), a blocker (no SSH-CA engine surface), and a
+review date. That is `ADR-0003` — cover gaps, never silently own them — applied to
+ops-warden itself instead of to someone else's lane.
+
+### Proposed amendment to the standard
+
+§5 has exactly one shape for a Staff repository that legitimately touches Tooling:
+read-only diagnostics. That shape is too narrow to describe the estate as it exists,
+and a rule with no lane for a real, sanctioned case gets satisfied by relabelling
+rather than by closing the gap.
+
+Recommend §5 gain a second shape: a **declared engine gap** — a Staff repository MAY
+hold a Tooling client for a capability no engine exposes, provided it is declared in
+`INTENT.md` with an intended owner, the blocker, and a review date, and provided the
+declaration is machine-readable so the conformance check in §10 can distinguish a
+tracked gap from an undeclared violation.
+
+ops-warden already runs this machinery for other repositories' lanes: 27 catalog
+entries carry `delegation:` with `intended_owner` and `blocked_on`, and
+`warden route gaps` lists them (WP-0030). It is offered, not imposed — the standard
+is gate-house's.
+
+---
+
+## Item 2 — Doctrine versus runbook
+
+**Assent.** The `NetKingdom Security Literacy` section is what gate-house says it is:
+evidence that the curriculum had no owner, so it accreted in whatever `INTENT.md`
+was open. That is the same failure `risk-nexus` names for findings and the same one
+`ADR-0001` prevents for catalog procedure. ops-warden has argued this rule twice
+against other repositories; it applies here.
+
+The boundary, drawn precisely:
+
+| Moves to gate-house | Stays with ops-warden |
+| --- | --- |
+| Why the planes are separated; the authority model | Which subsystem owns which credential need |
+| What "posture", "zone", "authority ceiling" mean | How to obtain a cert, a lease, a login — per lane |
+| The security curriculum a worker is taught | The runbook a worker executes |
+| Doctrine a lane must conform to | Evidence of conformance for ops-warden's lanes |
+
+**gate-house's test question, answered: no, it does not leave ops-warden unable to
+instruct its workers — and the reason is worth recording.** What actually instructs
+an ops-warden worker is not the prose in `INTENT.md`. It is `warden plan "<need>"`,
+`warden route find`, and `.claude/rules/credential-routing.md`, which is inlined into
+every repository's agent instructions precisely because credential routing is
+high-frequency and high-risk. That surface is executable, lane-specific, and
+unambiguously runbook. It does not depend on the literacy table, and moving doctrine
+out does not weaken it.
+
+If anything the move improves it: the literacy table has been a second, prose copy of
+what `registry/routing/catalog.yaml` states machine-readably, which is the
+double-source failure `ADR-0001` exists to stop.
+
+**One thing must not move with it.** `.claude/rules/credential-routing.md` stays
+inline in this repository and in every other. It is not doctrine and not a
+curriculum; it is the anti-pattern list an agent needs *before* it acts, and a
+reference to a document in another repository would not be read in time.
+
+---
+
+## Item 3 — Access lane versus access rule
+
+**Assent, unconditionally, and the veto on `access-engine` is not exercised.**
+
+ops-warden is already built this way. `ADR-0005` implements one lane narrowly and
+routes everything else; `ADR-0002` makes it a conduit that never decides; `ADR-0009`
+has ops-warden compile membership attributes and apply a zone's failure mode while
+flex-auth owns the stance. ops-warden consumes decisions; it has never rendered one.
+The demarcation costs nothing because it describes what is already true.
+
+`access-engine` is also the better name. ops-warden's own routing table has had to
+say "authorization" for the decision and "access" for the route for a year, and the
+collision is visible in every playbook.
+
+**One operational condition, on execution rather than on the ruling.** The rename is
+598 references across 82 files in this repository alone — catalog `owner:` fields,
+`registry/flex-auth/`, `src/warden/policy.py`, the production registry snapshot
+builder, playbooks, and the `.claude/rules/` files that other repositories inline.
+Ops-warden asks for a deprecation window in which both names resolve, rather than a
+flag day; ops-warden will do its own migration inside that window. This is a request
+about sequencing, not a reservation about the name.
+
+---
+
+## Item 4 — gate-house is missing from every table
+
+Correct, and fixed in this pass. gate-house is added to the literacy/routing table
+in `INTENT.md` as the owner of doctrine, invariants, authority context, and
+conformance review — with the routing rule stated explicitly: **doctrine and
+authority-model questions go to gate-house; policy decisions continue to go to
+access-engine.** Those are different questions and the distinction is the whole
+point of §6.
+
+---
+
+## Recorded as
+
+- `ADR-0010` — ops-warden is Staff; lanes not rules; the declared §5 exception
+- `INTENT.md` — layer declaration, reworked routing table, gate-house row
+- `WARDEN-IN-0001` — closed, outcome `assented`

intakes/intakes.md

@@ -7,7 +7,8 @@ id: WARDEN-IN-0001
 kind: intake
 title: 'Assent requested: Staff layer, doctrine vs runbook, and the access lane/rule
   demarcation'
-status: open
+status: closed
+outcome: assented
 origin: cross-repo
 origin_ref: gate-house GH-DEC-2026-001
 priority: medium
@@ -30,6 +31,24 @@ description: 'gate-house asks ops-warden to assent to three boundary items. (1)
   — routing doctrine and authority-model questions there while continuing to route
   policy decisions to access-engine. If moving the curriculum out leaves ops-warden
   unable to instruct its own workers, say so; the boundary is wrong if it does.'
+notes: 'Assented to all three items in ADR-0010, with reasoning in
+  history/2026-08-28-security-layer-model-assent.md. (1) Staff accepted; the section 5
+  binding rule exposed a real non-conformance — src/warden/vault.py is a direct
+  OpenBao client performing a write, as is warden desk''s bao kv put. Declared in
+  INTENT.md as an engine gap with intended owner secrets-engine and blocker "no engine
+  exposes an SSH-CA surface", not negotiated as an exemption; taint.py declared under
+  the read-only allowance; warden access proxies run under the caller''s identity.
+  An amendment is offered back to gate-house: a second sanctioned shape in section 5 for
+  a declared engine gap carrying intended owner, blocker and review date, machine-readable
+  so section 10 can tell a tracked gap from an undeclared violation. (2) Doctrine versus
+  runbook accepted; the literacy section is now a lane routing runbook referencing
+  gate-house doctrine. Answering gate-house''s test question: it does not leave ops-warden
+  unable to instruct its workers, because what instructs them is warden plan / warden route
+  and .claude/rules/credential-routing.md, which stays inline by design. (3) The lane/rule
+  demarcation assented unconditionally and the access-engine veto not exercised — ops-warden
+  already consumes decisions and renders none. One request on sequencing only: a deprecation
+  window in which both names resolve (598 references across 82 files here). gate-house added
+  to the routing tables in INTENT.md and SCOPE.md.'
 created: '2026-08-28T19:30:28.087109Z'
-updated: '2026-08-28T19:30:28.087109Z'
+updated: '2026-08-28T21:05:00Z'
 ```