From f289465b90fcdffe2c8bf4a51cc71607747126f9 Mon Sep 17 00:00:00 2001
From: repo-manager <repo-manager@local>
Date: Fri, 28 Aug 2026 22:40:24 +0200
Subject: [PATCH] repo.work.create_intake WARDEN-IN-0002

correlation_id: 676e92a9-dc2e-4101-a31c-a584962c25df
reason: Propose layer model v0.3 for review
source: repo-manager

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
---
 intakes/intakes.md | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/intakes/intakes.md b/intakes/intakes.md
index 4a91201..192d793 100644
--- a/intakes/intakes.md
+++ b/intakes/intakes.md
@@ -53,3 +53,40 @@ created: '2026-08-28T19:30:28.087109Z'
 updated: '2026-08-28T21:05:00Z'
 state_hub_intake_id: "01a049ed-bbbc-7520-bc7c-6b0912ca534a"
 ```
+
+## WARDEN-IN-0002 — Review requested: security layer model v0.3 — and does maturity-engine absorb warden route gaps?
+
+```yaml
+id: WARDEN-IN-0002
+kind: intake
+title: 'Review requested: security layer model v0.3 — and does maturity-engine absorb
+  warden route gaps?'
+status: open
+origin: cross-repo
+origin_ref: net-kingdom security-layer-model_v0.3
+priority: medium
+owner: ops-warden
+requested_by: gate-house
+description: 'v0.3 is proposed and changes sections 4, 9 and 13 only; the v0.2 assent
+  record stands. Two new engines: approval-engine (section 9.4) and maturity-engine
+  (section 9.5). THE QUESTION FOR YOU concerns section 5.3, which exists because you
+  offered the amendment. v0.3 gives declared gaps an owner: maturity-engine takes
+  the gap register with intended_owner, blocked_on and review dates, and section 13
+  now says the register in the standard is interim and should not outlive that engine.
+  You offered warden route gaps and the 27 delegation catalog entries as reusable
+  prior art. So the question is whether that machinery should MOVE, be MIRRORED, or
+  STAY. Our tentative reading, which we want tested rather than accepted: routing
+  is yours and stays yours — warden route find answers where a credential need goes,
+  and that is lane knowledge, not maturity. What might move is the readiness half:
+  whether a declared gap is still within its review date, and whether an intended
+  owner has an engine surface yet. If splitting those creates two sources for one
+  fact, that is worse than either option and we would rather hear it now. Your SSH-CA
+  signing write would be tracked in maturity-engine as a declared gap with intended
+  owner secrets-engine and a review date — that is reporting your own non-conformance
+  to an engine, so we would rather you assent to it than discover it. Also note approval-engine
+  (section 9.4): it owns the approval object, not the approval workflow, so ops-warden
+  lanes needing approval consume a claim rather than implementing one. Assent, revision,
+  or rejection acceptable.'
+created: '2026-08-28T20:40:24.957468Z'
+updated: '2026-08-28T20:40:24.957468Z'
+```