Implement §5.3 machine-readably — layer.yaml, checker, conformance tests

The security layer model moved v0.1 -> v0.4 (accepted) after ops-warden's
assent. Both §5 asks from ADR-0010 were adopted: §5.2 now sanctions the conduit
shape on the supplied-authority property, and §5.3 is the declared engine gap
amendment, carrying the four fields verbatim and crediting ops-warden's
delegation machinery as prior art.

Which creates an obligation. §5.3 requires those fields MACHINE-READABLY, and
§11 makes "every direct Tooling client maps to a declared §5.1/§5.2/§5.3 entry"
a mechanical check. ops-warden's declaration was prose in INTENT.md — the repo
that proposed the shape was not implementing it.

layer.yaml is the map: 5 contacts (2 declared gaps, 1 read-only observation,
2 conduits) plus the non-Tooling clients recorded explicitly so the check is
total rather than silently selective.

scripts/check_layer_conformance.py enforces it and found three undeclared
modules on its first run — all false positives (help text, a docstring, and the
doubles library that SIMULATES bao rather than calling it), which is why the
scan now matches invocation shapes instead of the word: an httpx call built
against the configured OpenBao address, or an argv whose first element is the
bao binary.

tests/test_layer_conformance.py adds the §5.2 test the standard says SHOULD
exist: _caller_env() returns the caller's environment unchanged, and proxy.py
is asserted not to reference X-Vault-Token, approle login, or token create — a
conduit that presents its own token is not a conduit.

No assertion on review dates, deliberately: a date-triggered failure breaks the
build on a calendar day with no code change, the same reasoning WP-0033-T05
recorded for blocker staleness.

398 tests pass, ruff clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c

layer.yaml

@@ -0,0 +1,123 @@
+# ops-warden — NetKingdom security layer declaration
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.4.md
+# Assent:    docs/adr/ADR-0010 (ops-warden's own voice, per §11 "who must declare")
+# Validate:  python3 scripts/check_layer_conformance.py
+#
+# §11 makes one check mechanical: "every direct Tooling client in a Staff
+# repository maps to a declared §5.1, §5.2, or §5.3 entry". This file is that
+# map. It is machine-readable because §5.3 requires it to be — ops-warden
+# proposed that shape and is implementing it rather than declaring in prose.
+#
+# Conformance rule inherited from tenancy.yaml: accuracy, not altitude. A
+# declared gap is TRACKED NON-CONFORMANCE (§11), never a claim of conformance.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.4"
+repository: ops-warden
+layer: staff
+declared_by: docs/adr/ADR-0010
+declared_at: "2026-08-29"
+
+# Every direct contact with a Tooling-layer system (§4), one entry each.
+tooling_contacts:
+
+  - id: ssh-ca-signing-write
+    shape: "5.3"                      # declared engine gap
+    module: src/warden/vault.py
+    symbol: VaultCA.sign
+    tooling: OpenBao
+    operation: "HTTP POST <addr>/v1/<mount>/sign/<role> with X-Vault-Token"
+    write: true
+    capability: "Sign a short-lived SSH certificate for an adm/agt/atm actor"
+    intended_owner: secrets-engine
+    blocked_on: >-
+      No engine exposes an SSH certificate signing surface. secrets-engine owns
+      credential abstraction, custody and lifecycle, which is the layer this
+      belongs in, but fronts no SSH-CA API today.
+    review: "2026-11-28"
+    note: >-
+      Production-verified and in daily use. This is the one lane ops-warden owns
+      permanently (§4). Signing continues while the gap is open: refusing would
+      remove production host access to close a documentation gap.
+
+  - id: desk-paste-once-provision
+    shape: "5.3"
+    module: src/warden/desk.py
+    symbol: _provision_to_openbao
+    tooling: OpenBao
+    operation: "bao kv put <path> <field>=- (value on stdin, never argv)"
+    write: true
+    capability: "Founder paste-once provisioning of a secret straight into OpenBao"
+    intended_owner: secrets-engine
+    blocked_on: >-
+      No engine exposes an attended provisioning surface for a value the founder
+      holds and no automated path can produce.
+    review: "2026-11-28"
+    note: >-
+      Attended and founder-operated (WP-0029). The value reaches OpenBao without
+      passing through a terminal, an argv, or the audit log.
+
+  - id: taint-metadata-read
+    shape: "5.1"                      # read-only diagnostic observation
+    module: src/warden/taint.py
+    symbol: fetch_taint_status
+    tooling: OpenBao
+    operation: "bao kv metadata get -format=json <path>"
+    write: false
+    capability: "Report EXPOSED taint (custom_metadata) without reading secret data"
+    intended_owner: secrets-engine
+    blocked_on: >-
+      No engine exposes a disclosure-taint query. Metadata-only by construction —
+      reading the data would be the 2026-07-16 vector this exists to avoid.
+    review: "2026-11-28"
+
+  - id: access-proxy-conduit
+    shape: "5.2"                      # conduit
+    module: src/warden/proxy.py
+    symbol: proxy_fetch, proxy_attended_login_exec
+    tooling: OpenBao, key-cape
+    operation: "Runs the catalog-declared owner fetch_command as a child process"
+    write: false
+    capability: "warden access --fetch/--exec/--out/--wrap for exec_capable lanes"
+    supplied_authority: none
+    evidence:
+      no_own_credential: src/warden/proxy.py::_caller_env
+      test: tests/test_proxy.py::test_conduit_supplies_no_authority_of_its_own
+      audit: "audit.jsonl records the caller, the lane, and the outcome; never a value"
+    note: >-
+      The §5.2 test is the supplied-authority property: ops-warden presents no
+      credential of its own, cannot widen what the caller could already do, and
+      the action reconstructs as the caller's. Governed by ADR-0002.
+
+  - id: caller-identity-token
+    shape: "5.2"
+    module: src/warden/caller_identity.py
+    symbol: resolve_caller_token
+    tooling: OpenBao
+    operation: "Runs the operator-configured caller_auth command, or reads token env"
+    write: false
+    capability: "Establish the caller's own identity for the pre-sign policy gate"
+    supplied_authority: none
+    detection: voluntary   # runs an operator-configured command, so no fixed
+                           # argv shape to scan for; declared rather than omitted
+    note: >-
+      Obtains the CALLER's credential by the operator's configured means; adds no
+      authority. Never mints, and never persists what it resolves.
+
+# Contacts that are deliberately NOT Tooling contacts, recorded so the check is
+# total rather than silently selective.
+non_tooling_clients:
+
+  - module: src/warden/policy.py
+    target: access-engine (flex-auth)
+    rationale: "Engine API — §5 permits it; this is the shape §5 prescribes."
+
+  - module: src/warden/worker.py
+    target: state-hub, llm-connect
+    rationale: >-
+      Not catalogued in §4. The layer catalog scopes the security estate, and
+      neither the State Hub nor llm-connect appears in it, so no §5 shape applies
+      on the standard's own terms. Raised with gate-house 2026-08-29 as a scope
+      question rather than resolved unilaterally — see the assessment note.