Align INTENT and SCOPE to layer model v0.7; assess gaps; open WARDEN-WP-0034

The standard is accepted at v0.7, with SECURITY-COMPANION.md v0.2 as its
operative form. Four ops-warden findings were adopted between v0.4 and v0.7 —
§9.1's two marks, §5's Tooling scope rule, §6.4 obligation 1's second limb, and
§13.1's existence — and both ops-warden declaration artifacts are now cited in
the text as the estate's reference forms.

INTENT.md gains frontmatter (layer: Staff, pep_shaped: true) because §11 requires
a machine-readable declaration and prose cannot distinguish a declaration from a
transcribed review. The note now covers the agent principal (§3.4), the PEP
shape, the attributive evidence position, and the role the companion assigns:
the estate is told to ask ops-warden which lane, which credential, which route.

SCOPE.md records what is actually shipped against v0.7 and the honest conformance
state — declared gap, which is tracked non-conformance, not conformance.

The assessment checked every obligation against shipped code rather than intent.
Three gaps survive:

- §9.7.2 requires a PEP to state one revocation visibility deadline. Ours is
  unstated, and the honest value is uncomfortable: the cert TTL, up to 48h. A
  cert outlives revocation of the decision that authorized it — no CRL, no KRL
  distribution. That is a design property never written down, which is exactly
  what §9.7.2 exists to force into the open.
- §3.4 rule 1 forbids standing credentials and requires issued, attributable
  authority. ADR-0004's boundary keys on WARDEN_AGENT_ID, which an agent sets
  about itself. key-cape now issues a real coding-agent identity, so the
  ops-warden half can stop being advisory.
- §9.6 cadence remains undeclared. Attributive, so SHOULD not MUST, but silence
  through two reviews is the one outcome that is not defensible.

WARDEN-WP-0034 addresses all three, plus the discoverability gap the companion
creates and two items to route rather than absorb.

402 tests pass, ruff clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c

SCOPE.md

@@ -85,6 +85,28 @@ cutover, flex-auth publishing the zone-aware pre-sign stance package,
 the owner-driven WP-0015 canon landing, and — newly named — the missing owner front
 doors that keep ops-warden holding interim lanes (secrets-engine, tenant-engine).
 
+### Layer-model conformance (v0.7, accepted)
+
+ops-warden declares **Staff**, **PEP-shaped**, in `INTENT.md` frontmatter and in its
+own voice — `security-layer-model_v0.7` §11. Shipped declaration artifacts, both
+cited in the standard as the estate's reference forms:
+
+| Artifact | Declares | Status |
+| --- | --- | --- |
+| `layer.yaml` | 5 Tooling contacts mapped to §5.1/§5.2/§5.3 shapes + non-Tooling clients so the check is total | shipped; named reference form (§11) |
+| `pep-stance.yaml` | unreachable-engine stance map, total per zone | shipped; registered in statute §13.1 (§6.4 obl. 3) |
+| `scripts/check_layer_conformance.py` | every direct Tooling client maps to a declared shape | shipped; CI-enforced |
+| `tests/test_layer_conformance.py` | the §5.2 no-authority property, and published stance map **equals** shipped default | shipped, 11 tests |
+
+Conformance state under §11: **declared gap** — tracked non-conformance, not
+conformance. Two §5.3 contacts (`VaultCA` signing write, `warden desk` `bao kv put`),
+intended owner `secrets-engine`, registered in statute §13.
+
+Four ops-warden findings have been adopted into the standard: §9.1's two marks
+(`pending` vs `declared-gap`), §5's Tooling scope rule, §6.4 obligation 1's second
+limb, and §13.1's existence. Reviews: `history/2026-08-29-layer-model-v04-review.md`,
+`-v06-review.md`, `-v07-scope-intent-assessment.md`.
+
 ### Issue vs route
 
 ops-warden executes exactly one lane with its own authority and routes/assists the rest.
@@ -156,7 +178,7 @@ superseding ADR, never an in-place edit.
 | `ADR-0007` | Build-stage permissiveness stops at credential disclosure; every lane carries an explicit `risk` grade |
 | `ADR-0008` | A lane's risk grade covers every field its path discloses, not just the field it is named after |
 | `ADR-0009` | Adopt security-zones v0.1 and compile explicit workload membership; PEP failure mode is per zone |
-| `ADR-0010` | ops-warden is Staff — it owns access lanes, never access rules; the direct OpenBao client is a declared engine gap, not an exemption |
+| `ADR-0010` | ops-warden is Staff and PEP-shaped — it owns access lanes, never access rules; the direct OpenBao client is a declared engine gap, not an exemption |
 
 Rules we follow but do not own — NetKingdom canon, the IAM profile, the
 credential-management standard, the-custodian's ADR-001 workplan convention — are
@@ -434,7 +456,7 @@ Downstream: `ops-bridge` (primary), kaizen agents, CI automations, human operato
 
 | Repo | Relationship |
 | --- | --- |
-| `gate-house` | Owns security doctrine, invariants, authority context, and conformance review; ops-warden routes doctrine questions there and references rather than restates them (`ADR-0010`) |
+| `gate-house` | Owns the security layer model, doctrine, invariants, authority context, and conformance review. ops-warden routes doctrine questions there, and the companion routes the estate's *path* questions back to ops-warden (`ADR-0010`) |
 | `net-kingdom` | Canonical security architecture; ops-warden aligns to it |
 | `ops-bridge` | Primary cert_command consumer |
 | `railiance-infra` | Host-side SSH principals and hardening |
@@ -488,6 +510,9 @@ keywords: [access, credential, secret, npm, token, api-key, openbao, key-cape, l
 | `wiki/CredentialRouting.md` | Which subsystem for each credential need |
 | `wiki/WorkloadSecurityPosture.md` | Secret-store posture, workload maturity, and blocker triage |
 | `registry/routing/catalog.yaml` | Machine-readable routing pointer catalog |
+| `net-kingdom/SECURITY-COMPANION.md` | **The estate's operative security rules — start here** |
+| `layer.yaml` | Layer declaration: every Tooling contact and its §5 shape |
+| `pep-stance.yaml` | Unreachable-engine stance map (§6.4); equals shipped behaviour by test |
 | `tenancy.yaml` | Declared tenancy posture (`I1 A1 E0 P n/a R n/a V0`) and why each axis sits where it does |
 | `wiki/NetKingdomSecurityMap.md` | Platform security component map |
 | `examples/warden.production.example.yaml` | Production warden.yaml template |