Align INTENT and SCOPE to layer model v0.7; assess gaps; open WARDEN-WP-0034

The standard is accepted at v0.7, with SECURITY-COMPANION.md v0.2 as its
operative form. Four ops-warden findings were adopted between v0.4 and v0.7 —
§9.1's two marks, §5's Tooling scope rule, §6.4 obligation 1's second limb, and
§13.1's existence — and both ops-warden declaration artifacts are now cited in
the text as the estate's reference forms.

INTENT.md gains frontmatter (layer: Staff, pep_shaped: true) because §11 requires
a machine-readable declaration and prose cannot distinguish a declaration from a
transcribed review. The note now covers the agent principal (§3.4), the PEP
shape, the attributive evidence position, and the role the companion assigns:
the estate is told to ask ops-warden which lane, which credential, which route.

SCOPE.md records what is actually shipped against v0.7 and the honest conformance
state — declared gap, which is tracked non-conformance, not conformance.

The assessment checked every obligation against shipped code rather than intent.
Three gaps survive:

- §9.7.2 requires a PEP to state one revocation visibility deadline. Ours is
  unstated, and the honest value is uncomfortable: the cert TTL, up to 48h. A
  cert outlives revocation of the decision that authorized it — no CRL, no KRL
  distribution. That is a design property never written down, which is exactly
  what §9.7.2 exists to force into the open.
- §3.4 rule 1 forbids standing credentials and requires issued, attributable
  authority. ADR-0004's boundary keys on WARDEN_AGENT_ID, which an agent sets
  about itself. key-cape now issues a real coding-agent identity, so the
  ops-warden half can stop being advisory.
- §9.6 cadence remains undeclared. Attributive, so SHOULD not MUST, but silence
  through two reviews is the one outcome that is not defensible.

WARDEN-WP-0034 addresses all three, plus the discoverability gap the companion
creates and two items to route rather than absorb.

402 tests pass, ruff clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014535@bnt-lap001
Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c

workplans/WARDEN-WP-0034-layer-model-v07-conformance.md

@@ -0,0 +1,165 @@
+---
+id: WARDEN-WP-0034
+type: workplan
+title: "Layer model v0.7 conformance — state the deadline, bind the agent boundary, steward the estate's newest rule"
+domain: infotech
+repo: ops-warden
+status: ready
+owner: ops-warden
+topic_slug: netkingdom
+planning_priority: P1
+depends_on_workplans:
+  - WARDEN-WP-0030
+created: "2026-08-29"
+updated: "2026-08-29"
+---
+
+# WARDEN-WP-0034 — Layer model v0.7 conformance
+
+`security-layer-model_v0.7` is **accepted**. ops-warden declared Staff and PEP-shaped,
+shipped the two declaration artifacts the standard now cites as estate reference forms,
+and had four findings adopted into the text between v0.4 and v0.7.
+
+The assessment in `history/2026-08-29-v07-scope-intent-assessment.md` checked every
+v0.7 obligation against shipped code rather than intent. Three gaps survive, plus a
+role the companion assigns that no conformance check will ever catch.
+
+## Why a workplan and not an adhoc
+
+T01 is a `MUST` that is currently unstated. T02 changes an enforcement boundary and
+touches `ADR-0004`. T04 is a cross-repo stewardship commitment against a standard eight
+repositories have yet to adopt. The convention reserves adhocs for low-risk work
+completed directly; none of these qualify.
+
+## Tasks
+
+```task
+id: WARDEN-WP-0034-T01
+status: todo
+priority: high
+```
+
+**State the revocation visibility deadline (§9.7.2, a MUST).**
+
+ops-warden states none, and the honest value is the certificate TTL: **up to 48 hours**.
+A cert issued under an allow remains valid for its full TTL even if the authorizing
+decision is revoked the next minute. There is no CRL, no KRL distribution, and host-side
+`auth_principals` belongs to `railiance-infra`.
+
+Add the deadline to `pep-stance.yaml` as what it is — `adm` 48h / `agt` 24h / `atm` 8h —
+with the mechanism named (TTL expiry, no revocation channel) rather than implied. Assert
+it against the shipped `ActorType` TTL policy by test, the same way the stance map is
+asserted equal to shipped behaviour: a stated deadline free to drift from the code has
+the same defect as a stated stance free to drift.
+
+**Done when:** the deadline is published, test-bound to the TTL policy, and the absence
+of a revocation channel is stated rather than left to inference.
+
+**Not in scope:** shortening it. Whether 48h is acceptable is a joint question with
+`railiance-infra` (KRL distribution) and is T05's to raise, not this task's to decide.
+
+```task
+id: WARDEN-WP-0034-T02
+status: todo
+priority: high
+```
+
+**Bind the agent read-boundary to an issued identity (§3.4 rule 1).**
+
+`ADR-0004`'s boundary triggers on `WARDEN_AGENT_ID` — a variable the agent sets about
+itself. An agent that omits it is not recognised as one. §3.4 rule 1 now requires
+authority to be *issued* per task and attributable to the principal acted for.
+
+The identity exists as of `KEY-WP-0009-T03`: `codex-railiance-platform`, subject
+`service:codex:railiance-platform`, role `coding-agent`, 15-minute lifetime, with
+`railiance-platform` enforcing the OpenBao-side policy.
+
+Key the boundary on the issued identity where one is present; keep `WARDEN_AGENT_ID` as
+a fallback that fails **toward** the boundary, never away from it. State plainly in the
+ADR trail which half is enforced and which is advisory: the OpenBao-side deny is real,
+the ops-warden-side refusal is a courtesy that a determined caller can decline.
+
+**Done when:** an agent presenting the issued identity is recognised without setting
+`WARDEN_AGENT_ID`, the fallback still refuses on `risk: high` lanes, and the
+enforced/advisory split is written down.
+
+**Watch:** do not turn this into ops-warden validating a token — that is verifying an
+identity claim, adjacent to deciding, and `ADR-0002`/§6 both point away from it. Read
+the identity; do not adjudicate it.
+
+```task
+id: WARDEN-WP-0034-T03
+status: todo
+priority: medium
+```
+
+**Derive an emission cadence, or defer it with a reason (§9.6).**
+
+ops-warden's trail is attributive, so cadence is a SHOULD rather than v0.7's MUST for
+load-bearing sources. It has been silent through two reviews, which is the one outcome
+that is not defensible.
+
+Derive a baseline from the existing `audit.jsonl` and signatures log. If the signal is
+too bursty to support a threshold — plausible, since volume is operator-driven — record
+that as the finding with the distribution that shows it, and declare the deferral in
+`pep-stance.yaml`. A measured "no useful baseline" is a result; silence is not.
+
+**Done when:** either a declared cadence with its derivation, or a declared deferral
+carrying the data that justifies it.
+
+```task
+id: WARDEN-WP-0034-T04
+status: todo
+priority: medium
+```
+
+**Answer the question the companion sends the estate here to ask.**
+
+> *"For how to get something done — which lane, which credential, which route — ask
+> `ops-warden`."*
+
+Today the repo answers credential questions and no others. `warden route` and
+`warden plan` cover lanes, owners and acts. Nothing answers *"which layer am I"*, *"how
+do I declare"*, *"I am PEP-shaped, what do I owe"* — and eight of fifteen catalogued
+repositories have yet to declare.
+
+Provide the path, not the doctrine (that boundary is `ADR-0010`'s and does not move):
+a routing entry and a short playbook that carry a reader from the companion to the files
+to copy — `layer.yaml`, `pep-stance.yaml`, `check_layer_conformance.py`,
+`test_layer_conformance.py` — and the check to run. The standard already names these in
+§11 and §6.4; what is missing is the route to them.
+
+**Done when:** `warden route find "how do I declare my layer"` resolves, and the
+playbook is reachable from the catalog. **Not** a restatement of the companion — a
+pointer layer, per `ADR-0001`.
+
+```task
+id: WARDEN-WP-0034-T05
+status: todo
+priority: low
+```
+
+**Two things to raise rather than absorb.**
+
+Both are other repositories' to own; ops-warden's obligation is to route them, not to
+fix them (`ADR-0003`, `ADR-0005`).
+
+1. **`ops-mason` has published no stance map.** §13.1's register has one row and the
+   standard says that is itself the finding. `ops-mason` is catalogued PEP-shaped in
+   the same paragraph and is ops-warden's peer lane owner. Offer the reference form;
+   do not write their map.
+2. **The 48-hour replay window from T01.** Once stated, raise with `railiance-infra`
+   whether KRL distribution is worth building, and with `access-engine` whether a
+   decision lifetime shorter than the cert TTL is meaningful when nothing can recall
+   the cert. State the question; let the owners answer.
+
+**Done when:** both are routed with reasoning, and the answers recorded either way —
+including a refusal, which is an equally good answer.
+
+## Related
+
+- `history/2026-08-29-v07-scope-intent-assessment.md` — the gap analysis behind this plan
+- `history/2026-08-29-layer-model-v04-review.md`, `-v06-review.md` — the two prior reviews
+- `security-layer-model_v0.7.md` §3.4, §6.4, §9.6, §9.7, §11, §13.1
+- `net-kingdom/SECURITY-COMPANION.md` v0.2
+- `ADR-0002`, `ADR-0003`, `ADR-0004`, `ADR-0005`, `ADR-0009`, `ADR-0010`