# ops-warden — PEP unreachable-engine stance map
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.6.md §6.4, §9.3
# Rule of record: docs/adr/ADR-0009
# Validate: pytest tests/test_layer_conformance.py -k stance
#
# §6.4 obligation 3 requires a declared unreachable-engine stance that is total,
# scoped per zone, carries no implicit default and no per-call discretion, and is
# "published rather than held in code comments". §6.4 further requires every
# PEP-shaped consumer to PUBLISH its map so the maps can be inventoried. This
# file is ops-warden's, published because a map that lives only in a dataclass
# default is not published — it is merely written down.
#
# The property that makes this worth reading: it is asserted equal to the shipped
# default in src/warden/config.py (PolicyConfig.failure_modes) by
# tests/test_layer_conformance.py. A published map that may drift from the code
# is worse than none, because it invites reliance it cannot support.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.6"
repository: ops-warden
pep_shape: true
declared_by: docs/adr/ADR-0009

protected_action: "SSH certificate issuance (warden sign / cert_command)"
decision_engine: access-engine        # flex-auth until the governed rename
scope: security-zone                  # security-zones_v0.1 membership of the TARGET workload

# Total by construction: every zone in security-zones_v0.1, plus the two
# non-zone outcomes. No implicit default — an unlisted value is a config error,
# not a permissive fallback.
stance:
  z0-experimental: fail_open
  z1-operational:  fail_open
  z2-protected:    fail_open
  z2-continuity:   fail_open
  z3-critical:     fail_closed
  unknown:         fail_open          # versioned build profile (ADR-0009); explicit, never inferred
  not-applicable:  fail_closed

# What happens when the stance is applied. §6.4 obligation 1 requires a decision
# record for a protected side effect; where the engine is unreachable there is no
# decision to hold, so ops-warden records the APPLICATION OF THE STANCE instead.
# See the assessment note: obligation 1 as written admits no such case.
on_apply:
  recorded_fields:
    - policy_zone
    - policy_failure_mode
    - policy_decision_id   # present only where a decision was actually rendered
    - outcome
  written_to:
    - "signatures log (src/warden/ca.py)"
    - "audit.jsonl (src/warden/audit.py)"
  never_recorded: "any secret material, any certificate private key"

# §6.4 obligation 2 — the verdict is never cached. Input claims (zone membership,
# compiled from the flex-auth registry snapshot) are cached under their own
# freshness rules; the answer is not.
verdict_caching: none
input_claim_caching: "registry/flex-auth/production_registry_snapshot.json, rebuilt by scripts/build_flex_auth_registry.py"

# §6.4 obligation 4 — reconstructability, bounded by §9.6. ops-warden's audit
# emission on this lane is deliberately non-atomic and therefore ATTRIBUTIVE, not
# load-bearing: no control branches on the presence of a signing record
# (`warden activity` displays it; nothing gates on it). Registered in §13.
reconstructability:
  bound: "§9.6 attributive — completeness is not claimed"
  declared_at: wiki/AuditTrail.md