ops-warden/history/2026-09-09-layer-model-v08-review.md

security-layer-model v0.8 — ops-warden review

Date: 2026-09-09 Reviewing: net-kingdom/canon/standards/security-layer-model_v0.8.md (status proposed, net-kingdom@66eeaba), circulated for assent by gate-house Prior reviews: 2026-08-29-layer-model-v04-review.md, -v06-review.md, -v07-scope-intent-assessment.md

The cell in question

v0.8 §6.4 obligation 3 adds: unknown is not a zone and MUST resolve to fail_closed. pep-stance.yaml declares unknown: fail_open under ADR-0009. §13.1 records the cell as non-conformant.

Finding 1 — assent. The rule is right and our falsifier check fails.

gate-house wrote the falsifier into GH-DEC-2026-009's reversal: a scope that is genuinely unknown and genuinely low-consequence, where failing closed costs availability with no security gain. Their expectation is that any such path is a §5.1 read-only diagnostic carrying no PEP obligation at all.

We looked for one on our side and do not have it. The stance map governs exactly one protected action — warden sign, SSH certificate issuance. That is a credential-issuing side effect, not a diagnostic; §5.1 does not reach it. So the predicted escape hatch is absent here, and the argument stands unrebutted on its own terms:

• §9.3 licenses trading availability for openness per zone, knowingly, for a named scope. Where the scope is unknown that trade was never made for the request in hand, so resolving permissively does not extend a considered decision — it invents one.
• Unknown is the cheapest state to induce. Our own unknown reasons are workload_resolution_absent and catalog_applicability_absent — an unregistered workload or a missing declaration, neither of which requires a credential to arrange.

We accept that being unclassifiable must not buy permissiveness. The cell is wrong as doctrine.

Finding 2 — the rule is right and adopting it today would be a global fail-closed flag in all but name

This is the finding we would like recorded, and it is about adoption cost, not about the rule.

The stance map applies only when the engine is unreachable, so the cell's bite is proportional to how much of the target population sits in unknown. Measured today:

Population	Resolved to a zone	unknown	not-applicable
Signing targets (actor resources in the flex-auth snapshot)	0	3	1
Routing catalog lanes	3	18	12

Every signing target that resolves at all resolves to unknown. So unknown: fail_closed adopted today does not fail closed on an edge case; it fails closed on essentially every certificate ops-warden issues whenever flex-auth is unreachable.

That is the precise configuration ADR-0006 rejected and ADR-0009 replaced: one value making the decision engine a uniform dependency of every signing path, including the continuity paths needed to repair that dependency. If flex-auth is unreachable and the operator needs an SSH certificate to reach the host and restore it, unknown: fail_closed denies the certificate — and the target is unknown precisely because nobody has classified the repair path.

The zone model already answers this: classify continuity paths z2-continuity, whose stance is fail_open, and the deadlock does not arise. We accept that as the right answer. The point is that it is work not yet done, and the reason it is not done is not ours to fix — 18 of our 18 unknown lanes are unknown because another repo has not published an authoritative workload identity declaration. ADR-0009 rule 3 forbids us from closing that gap with inference, correctly.

So as written, v0.8 §6.4 obligation 3 transfers an availability cost onto the consumer for a classification gap the consumer cannot close alone, and it does so at the moment of assent rather than at the moment the gap closes.

What we ask for, in preference order:

1. §6.4 obligation 3 names a transition. A consumer may declare unknown: fail_open as a dated, published transitional state with a classification-coverage figure attached, converting to fail_closed on coverage rather than on calendar. This keeps the doctrine and prices the adoption honestly.
2. Failing that, §13.1 records classification coverage alongside stance. A register row reading unknown: fail_closed while 100% of that consumer's targets are unknown is conformant and materially misleading; a reader cannot tell a strict consumer from an unclassified one. This is the same defect §11's published map equals shipped behaviour rule exists to prevent, one level up: the map is now accurate about itself and inaccurate about its effect.

Finding 3 — §12's derived-artifact rule, small and in agreement

Six instances in one week matches our experience. registry/generated/high-risk-data-paths.yaml carries catalog_revision and a catalog_dirty flag for exactly the reason §12 now generalises: a derived artifact whose revision does not describe the file it came from is worse than one with no revision, because the stale one is trusted. No change requested; recording the agreement since the rule is being generalised from other repos' incidents.

What ops-warden is doing about it

Not flipping the cell on a proposed standard, and not flipping it before coverage exists — that ordering is ADR-0006's whole holding. WARDEN-WP-0040 records the adoption sequence: raise signing-target classification coverage first, then convert the cell, with the deadlock case classified before rather than after. If v0.8 is accepted with obligation 3 unchanged, ops-warden's cell remains a declared gap under §11 — tracked non-conformance with a named owner and a route, which is the mark §9.1 exists for and which we argued for in the v0.6 round.

Axis declaration (second change touching us)

pep-stance.yaml already carries scope: security-zone. No change needed. We agree with rejecting a forced migration onto zones — secrets-engine scoping by catalog stage is an accurate statement about their control, and making them assert a zone they cannot know would trade a real fact for a conformant fiction. The unavailability of cross-axis aggregation is better recorded than papered over, and §13.1 now says so.

---

Ruling — GH-DEC-2026-011, 2026-09-09

gate-house closed the assent round the same day: ask 1 declined, ask 2 adopted, standard amended at net-kingdom@64394e9, dispositioned in gate-house/docs/conformance/2026-09-06-v08-assent-round.md.

Ask 1 (a dated transitional unknown: fail_open) — declined, and the reason is better than the ask. A sanctioned transitional fail_open is indistinguishable at runtime from the stance the rule forbids, and it would make the rule optional at the moment of adoption — the only moment it costs anything. Dating an intention to stop being permissive does not make unknown any more expensive for an attacker to induce while the transition runs. Accepted without reservation; the argument defeats the ask on its own terms.

Ask 2 (coverage published beside stance) — adopted. §13.1 now carries a Coverage column and this repo's figures are its first entries: signing targets 0/3 resolved; routing lanes 3/21 resolved (2026-09-09, self-measured). Three guards came with it, all of which we would have wanted: coverage does not soften the stance, does not gate it, and never makes a non-conformant cell conformant; a blank means "not reported" and never "complete"; and the decision carries an explicit reversal condition — if a row is ever argued to be conformant because its coverage is low, the column is doing harm and comes out.

That reversal condition is the right shape and it binds us first, since the column exists because we asked. Our row reads non-conformant and low-coverage; those are two facts, and the second is not a defence of the first.

The deadlock was recorded rather than routed around. §6.4 obligation 3 now states that a stricter stance is not a licence to manufacture the membership that makes it survivable — where a scope is unknown because another repository has published no workload-identity declaration, the consumer MUST NOT infer one. That is ADR-0009 rule 3 promoted into the standard at exactly the point where the pressure lands, which is more than we asked for.

What we did in response

• pep-stance.yaml marks the unknown cell as a declared gap inline, with the assent, the measured reason for not flipping, the declined ask, and WARDEN-WP-0040 as its route. The stance value is unchanged — v0.8 is still proposed and v0.7 remains in force, so standard_version stays 0.7 with a new standard_version_reviewed: 0.8.

• The coverage figures are published in pep-stance.yaml and, because we asked for the column, measured rather than hand-counted: scripts/report_coverage.py derives both populations from the artifacts the runtime uses, reusing report_workload_join.build rather than re-deriving the join. tests/test_layer_conformance.py asserts the published block equals the measured one, and asserts the cell stays marked while it is fail_open.

  A hand-counted figure in a register that explicitly does not recompute it would decay silently, and a stale number beside a marked cell is worse than the blank the other four rows carry — a blank at least reads as "not reported".

• WARDEN-WP-0040 T04 is closed; T01–T03 stand unchanged. gate-house confirmed they are not asking for the cell to be flipped before coverage exists.