tegwick
fd08950231
The standard is accepted at v0.7, with SECURITY-COMPANION.md v0.2 as its operative form. Four ops-warden findings were adopted between v0.4 and v0.7 — §9.1's two marks, §5's Tooling scope rule, §6.4 obligation 1's second limb, and §13.1's existence — and both ops-warden declaration artifacts are now cited in the text as the estate's reference forms. INTENT.md gains frontmatter (layer: Staff, pep_shaped: true) because §11 requires a machine-readable declaration and prose cannot distinguish a declaration from a transcribed review. The note now covers the agent principal (§3.4), the PEP shape, the attributive evidence position, and the role the companion assigns: the estate is told to ask ops-warden which lane, which credential, which route. SCOPE.md records what is actually shipped against v0.7 and the honest conformance state — declared gap, which is tracked non-conformance, not conformance. The assessment checked every obligation against shipped code rather than intent. Three gaps survive: - §9.7.2 requires a PEP to state one revocation visibility deadline. Ours is unstated, and the honest value is uncomfortable: the cert TTL, up to 48h. A cert outlives revocation of the decision that authorized it — no CRL, no KRL distribution. That is a design property never written down, which is exactly what §9.7.2 exists to force into the open. - §3.4 rule 1 forbids standing credentials and requires issued, attributable authority. ADR-0004's boundary keys on WARDEN_AGENT_ID, which an agent sets about itself. key-cape now issues a real coding-agent identity, so the ops-warden half can stop being advisory. - §9.6 cadence remains undeclared. Attributive, so SHOULD not MUST, but silence through two reviews is the one outcome that is not defensible. WARDEN-WP-0034 addresses all three, plus the discoverability gap the companion creates and two items to route rather than absorb. 402 tests pass, ruff clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014535@bnt-lap001 Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c
6.9 KiB
| id | type | title | domain | repo | status | owner | topic_slug | planning_priority | depends_on_workplans | created | updated | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WARDEN-WP-0034 | workplan | Layer model v0.7 conformance — state the deadline, bind the agent boundary, steward the estate's newest rule | infotech | ops-warden | ready | ops-warden | netkingdom | P1 |
|
2026-08-29 | 2026-08-29 |
WARDEN-WP-0034 — Layer model v0.7 conformance
security-layer-model_v0.7 is accepted. ops-warden declared Staff and PEP-shaped,
shipped the two declaration artifacts the standard now cites as estate reference forms,
and had four findings adopted into the text between v0.4 and v0.7.
The assessment in history/2026-08-29-v07-scope-intent-assessment.md checked every
v0.7 obligation against shipped code rather than intent. Three gaps survive, plus a
role the companion assigns that no conformance check will ever catch.
Why a workplan and not an adhoc
T01 is a MUST that is currently unstated. T02 changes an enforcement boundary and
touches ADR-0004. T04 is a cross-repo stewardship commitment against a standard eight
repositories have yet to adopt. The convention reserves adhocs for low-risk work
completed directly; none of these qualify.
Tasks
id: WARDEN-WP-0034-T01
status: todo
priority: high
State the revocation visibility deadline (§9.7.2, a MUST).
ops-warden states none, and the honest value is the certificate TTL: up to 48 hours.
A cert issued under an allow remains valid for its full TTL even if the authorizing
decision is revoked the next minute. There is no CRL, no KRL distribution, and host-side
auth_principals belongs to railiance-infra.
Add the deadline to pep-stance.yaml as what it is — adm 48h / agt 24h / atm 8h —
with the mechanism named (TTL expiry, no revocation channel) rather than implied. Assert
it against the shipped ActorType TTL policy by test, the same way the stance map is
asserted equal to shipped behaviour: a stated deadline free to drift from the code has
the same defect as a stated stance free to drift.
Done when: the deadline is published, test-bound to the TTL policy, and the absence of a revocation channel is stated rather than left to inference.
Not in scope: shortening it. Whether 48h is acceptable is a joint question with
railiance-infra (KRL distribution) and is T05's to raise, not this task's to decide.
id: WARDEN-WP-0034-T02
status: todo
priority: high
Bind the agent read-boundary to an issued identity (§3.4 rule 1).
ADR-0004's boundary triggers on WARDEN_AGENT_ID — a variable the agent sets about
itself. An agent that omits it is not recognised as one. §3.4 rule 1 now requires
authority to be issued per task and attributable to the principal acted for.
The identity exists as of KEY-WP-0009-T03: codex-railiance-platform, subject
service:codex:railiance-platform, role coding-agent, 15-minute lifetime, with
railiance-platform enforcing the OpenBao-side policy.
Key the boundary on the issued identity where one is present; keep WARDEN_AGENT_ID as
a fallback that fails toward the boundary, never away from it. State plainly in the
ADR trail which half is enforced and which is advisory: the OpenBao-side deny is real,
the ops-warden-side refusal is a courtesy that a determined caller can decline.
Done when: an agent presenting the issued identity is recognised without setting
WARDEN_AGENT_ID, the fallback still refuses on risk: high lanes, and the
enforced/advisory split is written down.
Watch: do not turn this into ops-warden validating a token — that is verifying an
identity claim, adjacent to deciding, and ADR-0002/§6 both point away from it. Read
the identity; do not adjudicate it.
id: WARDEN-WP-0034-T03
status: todo
priority: medium
Derive an emission cadence, or defer it with a reason (§9.6).
ops-warden's trail is attributive, so cadence is a SHOULD rather than v0.7's MUST for load-bearing sources. It has been silent through two reviews, which is the one outcome that is not defensible.
Derive a baseline from the existing audit.jsonl and signatures log. If the signal is
too bursty to support a threshold — plausible, since volume is operator-driven — record
that as the finding with the distribution that shows it, and declare the deferral in
pep-stance.yaml. A measured "no useful baseline" is a result; silence is not.
Done when: either a declared cadence with its derivation, or a declared deferral carrying the data that justifies it.
id: WARDEN-WP-0034-T04
status: todo
priority: medium
Answer the question the companion sends the estate here to ask.
"For how to get something done — which lane, which credential, which route — ask
ops-warden."
Today the repo answers credential questions and no others. warden route and
warden plan cover lanes, owners and acts. Nothing answers "which layer am I", "how
do I declare", "I am PEP-shaped, what do I owe" — and eight of fifteen catalogued
repositories have yet to declare.
Provide the path, not the doctrine (that boundary is ADR-0010's and does not move):
a routing entry and a short playbook that carry a reader from the companion to the files
to copy — layer.yaml, pep-stance.yaml, check_layer_conformance.py,
test_layer_conformance.py — and the check to run. The standard already names these in
§11 and §6.4; what is missing is the route to them.
Done when: warden route find "how do I declare my layer" resolves, and the
playbook is reachable from the catalog. Not a restatement of the companion — a
pointer layer, per ADR-0001.
id: WARDEN-WP-0034-T05
status: todo
priority: low
Two things to raise rather than absorb.
Both are other repositories' to own; ops-warden's obligation is to route them, not to
fix them (ADR-0003, ADR-0005).
ops-masonhas published no stance map. §13.1's register has one row and the standard says that is itself the finding.ops-masonis catalogued PEP-shaped in the same paragraph and is ops-warden's peer lane owner. Offer the reference form; do not write their map.- The 48-hour replay window from T01. Once stated, raise with
railiance-infrawhether KRL distribution is worth building, and withaccess-enginewhether a decision lifetime shorter than the cert TTL is meaningful when nothing can recall the cert. State the question; let the owners answer.
Done when: both are routed with reasoning, and the answers recorded either way — including a refusal, which is an equally good answer.
Related
history/2026-08-29-v07-scope-intent-assessment.md— the gap analysis behind this planhistory/2026-08-29-layer-model-v04-review.md,-v06-review.md— the two prior reviewssecurity-layer-model_v0.7.md§3.4, §6.4, §9.6, §9.7, §11, §13.1net-kingdom/SECURITY-COMPANION.mdv0.2ADR-0002,ADR-0003,ADR-0004,ADR-0005,ADR-0009,ADR-0010