railiance-master/workplans/RMASTER-WP-0026-netkingdom-security-layer-alignment.md

---
id: RMASTER-WP-0026
type: workplan
title: "Align railiance-master with the NetKingdom security-layer model"
domain: financials
repo: railiance-master
status: finished
owner: grok
topic_slug: netkingdom-security-layer-alignment
created: "2026-08-29"
updated: "2026-08-29"
state_hub_workstream_id: "256107a6-bf83-5e05-b2d5-1d75d790df5b"
---

# RMASTER-WP-0026 - Align railiance-master with the NetKingdom security-layer model

## Goal

Make this repository a conforming Taxonomy home for Railiance workload
operations under NetKingdom Security Layer Model v0.7: declare the layer in a
machine-readable form, record assent to statute §20, bind Railiance consumers
to the §20.2 consumption rules, split admission/exposure from authorization,
and open the five unsettled axis-to-layer questions without guessing them.

Source review: `history/260829-demand-netkingdom-security-layer-alignment.md`.
Statute: `net-kingdom/canon/standards/security-layer-model_v0.7.md`.
Companion: `net-kingdom/SECURITY-COMPANION.md` v0.2.

## Boundaries

- Do not add this repository to the NetKingdom §4 catalog; that is `gate-house`.
- Do not host a PDP, approval store, credential plane, or evidence archive.
- Do not publish a PEP stance map from this repository; it is not PEP-shaped.
- Do not invent a mapping of `rail-*` / `rapp-*` / `reef-*` / `railiance-*`
  onto Taxonomy, Tooling, Engine, or Staff. Statute §20.3 is unsettled.
- Do not absorb `glas-harness` session or tool-policy semantics.
- Do not treat observation-in-production or automatic containment as available.
- Do not fold RMASTER-WP-0020 (OpenBao migration) into this workplan.
- `info-tech-canon` remains the general semantic canon; this workplan does not
  redefine it.

## T01 - Machine-readable layer declaration

```task
id: RMASTER-WP-0026-T01
status: done
priority: high
state_hub_task_id: "fede9ca2-1c38-5e51-aa37-ff1abdfdfcd3"
```

Add `layer.yaml` in the kings-guard no-contact shape, pointing at security
layer model v0.7:

- `layer: taxonomy`
- `role` omitted
- `tooling_contacts: []`
- `non_tooling_clients` lists the State Hub progress/work-record client
- no `pep_stance` path
- catalog note: not a §4 row; operations Taxonomy, not NetKingdom security
  Taxonomy

`INTENT.md` frontmatter already declares `layer: Taxonomy`. Keep the file and
the frontmatter equal. A conformance script is optional in this task; the
declaration file is the §11 surface.

**Done when:** `layer.yaml` is committed, agrees with `INTENT.md`, and a
reviewer can see there are no Tooling contacts and no PEP claim.

Completed 2026-08-29. `layer.yaml` declares `layer: Taxonomy` against v0.7,
empty `tooling_contacts`, State Hub as the only non-Tooling client,
`pep_shaped: false`, and no `pep_stance` path. Frontmatter and file agree.

## T02 - Record assent to statute §20

```task
id: RMASTER-WP-0026-T02
status: done
priority: high
state_hub_task_id: "8c7baa43-0050-54ea-978e-6c58a2cb94e6"
```

Record, in this repository's own voice, that:

- statute §20.1 restates our axis and workload definitions and does not
  author them;
- statute §20.2 is accepted as the consumption constitution for every
  Railiance consumer of NetKingdom security;
- statute §20.3 remains unset, and this repository will not imply a mapping;
- changes to §20 require our assent for the axis definitions.

Form: a short accepted ADR, or a dated decision note under `docs/adr/` with
publication-grade metadata. Notify `gate-house` / `net-kingdom` so §14 stops
treating this repository as silent.

**Done when:** the assent record exists, is cited from `INTENT.md` or
`SCOPE.md`, and a State Hub message (or equivalent durable notice) has been
sent to `gate-house`.

Completed 2026-08-29. Assent is `docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`,
cited from INTENT and SCOPE. Notice sent to `gate-house`
(`da124e5c-fdc1-415a-bc6f-6a755508c981`), `net-kingdom`
(`5d9a1e08-fc86-44a3-81c8-435390f50657`), and `glas-harness`
(`f61159ea-d764-476b-a124-2182dc6ed749`) for the §20.3 seam.

## T03 - Framework consumption contract

```task
id: RMASTER-WP-0026-T03
status: done
priority: high
state_hub_task_id: "2ecaca39-c14e-567a-a667-d51babec749a"
```

Write a framework contract, cited by the T02 ADR or a follow-on ADR, that
Railiance rails, rapps, and reefs consume NetKingdom security as follows:

1. Authorization decisions come from `access-engine` only.
2. Approvals are `approval-engine` objects consumed as claims.
3. Credentials come from `secrets-engine` after a decision.
4. Evidence goes to `audit-core` under the alteration/truncation bound.
5. A runtime that causes a protected side effect is PEP-shaped and owes
   statute §6.4 in *its* repository, including a published stance map in the
   §13.1 register.

Do not copy engine schemas. Point at the statute and at the owning repos.
Distinguish this contract from ADR-0006 (admission) and ADR-0008 (exposure).

**Done when:** the contract is in `docs/`, an ADR cites it, and SCOPE's
"security consumption" gap no longer says the eight ADRs are silent on §20.2.

Completed 2026-08-29. Contract is
`docs/netkingdom-security-consumption-contract.md`, cited by ADR-0009. SCOPE
Current State names the contract rather than a silence.

## T04 - Split admission, exposure, and authorization

```task
id: RMASTER-WP-0026-T04
status: done
priority: medium
state_hub_task_id: "73241688-9877-54e8-8498-507efc7a42f4"
```

Add a short vocabulary note, preferably in the T03 contract rather than a
fourth ADR, that these three questions stay distinct:

| Question | Owner |
| --- | --- |
| May this binding run in production? | Railiance admission (ADR-0006) |
| Who may reach the listener we control? | Railiance exposure (ADR-0008) |
| May this actor perform this action on this resource? | `access-engine` |

`production-approved` and `exposure: public` MUST NOT be read as
authorization decisions. Compiled admission or exposure data that resolved
whether an actor may act would be statute §6.1 (deciding early).

**Done when:** ADR-0006, ADR-0008, and the T03 contract each point at the
split, and no schema field is renamed unless a later ADR requires it.

Completed 2026-08-29. The three-question table lives in the consumption
contract. ADR-0006 and ADR-0008, plus the admission and exposure contracts,
point at `access-engine` / ADR-0009. No schema field renamed.

## T05 - Track the five unsettled §20.3 questions

```task
id: RMASTER-WP-0026-T05
status: done
priority: medium
state_hub_task_id: "7827d59b-66aa-5d8b-8cfc-57024a7e588c"
```

Open a durable exploration record (demand files or a single `docs/` note
cited by T02) for the five questions statute §20.3 names, without answering
them:

1. Identity form of a `rapp-*` as a request-claim resource.
2. Whether a `rail-*` contract can carry PEP obligations, given that §6.4
   attaches to repositories.
3. Composition of a `reef-*` with a security zone.
4. Relation of the `railiance-*` ownership axis to the principal a decision
   is rendered for.
5. The `glas-harness` / statute §3.4 seam: tool policy versus conduit-or-engine
   API, where "tool availability is not permission" is either enforced or lost.

Question 5 requires `glas-harness` assent before any ADR. Questions 1–4
require `gate-house` / engine-owner review before they become framework
decisions. Do not ship a mapping ADR in this workplan.

**Done when:** each question has an owner, a next review date, and a stated
non-answer, and SCOPE lists them as tracked rather than as missing
architecture.

Completed 2026-08-29. `docs/netkingdom-axis-layer-open-questions.md` tracks
all five with owners, 2026-11-29 review, and standing non-answer "unset".
Question 5 requires `glas-harness` assent. No mapping ADR shipped.

## T06 - Close the SCOPE gap for this alignment

```task
id: RMASTER-WP-0026-T06
status: done
priority: low
state_hub_task_id: "6452ba15-0918-5907-a78d-b3d101e82060"
```

After T01–T05, refresh `SCOPE.md` Current State and Gap to Intent so they
describe evidenced artifacts rather than the 2026-08-29 starting deficit.
Keep Intent aspirational. Do not mark this workplan finished while T02 and
T03 are open.

**Done when:** SCOPE's security-consumption and layer-declaration bullets
match the files on disk, and this workplan can move to `finished` without
leaving silent follow-on work.

Completed 2026-08-29. SCOPE Current State and Gap to Intent describe the
evidenced artifacts. Remaining work is publication addressing and the
tracked §20.3 questions, not a missing declaration.

## Sequencing

T01 can proceed immediately. T02 and T03 are the load-bearing pair; T04 may
land inside T03. T05 must not block T02. T06 is last.