From a0c35b7438c4c6a3ccc368a18910802440d73f87 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 29 Aug 2026 12:52:35 +0200 Subject: [PATCH] =?UTF-8?q?feat(RMASTER-WP-0026):=20declare=20Taxonomy=20l?= =?UTF-8?q?ayer=20and=20consume=20NetKingdom=20=C2=A720?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add layer.yaml, RMASTER-ADR-0009, the consumption contract, and a tracked non-answer for the five §20.3 questions. Split admission, exposure, and authorization without renaming schema fields. Finish the workplan. Assistant: grok Assistant-Session: 01a04c9f-cd6b-7741-bce0-f1d9d1b3c3bc --- INTENT.md | 11 ++- README.md | 4 + SCOPE.md | 68 ++++++++------- .../adr/ADR-0006-reef-production-admission.md | 8 +- .../ADR-0008-private-by-default-exposure.md | 5 +- ...9-netkingdom-security-layer-interaction.md | 83 ++++++++++++++++++ docs/architecture/railiance_v0.1.md | 1 + docs/exposure-posture-contract.md | 2 + docs/netkingdom-axis-layer-open-questions.md | 50 +++++++++++ ...etkingdom-security-consumption-contract.md | 87 +++++++++++++++++++ docs/reef-production-readiness-contract.md | 3 +- layer.yaml | 54 ++++++++++++ ...026-netkingdom-security-layer-alignment.md | 40 +++++++-- 13 files changed, 373 insertions(+), 43 deletions(-) create mode 100644 docs/adr/ADR-0009-netkingdom-security-layer-interaction.md create mode 100644 docs/netkingdom-axis-layer-open-questions.md create mode 100644 docs/netkingdom-security-consumption-contract.md create mode 100644 layer.yaml diff --git a/INTENT.md b/INTENT.md index df288ba..149a7bc 100644 --- a/INTENT.md +++ b/INTENT.md @@ -92,9 +92,10 @@ and operated as a managed service, it is a workload like any other and is packaged, executed, and bound through `rapp-*`, `rail-*`, and `reef-*`. NetKingdom Security Layer Model v0.7 §20 restates these definitions; it does -not author them. Changes to that boundary require this repository's assent -for the axis definitions and `glas-harness`'s assent for the session and -tool-policy seam. +not author them. This repository's assent is +[`docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`](docs/adr/ADR-0009-netkingdom-security-layer-interaction.md). +Changes to that boundary require this repository's assent for the axis +definitions and `glas-harness`'s assent for the session and tool-policy seam. --- @@ -174,6 +175,10 @@ the other side's assent. They are not implied by this file. Admission (whether a binding may run in production) and exposure (who may reach a listener) remain Railiance axes. They are not authorization decisions. +The consumption contract is +[`docs/netkingdom-security-consumption-contract.md`](docs/netkingdom-security-consumption-contract.md). +The five unsettled axis-to-layer questions are tracked, not answered, in +[`docs/netkingdom-axis-layer-open-questions.md`](docs/netkingdom-axis-layer-open-questions.md). --- diff --git a/README.md b/README.md index 5eb232e..c63eb67 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,8 @@ recorded before they are spread across implementation repos. - [docs/rail-composition-contract.md](docs/rail-composition-contract.md) - [docs/reef-production-readiness-contract.md](docs/reef-production-readiness-contract.md) - [docs/exposure-posture-contract.md](docs/exposure-posture-contract.md) +- [docs/netkingdom-security-consumption-contract.md](docs/netkingdom-security-consumption-contract.md) +- [docs/netkingdom-axis-layer-open-questions.md](docs/netkingdom-axis-layer-open-questions.md) - [docs/qonto-knative-runtime-contract.md](docs/qonto-knative-runtime-contract.md) - [docs/adr/ADR-0001-repository-prefix-architecture.md](docs/adr/ADR-0001-repository-prefix-architecture.md) - [docs/adr/ADR-0002-rail-kubernetes-wave-1-boundary.md](docs/adr/ADR-0002-rail-kubernetes-wave-1-boundary.md) @@ -33,6 +35,8 @@ recorded before they are spread across implementation repos. - [docs/adr/ADR-0006-reef-production-admission.md](docs/adr/ADR-0006-reef-production-admission.md) - [docs/adr/ADR-0007-rapp-declaration-contract.md](docs/adr/ADR-0007-rapp-declaration-contract.md) - [docs/adr/ADR-0008-private-by-default-exposure.md](docs/adr/ADR-0008-private-by-default-exposure.md) +- [docs/adr/ADR-0009-netkingdom-security-layer-interaction.md](docs/adr/ADR-0009-netkingdom-security-layer-interaction.md) +- [layer.yaml](layer.yaml) ## Current Explorations diff --git a/SCOPE.md b/SCOPE.md index 4c6ec47..680db36 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -23,16 +23,17 @@ running deployable under rapp coverage (`ADR-0007`); human acts, credentials, broker actions, and non-deployable infrastructure resources remain outside that meaning. -This repository now **declares** itself Taxonomy of Railiance workload -operations in `INTENT.md` frontmatter (`layer: Taxonomy`, NetKingdom -security-layer-model v0.7). It is not a row in the NetKingdom §4 catalog. -The machine-readable `layer.yaml` form, a total non-Tooling-client account, -and a framework consumption contract for §20.2 are not yet evidenced here. +This repository **declares** itself Taxonomy of Railiance workload +operations in `INTENT.md` frontmatter and `layer.yaml` (`layer: Taxonomy`, +NetKingdom security-layer-model v0.7). It is not a row in the NetKingdom +§4 catalog. It is not PEP-shaped. Assent to statute §20 is +`docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`. The current implementation includes: -- eight accepted framework ADRs covering repository families, rail composition, - production admission, the rapp declaration contract, and exposure posture; +- nine accepted framework ADRs covering repository families, rail composition, + production admission, the rapp declaration contract, exposure posture, and + the NetKingdom security-layer interaction boundary; - framework contracts and migration guidance under `docs/`; - JSON Schemas for rail, rapp, and reef declarations plus a family-declaration validator and fixtures; @@ -86,7 +87,8 @@ not own every implementation implied by them. - PEP stance maps and unreachable-engine behaviour of implementation repositories; this repo is not PEP-shaped - A guessed mapping of rail, rapp, reef, or ownership onto Taxonomy, - Tooling, Engine, or Staff — statute §20.3 is unsettled + Tooling, Engine, or Staff — statute §20.3 is tracked unanswered in + `docs/netkingdom-axis-layer-open-questions.md` - Automatic containment or production observation; both are estate-wide zeros, not this repository's gaps to close @@ -107,9 +109,9 @@ not own every implementation implied by them. The policy publication corpus from this repo is `docs/adr/*.md`. Workplans, evidence, runbooks, schemas, and general documentation are not policy merely -because they are useful. `policy-nexus` currently discovers all eight ADRs, but -they remain `metadata-pending` until source lifecycle metadata and explicit -publication addressing are completed. +because they are useful. `policy-nexus` currently discovers the earlier eight +ADRs as `metadata-pending`; ADR-0009 is an additional source record awaiting +the same publication addressing. --- @@ -146,20 +148,23 @@ publication addressing are completed. - Status: maintained and evolving - Architecture baseline: four repository axes are materialized and governed by accepted ADRs and contracts -- Layer declaration: `INTENT.md` frontmatter declares `layer: Taxonomy` - against security-layer-model v0.7; `layer.yaml` and a conformance check are - not yet present -- Security consumption: ADR-0001 through ADR-0008 do not yet encode the - §20.2 rules (one PDP, approvals as claims, credentials after a decision, - evidence bound, PEP-shape of implementation runtimes) -- Admission (ADR-0006) and exposure (ADR-0008) are live Railiance axes and - are not yet demarcated in-repo from authorization decisions +- Layer declaration: `INTENT.md` frontmatter and `layer.yaml` declare + `layer: Taxonomy` against security-layer-model v0.7; no Tooling contacts; + State Hub listed as a non-Tooling client; not PEP-shaped +- Security consumption: ADR-0009 and + `docs/netkingdom-security-consumption-contract.md` encode the §20.2 rules + (one PDP, approvals as claims, credentials after a decision, evidence + bound, PEP-shape of implementation runtimes) +- Admission (ADR-0006), exposure (ADR-0008), and authorization + (`access-engine` via ADR-0009) are demarcated in-repo +- Axis-to-layer mapping: five statute §20.3 questions are tracked unanswered + in `docs/netkingdom-axis-layer-open-questions.md`; next review 2026-11-29 - Validation: rail/rapp/reef schemas and declaration checks are implemented - Active cross-repo work: OpenBao migration closeout remains partially blocked; public-listener retraction is in progress while destructive source cleanup retains separate approval and disaster-recovery gates - Publication: ADR discovery exists in `policy-nexus`; publication metadata and - stable addressing remain an open alignment gap + stable addressing remain an open alignment gap, now including ADR-0009 --- @@ -208,9 +213,13 @@ Intentional deviations and omissions: - Start with: `README.md`, `INTENT.md`, `SCOPE.md` - Architecture entry points: `docs/repository-axes.md`, `docs/reef-substrate-model.md`, `docs/adr/` +- NetKingdom interaction: `layer.yaml`, + `docs/netkingdom-security-consumption-contract.md`, + `docs/netkingdom-axis-layer-open-questions.md`, + `docs/adr/ADR-0009-netkingdom-security-layer-interaction.md` - NetKingdom alignment review: `history/260829-demand-netkingdom-security-layer-alignment.md` -- Machine-readable contracts: `schemas/`, +- Machine-readable contracts: `schemas/`, `layer.yaml`, `tools/validate-family-declarations.py` - Active and historical coordination: `workplans/`, `WORK-RECORDS.md` @@ -243,12 +252,11 @@ keywords: [schema, validation, declaration, rail, rapp, reef] ## Gap to Intent -The remaining alignment work is to complete downstream ADR publication, cleanly -archive completed work without breaking State Hub conventions, retain a -repeatable canon-consumer review packet as the architecture evolves, and close -the NetKingdom security-layer gap recorded in -`history/260829-demand-netkingdom-security-layer-alignment.md` and tracked by -`RMASTER-WP-0026`: a machine-readable layer declaration, a §20.2 consumption -contract, a vocabulary split between admission/exposure and authorization, and -assented answers to the five unsettled axis-to-layer questions. Do not invent -the mapping, host a PDP, or take PEP shape in this repository. +The remaining alignment work is to complete downstream ADR publication +(including ADR-0009), cleanly archive completed work without breaking State +Hub conventions, and retain a repeatable canon-consumer review packet as the +architecture evolves. The NetKingdom security-layer declaration, §20 assent, +consumption contract, and admission/exposure/authorization split are now +evidenced. The five axis-to-layer questions remain tracked unanswered until +their named reviewers assent; they are not a silent deficit of this +repository. Do not invent the mapping, host a PDP, or take PEP shape here. diff --git a/docs/adr/ADR-0006-reef-production-admission.md b/docs/adr/ADR-0006-reef-production-admission.md index 4ab6898..90d8fd6 100644 --- a/docs/adr/ADR-0006-reef-production-admission.md +++ b/docs/adr/ADR-0006-reef-production-admission.md @@ -4,7 +4,7 @@ title: "Reef Production Admission" status: accepted revision: "accepted-1" owner: railiance-master -last_reviewed: "2026-08-15" +last_reviewed: "2026-08-29" review_interval: 6m --- @@ -36,6 +36,11 @@ Who may reach a listener is a different axis: admission does not imply a public surface. A public surface requires this admission **and** an exposure grant. +Neither admission nor exposure is an authorization decision. Whether an +actor may perform an action on a resource is `access-engine` +([`ADR-0009`](ADR-0009-netkingdom-security-layer-interaction.md)). +`production-approved` MUST NOT be read as permission to act. + ## Consequences - `hosts_rail` and `binds_rapp` no longer imply deployability. @@ -44,3 +49,4 @@ this admission **and** an exposure grant. - Repeated evidence collection should become functional automation. - `production-approved` is not permission to publish a listener. See ADR-0008. +- `production-approved` is not an authorization decision. See ADR-0009. diff --git a/docs/adr/ADR-0008-private-by-default-exposure.md b/docs/adr/ADR-0008-private-by-default-exposure.md index 5f9e5d8..629c8c9 100644 --- a/docs/adr/ADR-0008-private-by-default-exposure.md +++ b/docs/adr/ADR-0008-private-by-default-exposure.md @@ -4,7 +4,7 @@ title: "Private-by-default Exposure" status: accepted revision: "accepted-1" owner: railiance-master -last_reviewed: "2026-08-15" +last_reviewed: "2026-08-29" review_interval: 6m --- @@ -89,6 +89,9 @@ The detailed per-family reading lives in - ADR-0006 still answers "may this binding run in production?" This ADR answers "who may reach the listener?" Do not merge the axes. +- Neither question is an authorization decision. Whether an actor may + perform an action is `access-engine` ([`ADR-0009`](ADR-0009-netkingdom-security-layer-interaction.md)). + `exposure: public` MUST NOT be read as permission to act. - The three readiness enums stay distinct on purpose. - Family schemas grow an additive `exposure` field. Rapp `data_classification: public` is a different field and must not be diff --git a/docs/adr/ADR-0009-netkingdom-security-layer-interaction.md b/docs/adr/ADR-0009-netkingdom-security-layer-interaction.md new file mode 100644 index 0000000..2d5daca --- /dev/null +++ b/docs/adr/ADR-0009-netkingdom-security-layer-interaction.md @@ -0,0 +1,83 @@ +--- +id: RMASTER-ADR-0009 +title: "NetKingdom Security-Layer Interaction Boundary" +status: accepted +revision: "accepted-1" +owner: railiance-master +last_reviewed: "2026-08-29" +review_interval: 6m +--- + +# ADR-0009: NetKingdom Security-Layer Interaction Boundary + +Date: 2026-08-29 +Status: Accepted + +## Context + +NetKingdom Security Layer Model v0.7 is accepted. Section 20 restates +Railiance workload-operation definitions owned by this repository and +states consumption rules every Railiance consumer of NetKingdom security +owes. Companion v0.2 §9 is the operative form of the same boundary. + +This repository had declared the four axes and the workload coverage rule +in its own voice, but had no machine-readable layer declaration, no +recorded assent to §20, and no framework contract that bound rails, rapps, +and reefs to those consumption rules. Admission (ADR-0006) and exposure +(ADR-0008) were live and were not demarcated from authorization. + +Statute §20.4: an interaction boundary between two frameworks is owned by +neither alone. Changes to §20 require this repository's assent for the +axis definitions and `glas-harness` assent for the session and tool-policy +seam. + +Ratified 2026-08-29 under `RMASTER-WP-0026`. + +## Decision + +1. **This repository is Taxonomy of Railiance workload operations.** The + machine-readable declaration is [`layer.yaml`](../../layer.yaml). It is + not a NetKingdom §4 catalog row. It is not PEP-shaped. It holds no + Tooling-layer client. + +2. **Statute §20.1 restates our definitions and does not author them.** + Workload, the four axes, and the rule that `rein-*` is not a fifth axis + remain this repository's. NetKingdom may cite them; it may not redefine + them without our assent. + +3. **Statute §20.2 is the consumption constitution** for every Railiance + consumer of NetKingdom security. The detailed contract is + [`docs/netkingdom-security-consumption-contract.md`](../netkingdom-security-consumption-contract.md). + +4. **Statute §20.3 remains unset.** This repository will not imply a + mapping of rails, rapps, reefs, or ownership onto Taxonomy, Tooling, + Engine, or Staff. The five questions are tracked, unanswered, in + [`docs/netkingdom-axis-layer-open-questions.md`](../netkingdom-axis-layer-open-questions.md). + +5. **Admission, exposure, and authorization stay three questions.** + ADR-0006 answers whether a binding may run in production. ADR-0008 + answers who may reach a listener we control. `access-engine` answers + whether an actor may perform an action. `production-approved` and + `exposure: public` are not authorization decisions. + +6. **Changes to this boundary** require this repository's assent for the + axis definitions. Changes that touch the glas-harness seam require + `glas-harness` assent as well. + +## Consequences + +- Rails, rapps, and reefs consume `access-engine`, `approval-engine`, + `secrets-engine`, and `audit-core`. They do not grow local substitutes. +- This repository does not host a PDP, an approval store, a credential + plane, an evidence archive, or an actuation surface. +- PEP stance maps belong in the repositories that cause protected side + effects, inventoried in statute §13.1, not here. +- Observation-in-production and automatic containment remain estate-wide + zeros. Framework plans must not assume they exist. +- `gate-house` can cite this ADR as this repository's own-voice + declaration and §20 assent, rather than a review note about us. + +## Notes + +This ADR does not amend ADR-0001 through ADR-0008. It adds the security +consumption axis those records did not have to name. diff --git a/docs/architecture/railiance_v0.1.md b/docs/architecture/railiance_v0.1.md index ef2babd..45c915e 100644 --- a/docs/architecture/railiance_v0.1.md +++ b/docs/architecture/railiance_v0.1.md @@ -119,6 +119,7 @@ Published on policy.coulomb.social from this repo: | `RMASTER-ADR-0006` | accepted | Reef production admission | | `RMASTER-ADR-0007` | accepted | Rapp declaration contract | | `RMASTER-ADR-0008` | accepted | Private-by-default exposure | +| `RMASTER-ADR-0009` | accepted | NetKingdom security-layer interaction | Also published from `railiance-platform`: `RPLAT-ADR-0001` (S3 platform services), `RPLAT-ADR-0002` (placement rule), `RPLAT-ADR-0003` diff --git a/docs/exposure-posture-contract.md b/docs/exposure-posture-contract.md index 2317771..173640f 100644 --- a/docs/exposure-posture-contract.md +++ b/docs/exposure-posture-contract.md @@ -15,6 +15,8 @@ those fields here except to name the objects the validator checks. Admission (ADR-0006) answers "may this binding run in production?" Exposure answers "who may reach the listener?" A `production-approved` binding is still private until a grant exists. +Neither is an authorization decision. Whether an actor may perform an +action is `access-engine` (ADR-0009). ## Vocabulary diff --git a/docs/netkingdom-axis-layer-open-questions.md b/docs/netkingdom-axis-layer-open-questions.md new file mode 100644 index 0000000..9508f72 --- /dev/null +++ b/docs/netkingdom-axis-layer-open-questions.md @@ -0,0 +1,50 @@ +# Unsettled axis-to-layer questions (statute §20.3) + +Date: 2026-08-29 +Status: tracked non-answer under ADR-0009 / RMASTER-WP-0026-T05 +Next review: 2026-11-29 + +## Purpose + +Statute §20.3 names five questions about how Railiance axes meet the +NetKingdom security-layer model and **deliberately does not answer them**. +Guessing a mapping would be worse than admitting the gap. + +This record keeps each question visible, owned, and unanswered. It is not +an ADR. A mapping ADR is forbidden until the named reviewers have assented. + +On disagreement the statute governs: +`net-kingdom/canon/standards/security-layer-model_v0.7.md` §20.3. + +## Standing non-answer + +For every row below: **unset**. Do not infer an answer from current +practice, from a repo prefix, from a Fabric graph edge, or from a +declaration field. Implementation repos must not ship a local mapping. + +## The five questions + +| # | Question | Why it is open | Propose | Must review before any ADR | Next review | +| --- | --- | --- | --- | --- | --- | +| 1 | Identity form of a `rapp-*` as a request-claim resource | A rapp is the most likely *resource* a decision is about, but nothing states its identity form in a claim | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 | +| 2 | Whether a `rail-*` contract can carry PEP obligations | PEP shape is most likely to live on a rail, but statute §6.4 attaches to repositories and a rail is a contract | `railiance-master` | `gate-house`; any `rail-*` that is actually PEP-shaped | 2026-11-29 | +| 3 | Composition of a `reef-*` with a security zone | A reef answers where a workload is bound; a zone answers which scrutiny it has qualified for. Adjacent is not equal. `zone-engine` already records this as a canon composition problem | `railiance-master` | `zone-engine`, `gate-house` | 2026-11-29 | +| 4 | Relation of the `railiance-*` ownership axis to the principal a decision is rendered for | Ownership names who owns a capability. That is adjacent to the subject of a decision, not equal to it | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 | +| 5 | The `glas-harness` / statute §3.4 seam | Tool policy and session semantics are glas-harness's; an agent may act only through a conduit or an Engine API. Neither half is sufficient. This is where "tool availability is not permission" is enforced or lost | `glas-harness` with `railiance-master` | `glas-harness` (required), `gate-house` | 2026-11-29 | + +Question 5 is the highest-consequence of the five. No Railiance ADR may +answer it without `glas-harness` assent (statute §20.4). + +## What this record is not + +- a mapping of `rail-*` / `rapp-*` / `reef-*` / `railiance-*` onto + Taxonomy, Tooling, Engine, or Staff +- a licence for a rail or rapp to invent a local claim shape +- a substitute for statute §17 Taxonomy artifacts (request-claim schema, + gap-record schema, emission-cadence declaration) + +## Related + +- [ADR-0009](adr/ADR-0009-netkingdom-security-layer-interaction.md) +- [Consumption contract](netkingdom-security-consumption-contract.md) +- Companion §9: "How the axes map onto the layer model is not settled" diff --git a/docs/netkingdom-security-consumption-contract.md b/docs/netkingdom-security-consumption-contract.md new file mode 100644 index 0000000..030d666 --- /dev/null +++ b/docs/netkingdom-security-consumption-contract.md @@ -0,0 +1,87 @@ +# NetKingdom Security Consumption Contract + +Date: 2026-08-29 +Status: Adopted under ADR-0009 / RMASTER-WP-0026-T03 + +## Purpose + +Say what every Railiance rail, rapp, and reef owes when it consumes +NetKingdom security, without copying engine schemas or turning this +repository into a second decision point. + +The statute is `net-kingdom/canon/standards/security-layer-model_v0.7.md` +§20.2 and §6.4. The working companion is `net-kingdom/SECURITY-COMPANION.md` +v0.2 §9. On disagreement the statute governs. + +This contract does **not** decide: + +- whether a binding may run in production — that is [ADR-0006](adr/ADR-0006-reef-production-admission.md); +- who may reach a listener we control — that is [ADR-0008](adr/ADR-0008-private-by-default-exposure.md); +- how the four Railiance axes map onto Taxonomy, Tooling, Engine, and Staff + — that remains unset in [the open-questions record](netkingdom-axis-layer-open-questions.md). + +## Three distinct questions + +| Question | Owner | Must not be read as | +| --- | --- | --- | +| May this binding run in production? | Railiance admission (ADR-0006) | permission for an actor to act | +| Who may reach the listener we control? | Railiance exposure (ADR-0008) | an authorization decision | +| May this actor perform this action on this resource? | `access-engine` | admission or exposure | + +`production-approved` and `exposure: public` MUST NOT be treated as +authorization decisions. Compiled admission or exposure data that resolved +whether an actor may act would be statute §6.1 — deciding early. + +## Consumption rules + +For any Railiance consumer of NetKingdom security, without exception: + +1. **Authorization decisions come from `access-engine` and from nowhere + else.** No rail, rapp, reef, or ownership repo may render or cache an + authorization verdict. A registry, schema, or cache that resolves a + result before the engine runs has decided early (statute §6.1). +2. **Approvals are objects in `approval-engine`, consumed as claims.** + They are not a Railiance axis and not an audit-core verdict. Callers + needing current approval state ask `approval-engine`. +3. **Credentials are materialized by `secrets-engine` after a decision, + never as a substitute for one.** A lease or certificate is an artifact + of authority, not its source. +4. **Evidence goes to `audit-core` under the bound in statute §9.6.** An + archive proves records were not altered or truncated after arrival. It + does not prove an event was sent. Absence of a record is not + non-occurrence. +5. **A runtime that causes a protected side effect is PEP-shaped** and + owes statute §6.4 **in its own repository**: no side effect without a + decision record or a recorded unreachable-engine stance; no replay + outside the decision's binding and lifetime; a published stance map + inventoried in statute §13.1; reconstructability within the evidence + bound. + +This repository is not PEP-shaped. `layer.yaml` records that. Implementation +rails, rapps, and reefs that do cause protected side effects inherit these +obligations themselves. This contract does not publish a stance map. + +## What this repository does not host + +- a policy decision point +- an approval store +- a credential lifecycle API +- an evidence archive +- an actuation or containment surface + +Observation-in-production and automatic containment are estate-wide zeros +(companion §10). Do not plan Railiance operations as if they existed. + +## Engine schemas stay with their owners + +This file names the engines and the rules. It does not restate their +request, decision, approval, credential, or evidence schemas. Those +contracts live in the owning repositories and, for shared claim +vocabulary, in Taxonomy artifacts statute §17 still requires. + +## Related + +- [ADR-0009](adr/ADR-0009-netkingdom-security-layer-interaction.md) — assent +- [ADR-0006](adr/ADR-0006-reef-production-admission.md) — admission +- [ADR-0008](adr/ADR-0008-private-by-default-exposure.md) — exposure +- [Open questions](netkingdom-axis-layer-open-questions.md) — §20.3, unset diff --git a/docs/reef-production-readiness-contract.md b/docs/reef-production-readiness-contract.md index 34e5836..ceff6cd 100644 --- a/docs/reef-production-readiness-contract.md +++ b/docs/reef-production-readiness-contract.md @@ -14,7 +14,8 @@ requires explicit readiness evidence. This contract does not decide who may reach a listener. That is [`ADR-0008`](adr/ADR-0008-private-by-default-exposure.md). A `production-approved` binding is still private until an exposure grant -exists. +exists. It also does not decide whether an actor may perform an action. +That is `access-engine` ([`ADR-0009`](adr/ADR-0009-netkingdom-security-layer-interaction.md)). ## Admission States diff --git a/layer.yaml b/layer.yaml new file mode 100644 index 0000000..fc57570 --- /dev/null +++ b/layer.yaml @@ -0,0 +1,54 @@ +# railiance-master — NetKingdom security layer declaration +# +# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md +# Companion: net-kingdom/SECURITY-COMPANION.md v0.2 +# Assent: docs/adr/ADR-0009-netkingdom-security-layer-interaction.md +# +# §11 requires a machine-readable declaration: prose cannot distinguish a +# declaration from a transcribed review. Form adapted from the kings-guard +# no-contact shape offered under §11. +# +# This repository produces terms, family contracts, and standards for +# workload operations. It owns no runtime position and no state another +# layer depends on. It is Taxonomy of Railiance operations, not a row in +# the NetKingdom §4 security-estate catalog. +# +# It is not PEP-shaped: nothing here causes a protected side effect, so +# there is no pep_stance path. + +schema_version: "0.1" +framework: netkingdom-security-layer-model +standard_version: "0.7" +repository: railiance-master +layer: Taxonomy +declared_by: docs/adr/ADR-0009-netkingdom-security-layer-interaction.md +declared_at: "2026-08-29" +pep_shaped: false + +catalog_entry: + note: >- + Not a NetKingdom §4 catalog row. This is Railiance operations Taxonomy, + not NetKingdom security Taxonomy. info-tech-canon remains ecosystem-wide + semantics; net-kingdom remains NetKingdom standards of record. + +# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling +# row). Empty is a claim: this Taxonomy home holds no OpenBao, key-cape, +# or cluster client. +tooling_contacts: [] + +# §11 requires non-Tooling clients to be recorded so the check is total. +non_tooling_clients: + - id: state-hub-work-records + target: state-hub + layer: not-catalogued + operation: "HTTP to the Custodian State Hub for work records and progress events" + write: true + note: >- + Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4 + Tooling row, and state-hub is not one. Recorded, not policed. Carries + no security authority and no secret payload. + +declared_shapes: + "5.1": [] + "5.2": [] + "5.3": [] diff --git a/workplans/RMASTER-WP-0026-netkingdom-security-layer-alignment.md b/workplans/RMASTER-WP-0026-netkingdom-security-layer-alignment.md index ca029b5..d0ce49b 100644 --- a/workplans/RMASTER-WP-0026-netkingdom-security-layer-alignment.md +++ b/workplans/RMASTER-WP-0026-netkingdom-security-layer-alignment.md @@ -4,7 +4,7 @@ type: workplan title: "Align railiance-master with the NetKingdom security-layer model" domain: financials repo: railiance-master -status: ready +status: finished owner: grok topic_slug: netkingdom-security-layer-alignment created: "2026-08-29" @@ -43,7 +43,7 @@ Companion: `net-kingdom/SECURITY-COMPANION.md` v0.2. ```task id: RMASTER-WP-0026-T01 -status: todo +status: done priority: high state_hub_task_id: "fede9ca2-1c38-5e51-aa37-ff1abdfdfcd3" ``` @@ -66,11 +66,15 @@ declaration file is the §11 surface. **Done when:** `layer.yaml` is committed, agrees with `INTENT.md`, and a reviewer can see there are no Tooling contacts and no PEP claim. +Completed 2026-08-29. `layer.yaml` declares `layer: Taxonomy` against v0.7, +empty `tooling_contacts`, State Hub as the only non-Tooling client, +`pep_shaped: false`, and no `pep_stance` path. Frontmatter and file agree. + ## T02 - Record assent to statute §20 ```task id: RMASTER-WP-0026-T02 -status: todo +status: done priority: high state_hub_task_id: "8c7baa43-0050-54ea-978e-6c58a2cb94e6" ``` @@ -92,11 +96,17 @@ treating this repository as silent. `SCOPE.md`, and a State Hub message (or equivalent durable notice) has been sent to `gate-house`. +Completed 2026-08-29. Assent is `docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`, +cited from INTENT and SCOPE. Notice sent to `gate-house` +(`da124e5c-fdc1-415a-bc6f-6a755508c981`), `net-kingdom` +(`5d9a1e08-fc86-44a3-81c8-435390f50657`), and `glas-harness` +(`f61159ea-d764-476b-a124-2182dc6ed749`) for the §20.3 seam. + ## T03 - Framework consumption contract ```task id: RMASTER-WP-0026-T03 -status: todo +status: done priority: high state_hub_task_id: "2ecaca39-c14e-567a-a667-d51babec749a" ``` @@ -118,11 +128,15 @@ Distinguish this contract from ADR-0006 (admission) and ADR-0008 (exposure). **Done when:** the contract is in `docs/`, an ADR cites it, and SCOPE's "security consumption" gap no longer says the eight ADRs are silent on §20.2. +Completed 2026-08-29. Contract is +`docs/netkingdom-security-consumption-contract.md`, cited by ADR-0009. SCOPE +Current State names the contract rather than a silence. + ## T04 - Split admission, exposure, and authorization ```task id: RMASTER-WP-0026-T04 -status: todo +status: done priority: medium state_hub_task_id: "73241688-9877-54e8-8498-507efc7a42f4" ``` @@ -143,11 +157,15 @@ whether an actor may act would be statute §6.1 (deciding early). **Done when:** ADR-0006, ADR-0008, and the T03 contract each point at the split, and no schema field is renamed unless a later ADR requires it. +Completed 2026-08-29. The three-question table lives in the consumption +contract. ADR-0006 and ADR-0008, plus the admission and exposure contracts, +point at `access-engine` / ADR-0009. No schema field renamed. + ## T05 - Track the five unsettled §20.3 questions ```task id: RMASTER-WP-0026-T05 -status: todo +status: done priority: medium state_hub_task_id: "7827d59b-66aa-5d8b-8cfc-57024a7e588c" ``` @@ -173,11 +191,15 @@ decisions. Do not ship a mapping ADR in this workplan. non-answer, and SCOPE lists them as tracked rather than as missing architecture. +Completed 2026-08-29. `docs/netkingdom-axis-layer-open-questions.md` tracks +all five with owners, 2026-11-29 review, and standing non-answer "unset". +Question 5 requires `glas-harness` assent. No mapping ADR shipped. + ## T06 - Close the SCOPE gap for this alignment ```task id: RMASTER-WP-0026-T06 -status: todo +status: done priority: low state_hub_task_id: "6452ba15-0918-5907-a78d-b3d101e82060" ``` @@ -191,6 +213,10 @@ T03 are open. match the files on disk, and this workplan can move to `finished` without leaving silent follow-on work. +Completed 2026-08-29. SCOPE Current State and Gap to Intent describe the +evidenced artifacts. Remaining work is publication addressing and the +tracked §20.3 questions, not a missing declaration. + ## Sequencing T01 can proceed immediately. T02 and T03 are the load-bearing pair; T04 may