feat(RMASTER-WP-0026): declare Taxonomy layer and consume NetKingdom §20

Add layer.yaml, RMASTER-ADR-0009, the consumption contract, and a tracked
non-answer for the five §20.3 questions. Split admission, exposure, and
authorization without renaming schema fields. Finish the workplan.

Assistant: grok
Assistant-Session: 01a04c9f-cd6b-7741-bce0-f1d9d1b3c3bc

docs/adr/ADR-0006-reef-production-admission.md

@@ -4,7 +4,7 @@ title: "Reef Production Admission"
 status: accepted
 revision: "accepted-1"
 owner: railiance-master
-last_reviewed: "2026-08-15"
+last_reviewed: "2026-08-29"
 review_interval: 6m
 ---
 
@@ -36,6 +36,11 @@ Who may reach a listener is a different axis:
 admission does not imply a public surface. A public surface requires
 this admission **and** an exposure grant.
 
+Neither admission nor exposure is an authorization decision. Whether an
+actor may perform an action on a resource is `access-engine`
+([`ADR-0009`](ADR-0009-netkingdom-security-layer-interaction.md)).
+`production-approved` MUST NOT be read as permission to act.
+
 ## Consequences
 
 - `hosts_rail` and `binds_rapp` no longer imply deployability.
@@ -44,3 +49,4 @@ this admission **and** an exposure grant.
 - Repeated evidence collection should become functional automation.
 - `production-approved` is not permission to publish a listener. See
   ADR-0008.
+- `production-approved` is not an authorization decision. See ADR-0009.

docs/adr/ADR-0008-private-by-default-exposure.md

@@ -4,7 +4,7 @@ title: "Private-by-default Exposure"
 status: accepted
 revision: "accepted-1"
 owner: railiance-master
-last_reviewed: "2026-08-15"
+last_reviewed: "2026-08-29"
 review_interval: 6m
 ---
 
@@ -89,6 +89,9 @@ The detailed per-family reading lives in
 
 - ADR-0006 still answers "may this binding run in production?" This ADR
   answers "who may reach the listener?" Do not merge the axes.
+- Neither question is an authorization decision. Whether an actor may
+  perform an action is `access-engine` ([`ADR-0009`](ADR-0009-netkingdom-security-layer-interaction.md)).
+  `exposure: public` MUST NOT be read as permission to act.
 - The three readiness enums stay distinct on purpose.
 - Family schemas grow an additive `exposure` field. Rapp
   `data_classification: public` is a different field and must not be

docs/adr/ADR-0009-netkingdom-security-layer-interaction.md

@@ -0,0 +1,83 @@
+---
+id: RMASTER-ADR-0009
+title: "NetKingdom Security-Layer Interaction Boundary"
+status: accepted
+revision: "accepted-1"
+owner: railiance-master
+last_reviewed: "2026-08-29"
+review_interval: 6m
+---
+
+# ADR-0009: NetKingdom Security-Layer Interaction Boundary
+
+Date: 2026-08-29
+Status: Accepted
+
+## Context
+
+NetKingdom Security Layer Model v0.7 is accepted. Section 20 restates
+Railiance workload-operation definitions owned by this repository and
+states consumption rules every Railiance consumer of NetKingdom security
+owes. Companion v0.2 §9 is the operative form of the same boundary.
+
+This repository had declared the four axes and the workload coverage rule
+in its own voice, but had no machine-readable layer declaration, no
+recorded assent to §20, and no framework contract that bound rails, rapps,
+and reefs to those consumption rules. Admission (ADR-0006) and exposure
+(ADR-0008) were live and were not demarcated from authorization.
+
+Statute §20.4: an interaction boundary between two frameworks is owned by
+neither alone. Changes to §20 require this repository's assent for the
+axis definitions and `glas-harness` assent for the session and tool-policy
+seam.
+
+Ratified 2026-08-29 under `RMASTER-WP-0026`.
+
+## Decision
+
+1. **This repository is Taxonomy of Railiance workload operations.** The
+   machine-readable declaration is [`layer.yaml`](../../layer.yaml). It is
+   not a NetKingdom §4 catalog row. It is not PEP-shaped. It holds no
+   Tooling-layer client.
+
+2. **Statute §20.1 restates our definitions and does not author them.**
+   Workload, the four axes, and the rule that `rein-*` is not a fifth axis
+   remain this repository's. NetKingdom may cite them; it may not redefine
+   them without our assent.
+
+3. **Statute §20.2 is the consumption constitution** for every Railiance
+   consumer of NetKingdom security. The detailed contract is
+   [`docs/netkingdom-security-consumption-contract.md`](../netkingdom-security-consumption-contract.md).
+
+4. **Statute §20.3 remains unset.** This repository will not imply a
+   mapping of rails, rapps, reefs, or ownership onto Taxonomy, Tooling,
+   Engine, or Staff. The five questions are tracked, unanswered, in
+   [`docs/netkingdom-axis-layer-open-questions.md`](../netkingdom-axis-layer-open-questions.md).
+
+5. **Admission, exposure, and authorization stay three questions.**
+   ADR-0006 answers whether a binding may run in production. ADR-0008
+   answers who may reach a listener we control. `access-engine` answers
+   whether an actor may perform an action. `production-approved` and
+   `exposure: public` are not authorization decisions.
+
+6. **Changes to this boundary** require this repository's assent for the
+   axis definitions. Changes that touch the glas-harness seam require
+   `glas-harness` assent as well.
+
+## Consequences
+
+- Rails, rapps, and reefs consume `access-engine`, `approval-engine`,
+  `secrets-engine`, and `audit-core`. They do not grow local substitutes.
+- This repository does not host a PDP, an approval store, a credential
+  plane, an evidence archive, or an actuation surface.
+- PEP stance maps belong in the repositories that cause protected side
+  effects, inventoried in statute §13.1, not here.
+- Observation-in-production and automatic containment remain estate-wide
+  zeros. Framework plans must not assume they exist.
+- `gate-house` can cite this ADR as this repository's own-voice
+  declaration and §20 assent, rather than a review note about us.
+
+## Notes
+
+This ADR does not amend ADR-0001 through ADR-0008. It adds the security
+consumption axis those records did not have to name.

docs/architecture/railiance_v0.1.md

@@ -119,6 +119,7 @@ Published on policy.coulomb.social from this repo:
 | `RMASTER-ADR-0006` | accepted | Reef production admission |
 | `RMASTER-ADR-0007` | accepted | Rapp declaration contract |
 | `RMASTER-ADR-0008` | accepted | Private-by-default exposure |
+| `RMASTER-ADR-0009` | accepted | NetKingdom security-layer interaction |
 
 Also published from `railiance-platform`: `RPLAT-ADR-0001` (S3 platform
 services), `RPLAT-ADR-0002` (placement rule), `RPLAT-ADR-0003`

docs/exposure-posture-contract.md

@@ -15,6 +15,8 @@ those fields here except to name the objects the validator checks.
 Admission (ADR-0006) answers "may this binding run in production?"
 Exposure answers "who may reach the listener?" A
 `production-approved` binding is still private until a grant exists.
+Neither is an authorization decision. Whether an actor may perform an
+action is `access-engine` (ADR-0009).
 
 ## Vocabulary
 

docs/netkingdom-axis-layer-open-questions.md

@@ -0,0 +1,50 @@
+# Unsettled axis-to-layer questions (statute §20.3)
+
+Date: 2026-08-29
+Status: tracked non-answer under ADR-0009 / RMASTER-WP-0026-T05
+Next review: 2026-11-29
+
+## Purpose
+
+Statute §20.3 names five questions about how Railiance axes meet the
+NetKingdom security-layer model and **deliberately does not answer them**.
+Guessing a mapping would be worse than admitting the gap.
+
+This record keeps each question visible, owned, and unanswered. It is not
+an ADR. A mapping ADR is forbidden until the named reviewers have assented.
+
+On disagreement the statute governs:
+`net-kingdom/canon/standards/security-layer-model_v0.7.md` §20.3.
+
+## Standing non-answer
+
+For every row below: **unset**. Do not infer an answer from current
+practice, from a repo prefix, from a Fabric graph edge, or from a
+declaration field. Implementation repos must not ship a local mapping.
+
+## The five questions
+
+| # | Question | Why it is open | Propose | Must review before any ADR | Next review |
+| --- | --- | --- | --- | --- | --- |
+| 1 | Identity form of a `rapp-*` as a request-claim resource | A rapp is the most likely *resource* a decision is about, but nothing states its identity form in a claim | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 |
+| 2 | Whether a `rail-*` contract can carry PEP obligations | PEP shape is most likely to live on a rail, but statute §6.4 attaches to repositories and a rail is a contract | `railiance-master` | `gate-house`; any `rail-*` that is actually PEP-shaped | 2026-11-29 |
+| 3 | Composition of a `reef-*` with a security zone | A reef answers where a workload is bound; a zone answers which scrutiny it has qualified for. Adjacent is not equal. `zone-engine` already records this as a canon composition problem | `railiance-master` | `zone-engine`, `gate-house` | 2026-11-29 |
+| 4 | Relation of the `railiance-*` ownership axis to the principal a decision is rendered for | Ownership names who owns a capability. That is adjacent to the subject of a decision, not equal to it | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 |
+| 5 | The `glas-harness` / statute §3.4 seam | Tool policy and session semantics are glas-harness's; an agent may act only through a conduit or an Engine API. Neither half is sufficient. This is where "tool availability is not permission" is enforced or lost | `glas-harness` with `railiance-master` | `glas-harness` (required), `gate-house` | 2026-11-29 |
+
+Question 5 is the highest-consequence of the five. No Railiance ADR may
+answer it without `glas-harness` assent (statute §20.4).
+
+## What this record is not
+
+- a mapping of `rail-*` / `rapp-*` / `reef-*` / `railiance-*` onto
+  Taxonomy, Tooling, Engine, or Staff
+- a licence for a rail or rapp to invent a local claim shape
+- a substitute for statute §17 Taxonomy artifacts (request-claim schema,
+  gap-record schema, emission-cadence declaration)
+
+## Related
+
+- [ADR-0009](adr/ADR-0009-netkingdom-security-layer-interaction.md)
+- [Consumption contract](netkingdom-security-consumption-contract.md)
+- Companion §9: "How the axes map onto the layer model is not settled"

docs/netkingdom-security-consumption-contract.md

@@ -0,0 +1,87 @@
+# NetKingdom Security Consumption Contract
+
+Date: 2026-08-29
+Status: Adopted under ADR-0009 / RMASTER-WP-0026-T03
+
+## Purpose
+
+Say what every Railiance rail, rapp, and reef owes when it consumes
+NetKingdom security, without copying engine schemas or turning this
+repository into a second decision point.
+
+The statute is `net-kingdom/canon/standards/security-layer-model_v0.7.md`
+§20.2 and §6.4. The working companion is `net-kingdom/SECURITY-COMPANION.md`
+v0.2 §9. On disagreement the statute governs.
+
+This contract does **not** decide:
+
+- whether a binding may run in production — that is [ADR-0006](adr/ADR-0006-reef-production-admission.md);
+- who may reach a listener we control — that is [ADR-0008](adr/ADR-0008-private-by-default-exposure.md);
+- how the four Railiance axes map onto Taxonomy, Tooling, Engine, and Staff
+  — that remains unset in [the open-questions record](netkingdom-axis-layer-open-questions.md).
+
+## Three distinct questions
+
+| Question | Owner | Must not be read as |
+| --- | --- | --- |
+| May this binding run in production? | Railiance admission (ADR-0006) | permission for an actor to act |
+| Who may reach the listener we control? | Railiance exposure (ADR-0008) | an authorization decision |
+| May this actor perform this action on this resource? | `access-engine` | admission or exposure |
+
+`production-approved` and `exposure: public` MUST NOT be treated as
+authorization decisions. Compiled admission or exposure data that resolved
+whether an actor may act would be statute §6.1 — deciding early.
+
+## Consumption rules
+
+For any Railiance consumer of NetKingdom security, without exception:
+
+1. **Authorization decisions come from `access-engine` and from nowhere
+   else.** No rail, rapp, reef, or ownership repo may render or cache an
+   authorization verdict. A registry, schema, or cache that resolves a
+   result before the engine runs has decided early (statute §6.1).
+2. **Approvals are objects in `approval-engine`, consumed as claims.**
+   They are not a Railiance axis and not an audit-core verdict. Callers
+   needing current approval state ask `approval-engine`.
+3. **Credentials are materialized by `secrets-engine` after a decision,
+   never as a substitute for one.** A lease or certificate is an artifact
+   of authority, not its source.
+4. **Evidence goes to `audit-core` under the bound in statute §9.6.** An
+   archive proves records were not altered or truncated after arrival. It
+   does not prove an event was sent. Absence of a record is not
+   non-occurrence.
+5. **A runtime that causes a protected side effect is PEP-shaped** and
+   owes statute §6.4 **in its own repository**: no side effect without a
+   decision record or a recorded unreachable-engine stance; no replay
+   outside the decision's binding and lifetime; a published stance map
+   inventoried in statute §13.1; reconstructability within the evidence
+   bound.
+
+This repository is not PEP-shaped. `layer.yaml` records that. Implementation
+rails, rapps, and reefs that do cause protected side effects inherit these
+obligations themselves. This contract does not publish a stance map.
+
+## What this repository does not host
+
+- a policy decision point
+- an approval store
+- a credential lifecycle API
+- an evidence archive
+- an actuation or containment surface
+
+Observation-in-production and automatic containment are estate-wide zeros
+(companion §10). Do not plan Railiance operations as if they existed.
+
+## Engine schemas stay with their owners
+
+This file names the engines and the rules. It does not restate their
+request, decision, approval, credential, or evidence schemas. Those
+contracts live in the owning repositories and, for shared claim
+vocabulary, in Taxonomy artifacts statute §17 still requires.
+
+## Related
+
+- [ADR-0009](adr/ADR-0009-netkingdom-security-layer-interaction.md) — assent
+- [ADR-0006](adr/ADR-0006-reef-production-admission.md) — admission
+- [ADR-0008](adr/ADR-0008-private-by-default-exposure.md) — exposure
+- [Open questions](netkingdom-axis-layer-open-questions.md) — §20.3, unset

docs/reef-production-readiness-contract.md

@@ -14,7 +14,8 @@ requires explicit readiness evidence.
 This contract does not decide who may reach a listener. That is
 [`ADR-0008`](adr/ADR-0008-private-by-default-exposure.md). A
 `production-approved` binding is still private until an exposure grant
-exists.
+exists. It also does not decide whether an actor may perform an action.
+That is `access-engine` ([`ADR-0009`](adr/ADR-0009-netkingdom-security-layer-interaction.md)).
 
 ## Admission States