a0c35b7438
Add layer.yaml, RMASTER-ADR-0009, the consumption contract, and a tracked non-answer for the five §20.3 questions. Split admission, exposure, and authorization without renaming schema fields. Finish the workplan. Assistant: grok Assistant-Session: 01a04c9f-cd6b-7741-bce0-f1d9d1b3c3bc
50 lines
3 KiB
Markdown
50 lines
3 KiB
Markdown
# Unsettled axis-to-layer questions (statute §20.3)
|
|
|
|
Date: 2026-08-29
|
|
Status: tracked non-answer under ADR-0009 / RMASTER-WP-0026-T05
|
|
Next review: 2026-11-29
|
|
|
|
## Purpose
|
|
|
|
Statute §20.3 names five questions about how Railiance axes meet the
|
|
NetKingdom security-layer model and **deliberately does not answer them**.
|
|
Guessing a mapping would be worse than admitting the gap.
|
|
|
|
This record keeps each question visible, owned, and unanswered. It is not
|
|
an ADR. A mapping ADR is forbidden until the named reviewers have assented.
|
|
|
|
On disagreement the statute governs:
|
|
`net-kingdom/canon/standards/security-layer-model_v0.7.md` §20.3.
|
|
|
|
## Standing non-answer
|
|
|
|
For every row below: **unset**. Do not infer an answer from current
|
|
practice, from a repo prefix, from a Fabric graph edge, or from a
|
|
declaration field. Implementation repos must not ship a local mapping.
|
|
|
|
## The five questions
|
|
|
|
| # | Question | Why it is open | Propose | Must review before any ADR | Next review |
|
|
| --- | --- | --- | --- | --- | --- |
|
|
| 1 | Identity form of a `rapp-*` as a request-claim resource | A rapp is the most likely *resource* a decision is about, but nothing states its identity form in a claim | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 |
|
|
| 2 | Whether a `rail-*` contract can carry PEP obligations | PEP shape is most likely to live on a rail, but statute §6.4 attaches to repositories and a rail is a contract | `railiance-master` | `gate-house`; any `rail-*` that is actually PEP-shaped | 2026-11-29 |
|
|
| 3 | Composition of a `reef-*` with a security zone | A reef answers where a workload is bound; a zone answers which scrutiny it has qualified for. Adjacent is not equal. `zone-engine` already records this as a canon composition problem | `railiance-master` | `zone-engine`, `gate-house` | 2026-11-29 |
|
|
| 4 | Relation of the `railiance-*` ownership axis to the principal a decision is rendered for | Ownership names who owns a capability. That is adjacent to the subject of a decision, not equal to it | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 |
|
|
| 5 | The `glas-harness` / statute §3.4 seam | Tool policy and session semantics are glas-harness's; an agent may act only through a conduit or an Engine API. Neither half is sufficient. This is where "tool availability is not permission" is enforced or lost | `glas-harness` with `railiance-master` | `glas-harness` (required), `gate-house` | 2026-11-29 |
|
|
|
|
Question 5 is the highest-consequence of the five. No Railiance ADR may
|
|
answer it without `glas-harness` assent (statute §20.4).
|
|
|
|
## What this record is not
|
|
|
|
- a mapping of `rail-*` / `rapp-*` / `reef-*` / `railiance-*` onto
|
|
Taxonomy, Tooling, Engine, or Staff
|
|
- a licence for a rail or rapp to invent a local claim shape
|
|
- a substitute for statute §17 Taxonomy artifacts (request-claim schema,
|
|
gap-record schema, emission-cadence declaration)
|
|
|
|
## Related
|
|
|
|
- [ADR-0009](adr/ADR-0009-netkingdom-security-layer-interaction.md)
|
|
- [Consumption contract](netkingdom-security-consumption-contract.md)
|
|
- Companion §9: "How the axes map onto the layer model is not settled"
|