Declare Engine/Lifecycle against security layer model v0.7

Replace the gate-house review note with this repository's own declaration:
INTENT.md frontmatter, layer.yaml, and a published PEP stance map. SCOPE.md
and agent boundary docs now match that layer. The review under history/
identifies the implementation remainder; SECRETS-WP-0008 is the follow-on
workplan. SECRETS-IN-0001 is closed.

The layer is not contested. Catalog "custody" is a finding: OpenBao owns
custody, this engine owns the lifecycle API over it. SSH-CA signing is
accepted as a proposed engine API and declined as a Staff lane.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b

pep-stance.yaml

@@ -0,0 +1,85 @@
+# secrets-engine — PEP unreachable-engine stance map
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
+# Companion: net-kingdom/SECURITY-COMPANION.md §5
+# Voice:     INTENT.md / layer.yaml
+# Validate:  pytest tests/test_layer_conformance.py
+#
+# §6.4 obligation 3 requires a declared unreachable-engine stance that is
+# total, scoped per zone or equivalent, carries no implicit default and no
+# per-call discretion, and is published rather than held in code comments.
+# Catalog stage is the equivalent scope until security-zone membership arrives
+# as a claim on the decision.
+#
+# The property that makes this worth reading: tests/test_layer_conformance.py
+# asserts this map against the shipped production fail-closed gate in
+# secrets_engine.cli._require_lane_approval. A published map free to drift
+# from the code is worse than none.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.7"
+repository: secrets-engine
+pep_shape: true
+declared_by: INTENT.md
+decision_engine: access-engine        # flex-auth until the governed rename
+scope: catalog-stage                  # equivalent scope; not security-zones yet
+
+protected_action: >-
+  OpenBao metadata apply, KV provision, verification, exec delivery,
+  auth-capability handoff, native revoke, and lifecycle
+  suspend/deactivate/destroy
+
+# Total by construction over every catalog stage plus unknown.
+# No implicit default — an unlisted value is a config error, not a fallback.
+# "fail_closed" means no protected side effect without a durable
+# access-engine / ActionAuthorization record.
+# "fail_open" here means the engine-unreachable residue: proceed only under
+# the existing lane-approval check (State Hub or local fixture), which is
+# itself a tracked gap relative to access-engine, not a manufactured allow.
+stance:
+  build:   fail_open
+  test:    fail_open
+  prod:    fail_closed
+  unknown: fail_closed
+
+# Explicit, three-factor exception. Not a stance row and not a default.
+# All three must hold or the production gate remains closed.
+demo_exception:
+  id: unsafe-local-demo
+  requires:
+    - "SECRETS_ENGINE_UNSAFE_DEMO=1"
+    - "hub URL empty"
+    - "OpenBao target is loopback"
+  applies_to: prod
+  note: >-
+    Throwaway local demonstration only. Not a production residue and not
+    available when any one factor is missing.
+
+on_apply:
+  recorded_fields:
+    - stage
+    - action
+    - approval_status          # rejected when the stance refuses
+    - error_type               # DecisionError when fail_closed fires
+    - decision_id              # present only where a decision was resolved
+  written_to:
+    - "local JSONL (.evidence/evidence-YYYY-MM-DD.jsonl)"
+    - "best-effort State Hub progress note"
+  never_recorded: "any secret material, token, password, or raw value"
+  gap: >-
+    Stance application is currently recorded as a DecisionError on the
+    privileged-evidence path, not as named stance fields (stage, failure
+    mode, decision id present only where rendered). Closing that gap is
+    SECRETS-WP-0008-T01.
+
+# §6.4 obligation 2 — the verdict is never cached. A retry of the same
+# canonical request digest inside the decision lifetime is the decision
+# being used as issued; a different resource is not.
+verdict_caching: none
+
+# §6.4 obligation 4 / §9.6 — attributive today. No control branches on the
+# presence of a local evidence record. Completeness is not claimed.
+reconstructability:
+  bound: "§9.6 attributive — completeness is not claimed"
+  declared_at: layer.yaml#evidence_bound