Implement SECRETS-WP-0008 unblocked layer-model obligations

Load pep-stance.yaml as the live unreachable-engine gate and record named
stance fields on privileged evidence. Classify evidence, queue load-bearing
records in a local outbox, and add heartbeat/drain commands that never sit
on a mutation path. Publish proposed SSH-CA and secret-use evidence
contracts without adding an OpenBao SSH-CA write.

T02 (access-engine decision records) and T06 (no standing credential) stay
wait on external endpoints.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b

SCOPE.md

@@ -193,6 +193,7 @@ secrets-engine route
 secrets-engine revoke [--dry-run]
 secrets-engine lifecycle suspend|deactivate|destroy
 secrets-engine audit <catalog-id> [--json]
+secrets-engine evidence heartbeat|drain|classify
 ```
 
 The implemented exec adapters are `exec-env` and `npm-config`. `read-check` is
@@ -233,16 +234,17 @@ verification, `approle-login` is auth-capability handoff metadata, and
 - Management or health verification of ESO, Kubernetes Secrets, deployments,
   provider accounts, SSH issuance, tunnels, or remote transport.
 - Any backend other than the local `bao`/`vault` CLI speaking to OpenBao.
-- An SSH-CA signing engine API. ops-warden still signs through its declared
-  OpenBao gap; this repository has accepted that surface as proposed only.
-- A secret-use evidence engine API for kings-guard. `route` and `audit` are
-  operator summaries over local JSONL, not an observation surface.
-- Emission to `audit-core`. Evidence today is local JSONL plus best-effort
-  State Hub progress notes, classified attributive, completeness not claimed.
-- Named stance-application records (stage, failure mode, decision id present
-  only where rendered). Fail-closed production currently surfaces as a
-  `DecisionError` on the privileged-evidence path.
+- An SSH-CA signing engine API. The contract is
+  `docs/ssh-ca-signing-contract.md`; ops-warden still signs through its
+  declared OpenBao gap.
+- A secret-use evidence engine API for kings-guard. The contract is
+  `docs/secret-use-evidence-contract.md`. `route` and `audit` are operator
+  summaries over local JSONL, not that observation surface.
+- Emission to `audit-core`. Load-bearing records are queued locally; drain
+  requires a sender binding that does not exist yet. Completeness is not
+  claimed.
 - Security-zone membership as a request claim. PEP scope is catalog stage.
+- Drain of the load-bearing outbox into a live `audit-core` sender binding.
 
 ## System Boundary
 
@@ -299,12 +301,12 @@ Working companion: `net-kingdom/SECURITY-COMPANION.md`.
 | Obligation | Current | Intended |
 | --- | --- | --- |
 | Layer declaration | `INTENT.md` frontmatter + `layer.yaml` | Keep in this repository's own voice |
-| One decision point | Consumer validator for ActionAuthorization; production live fail-closed | Consume an access-engine decision record before every protected side effect |
-| PEP stance | `pep-stance.yaml`; prod fail-closed, build/test fail-open relative to access-engine | Published map equals shipped behaviour; stance application recorded by name |
-| Evidence bound | Attributive local JSONL + best-effort State Hub | Load-bearing vs attributive classified; load-bearing to `audit-core` with cadence |
-| SSH-CA surface | Proposed; not shipped | Engine API for ops-warden's Staff PEP; lane stewardship stays with ops-warden |
-| Secret-use evidence | `route` / `audit` over local JSONL | Engine surface of lease/revocation/mount/rotation metadata |
-| Agent credential | Bootstrap token file still accepted; KeyCape scaffold unwired | Per-task, time-bounded service identity; no standing engine credential |
+| One decision point | Consumer validator for ActionAuthorization; production live fail-closed from `pep-stance.yaml` | Consume an access-engine decision record before every protected side effect |
+| PEP stance | Runtime loads `pep-stance.yaml`; named stance fields on privileged evidence | Unchanged map; T02 replaces fail-open residue with a decision record |
+| Evidence bound | `evidence-classification.yaml`; load-bearing local outbox; heartbeat command | Drain to `audit-core` once that sender is admitted |
+| SSH-CA surface | Contract at `docs/ssh-ca-signing-contract.md`; not shipped | Engine API after ops-warden assent |
+| Secret-use evidence | Contract at `docs/secret-use-evidence-contract.md`; not shipped | Engine surface after kings-guard assent |
+| Agent credential | Bootstrap token file still accepted; KeyCape scaffold unwired to OpenBao | Per-task, time-bounded service identity; no standing engine credential |
 
 ## Where Current Work Lives
 
@@ -312,7 +314,8 @@ Working companion: `net-kingdom/SECURITY-COMPANION.md`.
 - `docs/hardening-backlog.md` tracks exit from bootstrap mode.
 - `history/` contains dated capability and intent assessments.
 - `INTENT.md` remains the stable aspirational direction.
-- `layer.yaml` and `pep-stance.yaml` are the layer-model declaration surface.
+- `layer.yaml`, `pep-stance.yaml`, and `evidence-classification.yaml` are the
+  layer-model declaration surface.
 
 ## Provided Capabilities