# secrets-engine — load-bearing vs attributive evidence (§9.6)
#
# Machine-readable classification next to the layer declaration.
# Completeness is not claimed. No control may branch on presence or
# absence of a local evidence record.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
repository: secrets-engine
bound: "§9.6"
completeness_claimed: false
no_control_branches_on_presence: true
intended_destination: audit-core
destination_today: "local JSONL; load-bearing also queued in evidence_dir/outbox/"
sound_claim: >-
  The archive proves the records it holds were not altered or truncated
  after arrival. It does not prove a record was sent, and absence is not
  evidence of non-occurrence.

cadence:
  load_bearing_form: heartbeat
  interval: 1d
  action: evidence-heartbeat
  claim: nothing-to-report
  command: "secrets-engine evidence heartbeat"

# First match wins.
rules:
  - id: heartbeat
    kind: heartbeat
    actions: [evidence-heartbeat]
    stages: [build, test, prod, unknown]
    emission: local-outbox
    note: >-
      Positive claim that can itself go missing. Queue depth is metadata,
      not a permission.

  - id: destroy
    kind: load-bearing
    actions: [lifecycle-destroy]
    stages: [build, test, prod, unknown]
    emission: local-outbox
    note: Live destroy is currently disabled; refusals are still classified here.

  - id: production-control-mutation
    kind: load-bearing
    actions: [revoke, lifecycle-suspend, lifecycle-deactivate, provision, session-revoke]
    stages: [prod]
    emission: local-outbox
    note: >-
      Production provision, revoke, and suspend/deactivate once enabled.
      Production live remains fail-closed until an access-engine decision
      record is served.

  - id: default-attributive
    kind: attributive
    actions: ["*"]
    stages: [build, test, prod, unknown]
    emission: local-jsonl
    trade: >-
      State Hub progress posts are non-blocking. Completeness is not claimed.