# Decision records

## SECURITY-DEC-2026-001 — SecurityCanon boundary: CARING stays in InfoTechCanon; Auth Mode is architecture-layer vocabulary

```yaml
id: SECURITY-DEC-2026-001
kind: decision
title: 'SecurityCanon boundary: CARING stays in InfoTechCanon; Auth Mode is architecture-layer
  vocabulary'
status: accepted
created: '2026-09-20T19:30:50.120170Z'
updated: '2026-09-20T19:30:50.120170Z'
state_hub_decision_id: "f6496e7d-4622-4cc6-b5b1-b62172dd148e"
```

## SECURITY-DEC-2026-002 — Terminology separation: Auth Mode renames Subject to AuthorityContext; no upstream redefinition

```yaml
id: SECURITY-DEC-2026-002
kind: decision
title: 'Terminology separation: Auth Mode renames Subject to AuthorityContext; no
  upstream redefinition'
status: accepted
created: '2026-09-20T19:42:12.263921Z'
updated: '2026-09-20T19:42:12.263921Z'
state_hub_decision_id: "7717592b-70cf-43fc-986e-d208d1641f49"
```

## SECURITY-DEC-2026-003 — Concept placement: ten declared imports, no migration, identity model is a shared root

```yaml
id: SECURITY-DEC-2026-003
kind: decision
title: 'Concept placement: ten declared imports, no migration, identity model is a
  shared root'
status: accepted
created: '2026-09-20T20:20:00.000000Z'
updated: '2026-09-20T20:20:00.000000Z'
state_hub_decision_id: "054e60cc-c8df-4335-83d4-28fd438bb0a8"
```

## SECURITY-DEC-2026-004 — Adopt the DevOps Secrets Management Canon v1.0 as SEC-DSM

```yaml
id: SECURITY-DEC-2026-004
kind: decision
title: 'Adopt DevOps Secrets Management Canon v1.0 as the SEC-DSM standard'
status: accepted
created: '2026-10-11T00:00:00.000000Z'
updated: '2026-10-11T00:00:00.000000Z'
state_hub_decision_id: "de9b42e3-ef8d-4770-90a7-64245a269cdc"
```

The repository owner supplied `DevOpsSecretsManagementCanon-v1.0.md` and asked
that it be inserted as a standard. The body is stored unchanged at
`infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`,
with a placement preface. Source SHA-256
`ded46fc4ee657503f949dd223cb47d425dfa765c76f593775da8d3fb7a63c30f`.

The standard is the secrets best-practice guide. It does not take custody,
issuance, authorization, route construction, or lane operation away from their
owners. Section 4 terms that InfoTechCanon already owns are practice language,
not a second definition. Gate House, ops-mason, and ops-warden adopt it as
their guide for secrets practice. Gate House's Active Secrets Management Canon
v0.3 remains the estate doctrine for invariants, operating modes, and assurance
tests that this standard does not replace.