# Agent instructions — security-canon

## Repo Identity

**Purpose:** Orthogonal vocabulary and canonical model for security-related concepts, extending InfoTechCanon.

**Domain:** infotech
**Repo slug:** security-canon
**Topic ID:** `fe2aaa78-9c20-4feb-b3d2-4fe0529572a3`
**Workplan prefix:** `SECURITY-WP-`
**Upstream canon:** info-tech-canon

Orient: INTENT.md → SCOPE.md → workplans/.


## State Hub Integration

<!-- BEGIN STATE-HUB-ACCESS -->
| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` |
| Optional local edge relay | `http://127.0.0.1:18080` |

Do not instruct a remote agent to use `http://127.0.0.1:18000`. That reverse tunnel is retired; on railiance01 reach the hub at the in-cluster address above.
<!-- END STATE-HUB-ACCESS -->

## Cross-repo waits

If blocked on another repo, look for a `prj-` driver workplan and follow `coordination-engine` `spec/cross-owner-wait-mode-v0.1.md`. Do not mint a stranded `wait`, implement `flavor: residual`, or message `ops-warden` for secrets.