Implement TEN-WP-0011 security layer conformance

Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

layer.yaml

@@ -0,0 +1,84 @@
+# tenant-engine — NetKingdom security layer declaration
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
+# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
+# Assent:    decisions/decisions.md TEN-DEC-2026-001
+# Validate:  python3 scripts/check_layer_conformance.py
+#
+# Engine / PIP. Same authoritative tenant state yields the same result. We
+# supply tenant-as-an-entity facts as claims; we do not render a decision.
+# Writes are PEP-shaped (pep-stance.yaml). Catalogued Tooling (§4) is
+# key-cape and OpenBao — we hold no client for either.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.7"
+repository: tenant-engine
+layer: engine
+role: pip
+declared_by: decisions/decisions.md#TEN-DEC-2026-001
+declared_at: "2026-08-29"
+
+pep_stance: pep-stance.yaml
+pip_claims: pip-claims.yaml
+
+catalog_entry:
+  owns:
+    - tenant-as-an-entity facts
+
+# Empty is a claim. scripts/check_layer_conformance.py fails a new OpenBao
+# or key-cape client that is not listed here.
+tooling_contacts: []
+
+declared_shapes:
+  "5.1": []
+  "5.2": []
+  "5.3": []
+
+non_tooling_clients:
+  - id: postgres-own-store
+    module: src/tenant_engine/postgres_store.py
+    target: PostgreSQL
+    layer: not-catalogued
+    operation: "psycopg pool against TENANT_ENGINE_DATABASE_URL_FILE"
+    write: true
+    note: >-
+      Persistence this engine owns for its own facts. Companion §4: list
+      uncatalogued infrastructure so the check is total. Not a Tooling
+      contact — OpenBao and key-cape are the §4 Tooling rows.
+
+  - id: sqlite-dev-store
+    module: src/tenant_engine/sqlite_store.py
+    target: SQLite
+    layer: not-catalogued
+    operation: "sqlite3 file used for development and test"
+    write: true
+    note: "Dev/test backend. Production is PostgreSQL (TEN-WP-0009)."
+
+  - id: access-engine-check
+    module: src/tenant_engine/flex_auth.py
+    target: access-engine (flex-auth)
+    layer: engine
+    operation: "HTTP POST /v1/check"
+    write: false
+    note: "Engine API. §5 permits it; this is the shape §5 prescribes."
+
+  - id: audit-core-emission
+    module: src/tenant_engine/audit_core.py
+    target: audit-core
+    layer: engine
+    operation: "HTTP POST /v1/events from the local outbox"
+    write: true
+    note: >-
+      Evidence engine. Emission is attributive and non-blocking
+      (docs/evidence-emission.md). Sender registration on audit-core is
+      requested separately.
+
+  - id: state-hub-work-records
+    target: state-hub
+    layer: not-catalogued
+    operation: "HTTP to the Custodian State Hub for work records"
+    write: true
+    note: >-
+      Outside §5 by the v0.7 scope rule. Recorded, not policed. Carries no
+      tenant-fact authority and no secret payload.