Implement TEN-WP-0011 security layer conformance

Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

pep-stance.yaml

@@ -0,0 +1,50 @@
+# tenant-engine — PEP unreachable-engine stance map
+#
+# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
+# Companion: net-kingdom/SECURITY-COMPANION.md v0.2 §5
+# Named from: layer.yaml (pep_stance)
+# Validate:   tests/test_layer_conformance.py
+#
+# tenant-engine's protected side effect is a mutation of tenant-as-an-entity
+# facts (create, grant, revoke, plan, lifecycle, grouping, guardrail).
+# This is not ops-warden's per-zone fail-open map. A PIP that cannot ask
+# the PDP does not guess; it refuses.
+
+schema_version: "0.1"
+framework: netkingdom-security-layer-model
+standard_version: "0.7"
+repository: tenant-engine
+pep_shape: true
+declared_by: decisions/decisions.md#TEN-DEC-2026-001
+
+protected_action: "mutation of tenant-as-an-entity facts"
+decision_engine: access-engine
+scope: engine-reachability
+
+# Total by construction. No implicit default — an unlisted value is a
+# config error, not a permissive fallback. Every scope fails closed.
+stance:
+  unset: fail_closed          # TENANT_ENGINE_FLEX_AUTH_URL is not set
+  unreachable: fail_closed    # transport, timeout, non-2xx, malformed body
+  non_allow: fail_closed      # a decision was rendered, effect was not allow
+  unknown: fail_closed
+
+on_apply:
+  recorded_fields:
+    - authorization_source    # decision | stance
+    - authorization_decision_id
+    - authorization_request_digest
+    - authorization_effect
+    - authorization_stance
+    - authorization_reason
+    - action
+    - tenant_id
+    - actor
+    - allowed
+  written_to:
+    - "authz_records (every authorize attempt)"
+    - "events.payload (successful mutations only)"
+  never_recorded: "tokens, secrets, request bodies beyond the check digest"
+
+# §6.4 obligation 2 — the verdict is never cached. Every write re-checks.
+verdict_caching: none