Implement TEN-WP-0011 security layer conformance

Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

src/tenant_engine/stance.py

@@ -0,0 +1,49 @@
+"""Published unreachable-engine stance, loaded from pep-stance.yaml.
+
+The map MUST equal shipped behaviour. DefaultDenyWriteAuthorizer and
+transport-failure deny both apply `fail_closed`. A published map that may
+drift from this module is worse than none (§6.4 obligation 3).
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+STANCE_PATH = Path(__file__).resolve().parents[2] / "pep-stance.yaml"
+
+# Shipped behaviour. pep-stance.yaml must equal this dict. Keep the two
+# in lockstep — tests/test_layer_conformance.py compares them.
+SHIPPED_STANCE: dict[str, str] = {
+    "unset": "fail_closed",
+    "unreachable": "fail_closed",
+    "non_allow": "fail_closed",
+    "unknown": "fail_closed",
+}
+
+FAIL_CLOSED = "fail_closed"
+
+
+def shipped_stance() -> dict[str, str]:
+    return dict(SHIPPED_STANCE)
+
+
+def published_stance(text: str | None = None) -> dict[str, str]:
+    """Parse the `stance:` map from pep-stance.yaml without a YAML runtime dep."""
+    raw = text if text is not None else STANCE_PATH.read_text(encoding="utf-8")
+    in_map = False
+    parsed: dict[str, str] = {}
+    for line in raw.splitlines():
+        stripped = line.strip()
+        if stripped.startswith("stance:"):
+            in_map = True
+            continue
+        if in_map:
+            if not stripped or stripped.startswith("#"):
+                continue
+            if not line.startswith(" ") and not line.startswith("\t"):
+                break
+            if ":" not in stripped:
+                continue
+            key, value = stripped.split(":", 1)
+            parsed[key.strip()] = value.split("#", 1)[0].strip()
+    return parsed