Track the two external dispositions as TEN-WP-0012

TEN-WP-0011 closed correctly: T04 and T06 built everything this repo
owns. What neither could close is the other side — a sender credential
audit-core issues (AUDIT-IN-0002) and a canon edit only net-kingdom may
make (NET-IN-0002). Both intakes were filed outbound, so nothing in this
checkout held them.

Session protocol Step 3 scans workplans/ for open work. With every
workplan finished it found none, and each session re-derived the same two
externally-owned gaps from SCOPE.md prose and the audit-core source
before concluding there was nothing to do. TEN-WP-0012 holds that
conclusion so it is read rather than rediscovered, as a blocked workplan
with two wait tasks — the convention's status for work owed by another
party.

Records for each what would close it, including the decline branch, and
states the two things not to do: no editing net-kingdom canon from here,
and no requesting the audit-core token over the message bus.

No code change; 287 tests pass and ruff is clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHwvAEQfmzLHtrFGhXtVjq

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 823014@bnt-lap001
Assistant-Session: 2a0786b1-efea-4c38-959b-6e86a493f259

SCOPE.md

@@ -91,7 +91,8 @@ Production service, not a bootstrap. Workplans `TEN-WP-0001` through
 boundary-contract APIs, the `flex-auth` write authorizer, lifecycle,
 guardrails, PostgreSQL as the production store, mutable grouping,
 staged-promotion onboarding, and the security-layer conformance surfaces.
-No workplan in this repo is currently open.
+The only open workplan is `TEN-WP-0012`, which tracks two dispositions
+owed by other repos and expects no code change here.
 
 | Surface | Shipped | Notes |
 | --- | --- | --- |
@@ -107,7 +108,7 @@ No workplan in this repo is currently open.
 | Machine-readable `layer.yaml` | yes | `TEN-WP-0011-T01`; check in `scripts/check_layer_conformance.py` |
 | Persisted `authorization_decision_id` | yes | `authz_records` plus mutation event payload (`TEN-WP-0011-T02`) |
 | Published unreachable-engine stance map | yes | `pep-stance.yaml`, fail-closed, tested equal to shipped behaviour |
-| Independent audit-core emission | path shipped, sender pending | Local outbox + POST `/v1/events`; `AUDIT-IN-0002` |
+| Independent audit-core emission | path shipped, sender pending | Local outbox + POST `/v1/events`; waiting on `AUDIT-IN-0002` (`TEN-WP-0012-T01`) |
 | Bounded event-read interface | yes | `events_for(tenant_id)` only (`TEN-WP-0011-T05`) |
 | Claim freshness / input-class lifetime | yes | `pip-claims.yaml` (`TEN-WP-0011-T03`) |
 
@@ -115,7 +116,13 @@ The boundary contract still labels guardrail policy "reserved, not
 implemented" and still calls this repo "not a policy enforcement point".
 Both sentences are stale: guardrails shipped, and the write path is
 PEP-shaped even though this repo is not a PDP. Amendment is a
-`net-kingdom` change, requested from `TEN-WP-0011`.
+`net-kingdom` change, requested from `TEN-WP-0011` as `NET-IN-0002` and
+tracked here as `TEN-WP-0012-T02`.
+
+Those two rows are the only open items in this repo, and neither is ours
+to close: one waits on a credential audit-core issues, the other on a
+canon edit only `net-kingdom` may make. `TEN-WP-0012` holds both so they
+are read rather than re-derived each session.
 
 ## Getting Oriented
 
@@ -127,6 +134,7 @@ PEP-shaped even though this repo is not a PDP. Amendment is a
 - Layer declaration: `decisions/decisions.md` `TEN-DEC-2026-001`
 - Review: `history/2026-08-29-security-layer-intent-scope-review.md`
 - Evolution workplan: `workplans/TEN-WP-0011-security-layer-conformance.md`
+- External waits: `workplans/TEN-WP-0012-external-conformance-waits.md`
 - flex-auth write-authorization integration: `docs/flex-auth-integration.md`
 - Guardrail contract: `docs/tenant-guardrail-policy.md`
 - Lifecycle contract: `docs/tenant-lifecycle-api.md`

workplans/TEN-WP-0012-external-conformance-waits.md

@@ -0,0 +1,103 @@
+---
+id: TEN-WP-0012
+type: workplan
+title: "Track the two external dispositions tenant-engine is waiting on"
+domain: infotech
+repo: tenant-engine
+status: blocked
+owner: claude
+topic_slug: netkingdom
+created: "2026-09-07"
+updated: "2026-09-07"
+depends_on:
+  - TEN-WP-0011
+unblocks: []
+origin: residual
+origin_ref: TEN-WP-0011
+---
+
+# TEN-WP-0012 — Track the two external dispositions tenant-engine is waiting on
+
+`TEN-WP-0011` closed correctly. Its T04 and T06 are `done` in the sense that
+matters here: this repository built everything it owns. What neither task
+could close is the other side — a credential audit-core issues, and a canon
+edit only `net-kingdom` may make.
+
+Those two waits have no durable local record. The intakes were filed
+outbound, on other repositories' intake files, so nothing in this checkout
+holds them. `SCOPE.md` mentions both in prose, but prose is not scanned.
+
+The cost is small and repeating: session protocol Step 3 scans `workplans/`
+for open work, finds none, and each session re-derives the same two
+externally-owned gaps from `SCOPE.md` and the audit-core source before
+concluding — correctly — that there is nothing to do. This workplan holds
+that conclusion so it is read rather than rediscovered.
+
+## Why this is a workplan and not an intake
+
+This repository's intake files record work *it* may act on. Both records
+here are the opposite: work filed elsewhere, awaiting someone else's
+disposition. Only `workplans/` is read at session start, and `wait` is the
+convention's status for work that is blocked on another party.
+
+## Non-goals
+
+- Not editing `net-kingdom` canon from this repository. `TEN-WP-0011-T06`
+  settled that: file an intake, never fork the contract.
+- Not requesting a credential over the message bus. Credential routing is
+  explicit that `POST /messages/` asking for a token is an anti-pattern;
+  sender registration is audit-core's to issue.
+- Not re-opening `TEN-WP-0011`. Our side of both items shipped.
+- No code change is expected from this workplan. If either disposition
+  arrives and *does* require code, that becomes its own workplan.
+
+## T01 — audit-core sender registration (AUDIT-IN-0002)
+
+```task
+id: TEN-WP-0012-T01
+status: wait
+priority: medium
+```
+
+The emission path shipped in `TEN-WP-0011-T04`: the local outbox is inside
+the mutation transaction, the drain POSTs `/v1/events` and never fails a
+mutation, and the trade is declared in `docs/evidence-emission.md`. What is
+missing is sender registration — a credential audit-core issues and holds
+custody of. `src/tenant_engine/audit_core.py` documents that this module
+holds no audit-core credential beyond that sender token.
+
+Waiting on: `AUDIT-IN-0002`, filed on audit-core.
+
+Done when: audit-core registers the sender and production mutations land
+externally, **or** audit-core declines and `SCOPE.md` row
+"Independent audit-core emission" is restated to say so.
+
+Do not: request the token by message, or synthesize a local stand-in that
+would make the outbox look drained when it is not.
+
+## T02 — boundary-contract amendment (NET-IN-0002)
+
+```task
+id: TEN-WP-0012-T02
+status: wait
+priority: low
+```
+
+`net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md` still
+calls guardrail/quota policy "reserved, not implemented" and this repository
+"not a policy enforcement point". Guardrails shipped in `TEN-WP-0006`/`0007`,
+and the write path is PEP-shaped without this repository being a PDP, so
+both sentences now mislead a reader who trusts the contract over the code.
+
+Waiting on: `NET-IN-0002`, filed on `net-kingdom` by `TEN-WP-0011-T06`.
+
+Done when: the contract is amended at its next cut, **or** `net-kingdom`
+declines and the standing divergence is recorded here rather than left as
+a live contradiction between contract and code.
+
+## Closing this workplan
+
+Close when both tasks reach a disposition, whichever way each falls. If
+either stays open long enough to stop being worth re-reading, `cancel` the
+task and say in `SCOPE.md` that the gap is permanent — an accepted,
+documented divergence beats an indefinite `wait`.