Declare Engine/PIP and open USER-WP-0024 for layer conformance

Adopt security-layer-model v0.7 in INTENT.md in this repository's own
voice, restate SCOPE.md from that declaration, and record the
scope-versus-implementation assessment. USER-IN-0001 is answered;
runtime follow-through is USER-WP-0024.

Assistant: grok
Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb

workplans/USER-WP-0024-security-layer-conformance.md

@@ -0,0 +1,152 @@
+---
+id: USER-WP-0024
+type: workplan
+title: "Security layer model conformance for Engine/PIP"
+domain: communication
+repo: user-engine
+status: active
+owner: grok
+topic_slug: netkingdom
+created: "2026-08-29"
+updated: "2026-08-29"
+depends_on:
+  - USER-WP-0023
+---
+
+# USER-WP-0024 — security layer model conformance
+
+Adopt the accepted NetKingdom Security Layer Model
+(`net-kingdom/canon/standards/security-layer-model_v0.7.md`, companion
+`net-kingdom/SECURITY-COMPANION.md`) as this repository's own declaration
+and close the implementation gaps that leave a PEP-shaped Engine short of
+the standard.
+
+Assessment:
+`history/2026-08-29-security-layer-scope-intent-assessment.md`.
+
+Working references: `ops-warden/layer.yaml` and
+`kings-guard/layer.yaml` (no Tooling contacts). Credential and lane
+questions go to `ops-warden`, not this workplan.
+
+## T01 — Declare Engine/PIP in own voice
+
+```task
+id: USER-WP-0024-T01
+status: done
+priority: high
+```
+
+Replace the gate-house review note in `INTENT.md` with this repository's
+own declaration: frontmatter `layer: Engine`, `role: PIP`, plus prose that
+subject context is a claim, never a decision, and that protected
+mutations are PEP-shaped without changing layer. Restate `SCOPE.md` from
+that INTENT. Record the scope-vs-intent-vs-implementation assessment
+under `history/`.
+
+Done 2026-08-29. Closes the declaration half of `USER-IN-0001`. Does not
+by itself make the runtime conforming.
+
+## T02 — Machine-readable layer declaration and check
+
+```task
+id: USER-WP-0024-T02
+status: todo
+priority: high
+```
+
+Add `layer.yaml` (or equivalent) naming Engine/PIP, empty catalogued
+Tooling contacts, non-Tooling / own-store clients (PostgreSQL modeled
+concept, State Hub, env-injected secrets, flex-auth Engine API, OIDC
+claim input), and the path of the PEP stance map. Adapt
+`kings-guard/scripts/check_layer_conformance.py` and a unit test so an
+undeclared OpenBao, Vault, LDAP, or cluster client fails the commit that
+introduces it.
+
+Do not add a Tooling client to have something to declare.
+
+**Done when:** `layer.yaml` is the machine-readable declaration, the
+checker exits 0 on the current tree, and a test covers the empty
+Tooling-contact claim.
+
+## T03 — PEP obligations on the production path
+
+```task
+id: USER-WP-0024-T03
+status: todo
+priority: high
+```
+
+Ship the four §6.4 obligations for this PEP-shaped Engine:
+
+1. Publish `pep-stance.yaml` (total, no implicit default). Production
+   remains fail-closed, including unknown. A test asserts the file equals
+   `FlexAuthHTTPAdapter` behaviour.
+2. On engine-unavailable DENY, record stance application (scope, failure
+   mode, outcome). `decision_id` is present only when flex-auth rendered
+   a decision. Stop minting a local id via `AuthorizationDecision`'s
+   default factory on that path.
+3. Give `AuthorizationDecision` an explicit lifetime (TTL or
+   session/obligation binding). Do not add a verdict cache.
+4. Confine `LocalAuthorizationCheckPort` to tests and standalone
+   fixtures. Production `create_application()` must be unable to
+   construct a default-allow adapter.
+
+**Done when:** the published map matches shipped fail-closed behaviour,
+unavailable DENY audits carry no engine decision id, allows carry a
+lifetime, and the local port cannot enter the production runtime
+assembly.
+
+## T04 — Evidence bound and cadence
+
+```task
+id: USER-WP-0024-T04
+status: todo
+priority: medium
+```
+
+Classify local audit and outbox events as load-bearing or attributive.
+Keep mutation+audit+outbox atomic in the store transaction (already
+true). For denials and membership/account revocations — low-volume
+load-bearing classes — declare a heartbeat or reconciliation, not a
+rate. Update `docs/evidence-gap-examples.md` and operability copy so the
+trail is never described as complete, and so absence of a record is not
+read as non-occurrence.
+
+**Done when:** the classification is in-repo, the heartbeat or
+reconciliation form is named, and docs use the sound evidence sentences.
+
+## T05 — Access-control facts remain claims
+
+```task
+id: USER-WP-0024-T05
+status: todo
+priority: medium
+```
+
+Prove under statute §6.1 that hats, access profiles, and
+`AccessControlFact` exports cannot be mistaken for an authorization
+decision. Add a test that selection and export never return allow/deny.
+Document the consumer contract: compiling those facts into a local
+decision is an early decision and is forbidden.
+
+**Done when:** a test and the hats/boundary docs state the claim
+contract, and no user-engine API on that path exposes an effect.
+
+## T06 — Close the intake and request the stance-map row
+
+```task
+id: USER-WP-0024-T06
+status: done
+priority: medium
+```
+
+Mark `USER-IN-0001` answered: Engine/PIP, not contested. Message
+`gate-house` with the declaration path, the PEP-shaped finding for
+statute §13.1 (user-engine is a third PEP-shaped consumer; the register
+currently has one published row), and a pointer at this workplan for the
+runtime follow-through.
+
+Done 2026-08-29. Intake marked answered in `intakes/intakes.md`. Message
+`c014d12a-fe7a-4a90-ba73-03a5ac3e7f73` to `gate-house` carries the
+declaration, the non-contest, and the §13.1 request (row to be added
+when `pep-stance.yaml` ships in T03).