# user-engine — DERIVED form of the NetKingdom security layer declaration
#
# THIS FILE DOES NOT GOVERN. The declaration is the `layer:` key in INTENT.md's
# frontmatter; this file is a derived artifact under §11's derived-artifact rule
# and must agree with it (GH-DEC-2026-017 §1, amendment A11). The §3 vocabulary
# is compared after an ASCII case-fold, so `Engine` there and `engine` here are
# the same value and neither is re-spelled (GH-DEC-2026-017 §2). A disagreement
# that survives the fold is a finding in its own right and is reported.
#
# No standard version here or in INTENT.md: a layer declaration MUST NOT carry
# one (GH-DEC-2026-017 §4, amendment A12). Version-scoped state belongs in the
# derived conformance record.
#
# Framework: net-kingdom/canon/standards/security-layer-model
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
# Validate:  python3 scripts/check_layer_conformance.py
#
# Engine/PIP: same authoritative user-domain inputs yield the same result.
# Catalogued Tooling is key-cape and OpenBao. This repository holds no client
# for either. PostgreSQL is the modeled-concept store, not a §4 Tooling row.

schema_version: "0.1"
framework: netkingdom-security-layer-model

# §11 derived-artifact marking (GH-DEC-2026-017 §1 / A11).
derived: true
derived_from: INTENT.md

repository: user-engine
layer: engine
role: pip
declared_by: INTENT.md
declared_at: "2026-08-29"

pep_shape: true
pep_stance: pep-stance.yaml

catalog_entry:
  owns:
    - users
    - accounts
    - memberships
  role: PIP

# Empty is a claim. scripts/check_layer_conformance.py fails the commit that
# introduces an OpenBao, Vault, LDAP, or cluster client.
tooling_contacts: []

own_store:
  - id: postgres-modeled-concept
    module: src/user_engine/adapters/postgres.py
    import_root: psycopg
    symbol: PostgresUserEngineStore
    store: PostgreSQL
    write: true
    note: Persistence of the modeled concept a PIP owns. Not catalogued Tooling.

non_tooling_clients:
  - id: flex-auth-engine-api
    target: access-engine
    layer: engine
    module: src/user_engine/adapters/flex_auth.py
    operation: "HTTP POST /v1/check"
    write: false
    note: Engine API. The shape §5 prescribes for a PEP-shaped consumer.

  - id: oidc-claim-input
    target: key-cape
    layer: tooling-as-claim-input
    module: src/user_engine/oidc.py
    operation: "OIDC discovery and JWKS for verified IAM Profile claims"
    write: false
    note: Consumes identity claims as PIP input. Not a key-cape admin client.

  - id: env-injected-secrets
    target: Railiance secret injection
    layer: not-catalogued
    module: src/user_engine/runtime.py
    operation: "read environment and projected token files"
    write: false
    note: No OpenBao client. SecretProvider remains an unused port.

  - id: state-hub-work-records
    target: state-hub
    layer: not-catalogued
    operation: "HTTP to the Custodian State Hub for work records and progress events"
    write: true
    note: Agents writing this repository, not the service runtime.

declared_shapes:
  "5.1": []
  "5.2": []
  "5.3": []