# user-engine — PEP unreachable-engine stance map
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md §6.4, §9.3
# Companion: net-kingdom/SECURITY-COMPANION.md §5
# Validate:  tests/test_layer_conformance.py
#
# user-engine is a PEP-shaped Engine (PIP). Protected mutations proceed only
# with a decision from access-engine, or under this published stance whose
# application is recorded in place of a decision.
#
# Total by construction: every zone in security-zones_v0.1, plus unknown and
# not-applicable. No implicit default. Production is fail-closed everywhere,
# including unknown.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
repository: user-engine
pep_shape: true
declared_by: INTENT.md

protected_action: "user-engine owned mutations (account, membership, registration, hat, catalog, profile)"
decision_engine: access-engine
scope: security-zone

stance:
  z0-experimental: fail_closed
  z1-operational: fail_closed
  z2-protected: fail_closed
  z2-continuity: fail_closed
  z3-critical: fail_closed
  unknown: fail_closed
  not-applicable: fail_closed

allow_binding: request
allow_lifetime_seconds: 30

on_apply:
  recorded_fields:
    - stance_applied
    - stance_scope
    - outcome
    - decision_id
  decision_id: present only where access-engine rendered a decision
  written_to:
    - "local audit_records (UserEngineService._authorize)"
  never_recorded: "caller tokens, secret material, profile payloads"

verdict_caching: none

reconstructability:
  bound: "§9.6 — local audit and outbox prove the records they hold"
  completeness_claimed: false