# user-engine — NetKingdom security layer declaration
#
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
# Declare:   INTENT.md (own voice) + this file (§11 machine-readable form)
# Validate:  python3 scripts/check_layer_conformance.py
#
# Engine/PIP: same authoritative user-domain inputs yield the same result.
# Catalogued Tooling is key-cape and OpenBao. This repository holds no client
# for either. PostgreSQL is the modeled-concept store, not a §4 Tooling row.

schema_version: "0.1"
framework: netkingdom-security-layer-model
standard_version: "0.7"
repository: user-engine
layer: engine
role: pip
declared_by: INTENT.md
declared_at: "2026-08-29"

pep_shape: true
pep_stance: pep-stance.yaml

catalog_entry:
  owns:
    - users
    - accounts
    - memberships
  role: PIP

# Empty is a claim. scripts/check_layer_conformance.py fails the commit that
# introduces an OpenBao, Vault, LDAP, or cluster client.
tooling_contacts: []

own_store:
  - id: postgres-modeled-concept
    module: src/user_engine/adapters/postgres.py
    import_root: psycopg
    symbol: PostgresUserEngineStore
    store: PostgreSQL
    write: true
    note: Persistence of the modeled concept a PIP owns. Not catalogued Tooling.

non_tooling_clients:
  - id: flex-auth-engine-api
    target: access-engine
    layer: engine
    module: src/user_engine/adapters/flex_auth.py
    operation: "HTTP POST /v1/check"
    write: false
    note: Engine API. The shape §5 prescribes for a PEP-shaped consumer.

  - id: oidc-claim-input
    target: key-cape
    layer: tooling-as-claim-input
    module: src/user_engine/oidc.py
    operation: "OIDC discovery and JWKS for verified IAM Profile claims"
    write: false
    note: Consumes identity claims as PIP input. Not a key-cape admin client.

  - id: env-injected-secrets
    target: Railiance secret injection
    layer: not-catalogued
    module: src/user_engine/runtime.py
    operation: "read environment and projected token files"
    write: false
    note: No OpenBao client. SecretProvider remains an unused port.

  - id: state-hub-work-records
    target: state-hub
    layer: not-catalogued
    operation: "HTTP to the Custodian State Hub for work records and progress events"
    write: true
    note: Agents writing this repository, not the service runtime.

declared_shapes:
  "5.1": []
  "5.2": []
  "5.3": []