---
id: USER-WP-0024
type: workplan
title: "Security layer model conformance for Engine/PIP"
domain: communication
repo: user-engine
status: finished
owner: grok
topic_slug: netkingdom
created: "2026-08-29"
updated: "2026-08-29"
depends_on:
  - USER-WP-0023
state_hub_workstream_id: "dee4ec0e-c451-50be-9363-e9cbc8ff68de"
---

# USER-WP-0024 — security layer model conformance

Adopt the accepted NetKingdom Security Layer Model
(`net-kingdom/canon/standards/security-layer-model_v0.7.md`, companion
`net-kingdom/SECURITY-COMPANION.md`) as this repository's own declaration
and close the implementation gaps that leave a PEP-shaped Engine short of
the standard.

Assessment:
`history/2026-08-29-security-layer-scope-intent-assessment.md`.

Working references: `ops-warden/layer.yaml` and
`kings-guard/layer.yaml` (no Tooling contacts). Credential and lane
questions go to `ops-warden`, not this workplan.

## T01 — Declare Engine/PIP in own voice

```task
id: USER-WP-0024-T01
status: done
priority: high
state_hub_task_id: "ee4c6a3c-a48c-5508-85c1-a02c6a0b1d11"
```

Replace the gate-house review note in `INTENT.md` with this repository's
own declaration: frontmatter `layer: Engine`, `role: PIP`, plus prose that
subject context is a claim, never a decision, and that protected
mutations are PEP-shaped without changing layer. Restate `SCOPE.md` from
that INTENT. Record the scope-vs-intent-vs-implementation assessment
under `history/`.

Done 2026-08-29. Closes the declaration half of `USER-IN-0001`. Does not
by itself make the runtime conforming.

## T02 — Machine-readable layer declaration and check

```task
id: USER-WP-0024-T02
status: done
priority: high
state_hub_task_id: "2874fd05-5b54-5812-9e89-2832408e488b"
```

Add `layer.yaml` (or equivalent) naming Engine/PIP, empty catalogued
Tooling contacts, non-Tooling / own-store clients (PostgreSQL modeled
concept, State Hub, env-injected secrets, flex-auth Engine API, OIDC
claim input), and the path of the PEP stance map. Adapt
`kings-guard/scripts/check_layer_conformance.py` and a unit test so an
undeclared OpenBao, Vault, LDAP, or cluster client fails the commit that
introduces it.

Done 2026-08-29. `layer.yaml`, `scripts/check_layer_conformance.py`, and
`tests/test_layer_conformance.py`. Checker exits 0; a synthetic `hvac`
import fails the scan.

## T03 — PEP obligations on the production path

```task
id: USER-WP-0024-T03
status: done
priority: high
state_hub_task_id: "caf7ef66-d221-5548-947b-17b5ff1865ee"
```

Ship the four §6.4 obligations for this PEP-shaped Engine.

Done 2026-08-29. `pep-stance.yaml` is total fail-closed including unknown
and equals `user_engine.pep_stance`. Unavailable DENY sets
`stance_applied` and `decision_id=None`. Allows are request-bound with a
30s lifetime. `LocalAuthorizationCheckPort` raises when
`USER_ENGINE_FLEX_AUTH_TOKEN_FILE` is set; `runtime.py` does not import
it.

## T04 — Evidence bound and cadence

```task
id: USER-WP-0024-T04
status: done
priority: medium
state_hub_task_id: "b4cebd66-21d0-5a6d-b718-971af70bebb6"
```

Classify local audit and outbox events as load-bearing or attributive.
Keep mutation+audit+outbox atomic in the store transaction (already
true). For denials and membership/account revocations — low-volume
load-bearing classes — declare a heartbeat or reconciliation, not a
rate.

Done 2026-08-29. `src/user_engine/evidence.py`,
`UserEngineService.record_evidence_heartbeat()`,
`docs/evidence-classification.md`. Operability copy no longer says
audit correlation completeness.

## T05 — Access-control facts remain claims

```task
id: USER-WP-0024-T05
status: done
priority: medium
state_hub_task_id: "f1ac9244-0639-5e97-8981-babdbe8991e5"
```

Prove under statute §6.1 that hats, access profiles, and
`AccessControlFact` exports cannot be mistaken for an authorization
decision.

Done 2026-08-29. `tests/test_evidence.py` forbids effect fields on claim
shapes and asserts hat selection and export never return allow/deny.
`docs/hats-realms-services-assets-access-profiles.md` states the
consumer contract.

## T06 — Close the intake and request the stance-map row

```task
id: USER-WP-0024-T06
status: done
priority: medium
state_hub_task_id: "81ecfc55-2b23-53cd-9269-c7211bad8bd9"
```

Mark `USER-IN-0001` answered: Engine/PIP, not contested. Message
`gate-house` with the declaration path, the PEP-shaped finding for
statute §13.1 (user-engine is a third PEP-shaped consumer; the register
currently has one published row), and a pointer at this workplan for the
runtime follow-through.

Done 2026-08-29. Intake marked answered in `intakes/intakes.md`. Message
`c014d12a-fe7a-4a90-ba73-03a5ac3e7f73` to `gate-house` carries the
declaration, the non-contest, and the §13.1 request (row to be added
when `pep-stance.yaml` ships in T03).