tegwick
2ac4a36bdd
layer.yaml drops standard_version (A12) and is marked derived: true, derived_from: INTENT.md (A11); INTENT.md frontmatter already carries the governing layer: Engine and no standard_version. The checker changes in the same commit: standard_version is no longer required and its presence is now malformed, the derived marking is required, the layer is compared against the closed four-token vocabulary after an ASCII fold (A9), and a divergence between INTENT.md and layer.yaml that survives the fold is reported. Nothing is re-spelled: Engine and engine both stand. The tests assert the fold rather than equality. pep-stance.yaml is untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
93 lines
3 KiB
YAML
93 lines
3 KiB
YAML
# user-engine — DERIVED form of the NetKingdom security layer declaration
|
|
#
|
|
# THIS FILE DOES NOT GOVERN. The declaration is the `layer:` key in INTENT.md's
|
|
# frontmatter; this file is a derived artifact under §11's derived-artifact rule
|
|
# and must agree with it (GH-DEC-2026-017 §1, amendment A11). The §3 vocabulary
|
|
# is compared after an ASCII case-fold, so `Engine` there and `engine` here are
|
|
# the same value and neither is re-spelled (GH-DEC-2026-017 §2). A disagreement
|
|
# that survives the fold is a finding in its own right and is reported.
|
|
#
|
|
# No standard version here or in INTENT.md: a layer declaration MUST NOT carry
|
|
# one (GH-DEC-2026-017 §4, amendment A12). Version-scoped state belongs in the
|
|
# derived conformance record.
|
|
#
|
|
# Framework: net-kingdom/canon/standards/security-layer-model
|
|
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
|
|
# Validate: python3 scripts/check_layer_conformance.py
|
|
#
|
|
# Engine/PIP: same authoritative user-domain inputs yield the same result.
|
|
# Catalogued Tooling is key-cape and OpenBao. This repository holds no client
|
|
# for either. PostgreSQL is the modeled-concept store, not a §4 Tooling row.
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-security-layer-model
|
|
|
|
# §11 derived-artifact marking (GH-DEC-2026-017 §1 / A11).
|
|
derived: true
|
|
derived_from: INTENT.md
|
|
|
|
repository: user-engine
|
|
layer: engine
|
|
role: pip
|
|
declared_by: INTENT.md
|
|
declared_at: "2026-08-29"
|
|
|
|
pep_shape: true
|
|
pep_stance: pep-stance.yaml
|
|
|
|
catalog_entry:
|
|
owns:
|
|
- users
|
|
- accounts
|
|
- memberships
|
|
role: PIP
|
|
|
|
# Empty is a claim. scripts/check_layer_conformance.py fails the commit that
|
|
# introduces an OpenBao, Vault, LDAP, or cluster client.
|
|
tooling_contacts: []
|
|
|
|
own_store:
|
|
- id: postgres-modeled-concept
|
|
module: src/user_engine/adapters/postgres.py
|
|
import_root: psycopg
|
|
symbol: PostgresUserEngineStore
|
|
store: PostgreSQL
|
|
write: true
|
|
note: Persistence of the modeled concept a PIP owns. Not catalogued Tooling.
|
|
|
|
non_tooling_clients:
|
|
- id: flex-auth-engine-api
|
|
target: access-engine
|
|
layer: engine
|
|
module: src/user_engine/adapters/flex_auth.py
|
|
operation: "HTTP POST /v1/check"
|
|
write: false
|
|
note: Engine API. The shape §5 prescribes for a PEP-shaped consumer.
|
|
|
|
- id: oidc-claim-input
|
|
target: key-cape
|
|
layer: tooling-as-claim-input
|
|
module: src/user_engine/oidc.py
|
|
operation: "OIDC discovery and JWKS for verified IAM Profile claims"
|
|
write: false
|
|
note: Consumes identity claims as PIP input. Not a key-cape admin client.
|
|
|
|
- id: env-injected-secrets
|
|
target: Railiance secret injection
|
|
layer: not-catalogued
|
|
module: src/user_engine/runtime.py
|
|
operation: "read environment and projected token files"
|
|
write: false
|
|
note: No OpenBao client. SecretProvider remains an unused port.
|
|
|
|
- id: state-hub-work-records
|
|
target: state-hub
|
|
layer: not-catalogued
|
|
operation: "HTTP to the Custodian State Hub for work records and progress events"
|
|
write: true
|
|
note: Agents writing this repository, not the service runtime.
|
|
|
|
declared_shapes:
|
|
"5.1": []
|
|
"5.2": []
|
|
"5.3": []
|