Keep layer declaration separate from dated observer evidence

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

INTENT.md

@@ -4,16 +4,15 @@ role: null
 standard: net-kingdom/canon/standards/security-layer-model
 companion: net-kingdom/SECURITY-COMPANION.md
 declared_at: "2026-09-01"
-conformance_state: blocked-clean
 ---
 
 # INTENT — whitehat-security
 
 > **Layer: Staff.** Offensive validation. This is this repository's own
-> declaration under NetKingdom Security Layer Model v0.7 §11. A catalog row,
+> declaration under NetKingdom Security Layer Model v0.8 §11. A catalog row,
 > a review note, or the 2026-08-28 gate-house insert that used to sit here is
 > not a declaration. The statute is
-> `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted). The
+> `net-kingdom/canon/standards/security-layer-model_v0.8.md` (accepted). The
 > operative form is `net-kingdom/SECURITY-COMPANION.md`.
 >
 > Offensive validation is interactive and non-deterministic. Acting at runtime

SCOPE.md

@@ -108,7 +108,10 @@ a complete engagement record already exists. No live target is authorized.
 
 - Repository status: active.
 - Layer: Staff (declared in `INTENT.md`, 2026-09-01). `conformance_state`
-  stays `blocked-clean`. `WHITEHAT-IN-0001` is closed.
+  stays `blocked-clean` in the dated
+  [declaration migration evidence](docs/evidence/2026-10-11-layer-declaration-migration.md),
+  outside declaration frontmatter under GH-DEC-2026-021 §5.
+  `WHITEHAT-IN-0001` is closed.
 - The capability statement above is the 2026-10-04 scope assessment. The
   comparison against `INTENT.md` is
   [`history/2026-10-04T0649Z-scope-against-intent.md`](history/2026-10-04T0649Z-scope-against-intent.md).

docs/evidence/2026-10-11-layer-declaration-migration.md

@@ -0,0 +1,32 @@
+---
+type: evidence
+date: "2026-10-11"
+repository: whitehat-security
+conformance_state: blocked-clean
+source: INTENT.md
+ruling: GH-DEC-2026-021
+validated_against: net-kingdom/canon/standards/security-layer-model_v0.8.md
+scope: "Declaration frontmatter only; relocation of existing state, no live probing or full conformance determination"
+---
+
+# Declaration-state relocation
+
+GH-DEC-2026-021 §5 assigns conformance_state to run/evidence records rather
+than the standing layer declaration. Accepted v0.8 source enables this
+post-flip GH-WP-0004-T11 migration. The existing blocked-clean value is
+preserved here, not upgraded to conformant. Historical workplans and scope
+assessments remain unchanged. INTENT's governing statute citation now names
+accepted v0.8; declaration keys retain no standard or companion version.
+
+This migration changes no probe, authorization gate, live target, capability,
+or evidence axis. The declared Staff role and offensive-validation remit
+remain the repository's own voice. A passing declaration test establishes
+this limited structural property; no target isolation is established.
+
+Verification: all 117 offline tests passed against merged staged source,
+with explicit existing SecretsEngine source and Railiance custody schema
+paths. Three declaration tests also pass in the narrow staging directory.
+The first full copied-tree run failed 19 tests because sibling source/schema
+lookup cannot resolve from /tmp; supplying the documented environment
+overrides restores the same source dependencies as the authoritative tree.
+This was a verification-location failure, not a probe or capability change.

docs/evidence/2026-10-11-layer-declaration-tests.log

@@ -0,0 +1,3 @@
+........................................................................ [ 61%]
+.............................................                            [100%]
+117 passed in 0.99s

tests/test_layer_declaration.py

@@ -26,7 +26,9 @@ def test_intent_declares_staff_in_own_voice():
     layers = [v for k, v in _entries(frontmatter) if k == "layer"]
     # ASCII case-fold before comparing; nobody re-spells (GH-DEC-2026-017 §2).
     assert [v.casefold() for v in layers] == ["staff"]
-    assert "conformance_state: blocked-clean" in frontmatter
+    assert "conformance_state" not in dict(_entries(frontmatter))
+    evidence = Path("docs/evidence/2026-10-11-layer-declaration-migration.md").read_text()
+    assert "conformance_state: blocked-clean" in evidence
     assert "gate-house insert that used to sit here is" in text
     assert "does not author our probes" in text
 

workplans/ADHOC-2026-10-11.md

@@ -0,0 +1,33 @@
+---
+id: WHITEHAT-WP-ADHOC-2026-10-11
+type: workplan
+title: "Relocate declaration conformance state after accepted v0.8"
+domain: infotech
+repo: whitehat-security
+status: finished
+flavor: implementation
+owner: codex
+topic_slug: infotech
+created: "2026-10-11"
+updated: "2026-10-11"
+---
+
+## Relocate state without changing the security claim
+
+```task
+id: WHITEHAT-WP-ADHOC-2026-10-11-T01
+status: done
+priority: medium
+```
+
+Apply GH-DEC-2026-021 §5 and GateHouse GH-WP-0004-T11: move
+conformance_state: blocked-clean out of INTENT declaration into the dated
+layer-declaration migration evidence; retain SCOPE's blocked-clean claim
+with an explicit evidence link; update the governing prose citation to
+accepted v0.8. Declaration regression checks absence of the state key and
+preservation of the recorded value. No probe, target or live authority changes.
+
+Verification: all 117 offline tests passed against the merged staged source
+with explicit existing SecretsEngine fixture source and Railiance custody
+schema paths. The three declaration tests pass directly against staging.
+No network target was contacted.