66 lines
2.5 KiB
YAML
66 lines
2.5 KiB
YAML
|
# zone-engine — NetKingdom security layer declaration
|
||
|
|
#
|
||
|
|
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
|
||
|
|
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
|
||
|
|
# Declaration: INTENT.md (this repository's own voice, §11)
|
||
|
|
# Validate: python3 tools/check_layer_conformance.py
|
||
|
|
#
|
||
|
|
# §11 requires a machine-readable form because prose cannot distinguish a
|
||
|
|
# declaration from a transcribed review. Shape adapted from kings-guard's
|
||
|
|
# no-contact declaration, offered estate-wide under §11.
|
||
|
|
#
|
||
|
|
# Catalogued as Engine / PIP for zone identity and membership, offline
|
||
|
|
# reference conformance per the 2026-08-23 disposition. There is no
|
||
|
|
# Tooling contact, no PEP, and no authorization decision surface.
|
||
|
|
|
||
|
|
schema_version: "0.1"
|
||
|
|
framework: netkingdom-security-layer-model
|
||
|
|
standard_version: "0.7"
|
||
|
|
repository: zone-engine
|
||
|
|
layer: engine
|
||
|
|
role: pip
|
||
|
|
declared_by: INTENT.md
|
||
|
|
declared_at: "2026-08-29"
|
||
|
|
|
||
|
|
# §4 catalog entry, transcribed so drift is visible. The standard is
|
||
|
|
# authoritative for the row; this records what we understand ourselves
|
||
|
|
# to have been assigned.
|
||
|
|
catalog_entry:
|
||
|
|
owns:
|
||
|
|
- zone identity and membership
|
||
|
|
form: offline reference conformance (2026-08-23 disposition)
|
||
|
|
pep_shaped: false
|
||
|
|
|
||
|
|
# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling
|
||
|
|
# row), one entry each. Empty is a claim. tools/check_layer_conformance.py
|
||
|
|
# fails if a Tooling client or a decision surface appears under tools/.
|
||
|
|
tooling_contacts: []
|
||
|
|
|
||
|
|
# No pep_stance path. This repository causes no protected side effect.
|
||
|
|
|
||
|
|
# §11 requires non-Tooling clients to be recorded so the check is total.
|
||
|
|
# There is no library client in this repository. Work-record writes happen
|
||
|
|
# through the State Hub CLI / agent sessions, not through tools/.
|
||
|
|
non_tooling_clients:
|
||
|
|
- id: state-hub-work-records
|
||
|
|
target: state-hub
|
||
|
|
layer: not-catalogued
|
||
|
|
operation: "HTTP via statehub CLI / agent sessions for work records and progress events"
|
||
|
|
write: true
|
||
|
|
in_tree: false
|
||
|
|
note: >-
|
||
|
|
Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4
|
||
|
|
Tooling row, and state-hub is not one. Recorded, not policed. Carries no
|
||
|
|
security authority and no secret payload. No import of a State Hub
|
||
|
|
client exists under tools/.
|
||
|
|
|
||
|
|
# A live Engine API is not an unowned capability this repository currently
|
||
|
|
# owes. The catalog records the offline form. Growing one would be a §10
|
||
|
|
# layer change, not a gap to close in place.
|
||
|
|
unowned_capabilities: []
|
||
|
|
|
||
|
|
declared_shapes:
|
||
|
|
"5.1": []
|
||
|
|
"5.2": []
|
||
|
|
"5.3": []
|