---
id: ZONE-LAYER-CHANGE-2026-08-23
type: layer-change-record
title: "Statute §10 artifacts for the 2026-08-23 zone-engine layer cut"
status: accepted
recorded: "2026-08-29"
standard: net-kingdom/canon/standards/security-layer-model_v0.7.md
---

# Statute §10 artifacts — the 2026-08-23 layer cut

Statute §10 writes the layer-change procedure from this repository's case:
the runtime hypothesis was falsified, and the Engine remained as offline
reference conformance. The six artifacts are gathered here so a reviewer
does not have to reconstruct them from workplan history.

A later live API, decision surface, or compiled stance would be a **new**
cut and would need its own six artifacts plus assent from every repository
whose boundary moves. This record does not authorize that.

## 1. Before / after `INTENT.md`

| | Before (through 2026-08-23) | After (2026-08-29) |
| --- | --- | --- |
| Desired sentence | Not yet sayable | Sayable; standard adopted |
| Runtime | Hypothesis under test | Falsified; cheaper answer taken |
| Layer | Unstated in this repository's voice | Engine, role PIP |
| Surface | Assumed an engine might be needed | Offline reference conformance |
| PDP line | `flex-auth` is the only decision point | Same ruling; ruled name `access-engine` (currently `flex-auth`) |

Before-state: `history/2026-08-23-retain-reference-decision.md`,
`history/2026-08-23-scope-against-intent.md`, and the 2026-08-23 body of
`INTENT.md` retained as design history.

After-state: `INTENT.md` frontmatter (`layer: Engine`, `role: PIP`) and the
2026-08-29 declaration prose. Machine-readable twin: `layer.yaml`.

## 2. Client inventory

| Contact | Before | After |
| --- | --- | --- |
| Tooling-layer clients (`OpenBao`, `key-cape`, datastore) | none | none |
| HTTP authorization decision surface | none | none |
| Live Engine API | none | none |
| Python tools | offline resolver, exception checker, lineage checker | same |
| Non-Tooling | State Hub work records via CLI / agent sessions | same; recorded in `layer.yaml` |

There was no Tooling client to retire and none to add. `tools/` imports the
standard library and PyYAML only.

## 3. Gap inventory

| Kind | Before | After |
| --- | --- | --- |
| §5.3 declared Tooling contacts | none | none |
| Unowned capabilities this repository currently owes | none | none |
| Live Engine API | not owed; catalog records the offline form | still not owed |

A missing live API is not a §5.3 gap. Closing it in place would reverse the
cut this record describes.

## 4. Assent list

No new boundary moved on 2026-08-29. The cut of 2026-08-23 was already
assented in practice by the two consuming owners:

| Repository | Evidence | Boundary |
| --- | --- | --- |
| flex-auth (`access-engine`) | `FLEX-WP-0016` adoption; profile owner in `profiles/netkingdom-build-v0.1.yaml`; review of ZONE-WP-0001 | remains the only PDP; stance stays in its policy package |
| ops-warden | retired `policy.enabled`; PEP failure modes; adoption evidence 2026-08-22/23 | consumes membership; owns unreachable-engine stance |
| net-kingdom | published `security-zones_v0.1` (still `proposed`) | canon publication |
| gate-house | §4 catalog row names the offline disposition; `ZONE-IN-0001` requested the own-voice declaration | layer model |

A future live surface would require fresh assent from at least
`access-engine` and `ops-warden`.

## 5. State-migration decision

`history/2026-08-23-retain-reference-decision.md`. There was no live state
to migrate: no API, no store, no consumer registry. Consumers already read
declarations in owning repos and policy in owner packages. Retention is of
fixtures, lineage, and offline tools.

## 6. Permission freeze

Until a later cut carries its own six artifacts:

- no live API, daemon, database, controller, scheduler, or reload path;
- no authorization decision surface and no cached verdict;
- no stance compiled into membership, and no local profile change that
  alters a live effect;
- no PEP, and no unreachable-engine stance map published from this
  repository;
- no Tooling-layer client.

`tools/check_layer_conformance.py` is the freeze's check: a new OpenBao
import or an `/authorize` helper fails `make check`.