Question as presented: "D-137 ruling 4 of 5 -- policy home. Where does the
credential-lifecycle RULE live as authority?" Operator selection, exact:
"D-137 is the authority (Recommended)".

D-137 becomes the policy authority; the SEC-009 standing-convention block in
docs/security-ledger.md demotes to a pointer, and the ledger returns to being
purely a register of exposures and rotation obligations -- its stated purpose
and the GA-R4/F3 intent. Gates can then cite a D-number rather than an exposure
register. Satisfies the GA-R3 A1 test: a Roosevelt session greps
design-decisions before touching a built surface, so the rule must live there.

Implementation care recorded: the demotion MOVES the convention text, it does
not delete it. SEC-009's block carries the founding history (the NetBox-token
miss) which stays in the ledger as history while the RULE moves to D-137.

D-137 stays PROPOSED; sub-ruling 5 OPEN; nothing built until all five.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf