diff --git a/ArchitectureBlueprint.md b/ArchitectureBlueprint.md index be889a5..87954a1 100644 --- a/ArchitectureBlueprint.md +++ b/ArchitectureBlueprint.md @@ -4,8 +4,8 @@ **Project family:** NetKingdom **Artifact:** `ArchitectureBlueprint.md` **Status:** Current — doctrine architecture; no runtime role -**Version:** 0.2 -**Date:** 2026-09-01 +**Version:** 0.3 +**Date:** 2026-09-10 **Decision:** `decisions/decisions.md` GH-DEC-2026-001 --- @@ -545,6 +545,49 @@ Assistant sessions do not silently become Autonomous sessions. Deterministic boundaries continue to hold when every agent behaves incorrectly. +### A-16 — Distinguishable routes + +Where one observable state is reachable by two routes that differ in security +meaning, the record distinguishes which route produced it. + +The two routes usually behave identically, and must — `unknown` and `absent` both +fail closed, and should. A-16 is not a requirement that they diverge; it is a +requirement that a later reader can tell them apart. Where they cannot, a sound +check gets read as establishing a property it does not carry, and the safer +reading of the appearance becomes unavailable to everyone. + +Instances: `GH-DEC-2026-010` (a decision envelope reads identically whether +`access-engine` issued it or a responder forged it), `GH-DEC-2026-011` (`unknown` +versus `absent` in a stance map), `GH-DEC-2026-013` (a `tenant` claim +directory-asserted about the principal versus registration-supplied about the +client), `GH-DEC-2026-014` (*erased* versus *never held* on an evidence path). + +### A-17 — Fail-closed transitions + +A transitional deviation from an invariant is admissible only where it fails +closed on the case that distinguishes it from the conformant state. + +This governs what may enter the declared-gap register rather than what a system +does at runtime. The admitting question is not the quality of the design or the +length of the transition, but the direction of failure at the distinguishing +case. A promise that fails open is a permission; a promise that fails closed is a +gap. + +Instances: `GH-DEC-2026-011` (a dated transitional `unknown: fail_open` declined +— its distinguishing case is exactly where it fails open, so the transition +licenses the forbidden thing and dates it), `GH-DEC-2026-013` (a +registration-bound tenant granted — registration and directory disagreeing +refuses issuance rather than picking a winner), `GH-DEC-2026-014` (commitment-only +evidence granted — a reviewer who cannot obtain the content gets no +reconstruction rather than a wrong one). + +**A-16 and A-17 are newer than A-01…A-15 and are not yet estate doctrine.** They +are stated here because a property recorded only against the instance that +produced it is found by accident or not at all. Graduation to +`net-kingdom/canon/standards/` waits on a repository bearing a cost under them +having argued them, which is the bar `security-layer-model` met and these have +not. + ## 16. Conformance architecture Gate House doctrine is real only when the loop turns: diff --git a/INTENT.md b/INTENT.md index f92e670..ca4ec7f 100644 --- a/INTENT.md +++ b/INTENT.md @@ -4,8 +4,8 @@ **Project family:** NetKingdom **Layer:** Staff **Status:** Re-cut as the security and defence doctrine council -**Version:** 0.2 -**Date:** 2026-08-28 +**Version:** 0.3 +**Date:** 2026-09-10 **Supersedes:** v0.1 (2026-08-24), which framed Gate House as a deterministic authority plane. See `history/2026-08-28-security-layer-model-and-gate-house-recut.md` for why that framing was withdrawn. ## The Mission @@ -284,7 +284,7 @@ credential never enters model context. ## Core Rules -The doctrine, in fifteen lines. Gate House authors and maintains these; the +The doctrine, in seventeen lines. Gate House authors and maintains these; the engines and Staff repositories implement them. 1. **No privilege from cognition.** @@ -302,6 +302,42 @@ engines and Staff repositories implement them. 13. **Audit evidence is protected from the actor being audited.** 14. **Failure of critical policy or authorization dependencies fails closed.** 15. **Production guarantees must survive incorrect agent behavior.** +16. **Where one appearance is reachable by two routes, the record says which route.** +17. **A transitional deviation is admissible only where it fails closed on the case that distinguishes it from the conformant state.** + +**On rules 16 and 17, which are newer than the rest.** Both were derived in +September 2026 from rulings that kept arriving at the same shape, and they are +stated here because a property recorded only against the instance that produced it +is found by accident or not at all — the failure this repository has now corrected +in other repositories three times. + +**Rule 16** is the more load-bearing. Its instances so far: a stance map where +`unknown` and `absent` fail closed identically but mean different things +(`GH-DEC-2026-011`); a `tenant` claim that reads the same whether the directory +asserted it about the person or a client registration supplied it +(`GH-DEC-2026-013`); an evidence path where *erased* and *never held* both present +as a blank (`GH-DEC-2026-014`); and a decision envelope that looks identical +whether `access-engine` issued it or a responder forged it (`GH-DEC-2026-010`). +In each, a sound check is read as establishing a property it does not carry, +because the appearance the check produces is reachable two ways. The rule is not +that the two routes must behave differently — usually they must behave identically, +and safely. It is that the **record** must distinguish them, or the safer reading of +the appearance becomes unavailable to every later reader. + +**Rule 17** governs what may enter a declared-gap register. It exists because two +requests for transitional relief arrived in one week and had to be answered +oppositely without the answers looking arbitrary: `ops-warden`'s dated transitional +`unknown: fail_open` was declined (`GH-DEC-2026-011`) and `key-cape`'s +registration-bound tenant was granted (`GH-DEC-2026-013`). The distinguishing +question is not how careful the design is or how long the transition lasts, but +which way it fails on the case that separates it from the conformant state. A +promise that fails open is a permission; a promise that fails closed is a gap; only +the second is a thing a register can hold. + +Neither rule has graduated to `net-kingdom/canon/standards/`. They are Gate House +doctrine at repository level until they have been argued by a repository that bears +a cost under them — which is how `security-layer-model` earned its acceptance and is +the bar these have not yet met. **A bound on rule 13, and on every claim that rests on audit.** An append-only archive with a verified hash chain proves records were not *altered or truncated diff --git a/README.md b/README.md index 3c1ab0c..379e1a8 100644 --- a/README.md +++ b/README.md @@ -116,7 +116,7 @@ may. --- -## The doctrine in fifteen lines +## The doctrine in seventeen lines 1. No privilege from cognition. 2. Every privileged action crosses a deterministic authority boundary. @@ -133,6 +133,14 @@ may. 13. Audit evidence is protected from the actor being audited. 14. Failure of critical policy or authorization dependencies fails closed. 15. Production guarantees must survive incorrect agent behavior. +16. Where one appearance is reachable by two routes, the record says which route. +17. A transitional deviation is admissible only where it fails closed on the case that distinguishes it from the conformant state. + +The last two are September 2026 and are repository-level, not estate doctrine. 16 +is why an `unknown` and an `absent` stance cell must be told apart in the record +even though both fail closed, and why a decision envelope that looks authentic is +not therefore attributable. 17 is why one request for transitional relief was +granted and another declined in the same week. See `INTENT.md` § Core Rules. ## Agentic operating modes diff --git a/SCOPE.md b/SCOPE.md index 4ab8645..2eccf22 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -1,38 +1,84 @@ # Scope -Derived from `INTENT.md`. Gate House is deliberately narrow: it decides whether -a requested action is authorized, and represents that decision as bounded, -time-limited authority that downstream systems enforce. +Derived from `INTENT.md`. Gate House is the council where NetKingdom's security +and defence doctrine is established, documented, taught, and supervised. It is a +**Staff**-layer repository: it holds no runtime position and renders no +authorization decision. + +> **The mandate and the operating mode are Gate House's. The decision is +> access-engine's. The credential is secrets-engine's. The perimeter is +> ops-mason's and ops-warden's.** ## In scope -- deterministic authorization decisions (`GRANT` / `DENY` / `REQUIRE_APPROVAL` / `DEFER`) -- principal / actor / runtime-identity separation -- mandates, delegation, and attenuation -- authority ceilings -- tenant-, environment-, resource-, task-, and time-scoped grants -- approval binding and step-up requirements -- posture intake from King's Guard, restricting only -- change-dynamics limits: quotas, budgets, concurrency, circuit breakers -- credential-binding contract to Secrets Engine / OpenBao -- emergency revocation independent of the actor -- decision evidence, explainability, and protected audit -- policy and decision versioning; fail-closed semantics +- **doctrine** — the Active Secrets Management Canon, its invariants, and the + argument behind them; doctrine graduates into `net-kingdom/canon/standards/` + as it stabilizes +- the **authority context schema** — what must be *sayable* about an agentic + authority request (principal, actor, runtime identity, tenant, environment, + mandate, task, operating mode), consumed by access-engine as input claims +- **principal / actor / runtime-identity separation** as a model +- **mandates, delegation, attenuation, and authority ceilings** as a model and a + governance obligation +- the **agentic operating modes** — Assistant and Autonomous as distinct security + regimes, and the requirements attaching to each +- the **Change Dynamics Envelope** — how much change the organization tolerates, + expressed so engines and Staff can bound it +- the **posture contract** with King's Guard, including the asymmetry: posture may + only restrict +- the **MCP and tooling doctrine** — tool availability is not permission +- the **credential-binding contract** stating that credentials are implementation + artifacts of a grant, materialized by Secrets Engine after authority exists +- **fail-closed semantics** and the restrictive-failure rule, as properties the + estate must hold +- **conformance review** — whether an actor's authority in practice matches its + declared mandate and ceiling +- the **assurance specifications** `T-01`…`T-10`, authored here and executed by + whitehat-security +- the **security curriculum** — what operators, assistants, and autonomous agents + must understand before they are trusted with authority + +Decision types `GRANT` / `DENY` / `REQUIRE_APPROVAL` / `DEFER` are **named** here +and **rendered** by access-engine. ## Out of scope -Owned elsewhere in NetKingdom — see the responsibility table in `INTENT.md`: +Gate House holds no runtime position. Not owned here: -- human identity lifecycle and memberships — User Engine -- tenant and organizational boundaries — Tenant Engine -- authentication and federation — Key Cape -- credential abstraction and lifecycle orchestration — Secrets Engine -- secret storage, PKI, leases, dynamic secret engines — OpenBao -- operational execution — Ops Warden -- construction, reconciliation, recovery — Ops Mason -- anomaly detection, behavioral risk inference, security memory — King's Guard -- adversarial testing and attack simulation — Whitehat Security +- the authorization decision, policy evaluation, or any `/authorize` surface — + **access-engine** is NetKingdom's only policy decision point +- policy engine selection, policy packages, or policy rollout +- grant storage, credential issuance, leases, or revocation +- human identity lifecycle and memberships — **User Engine** +- tenant and organizational boundaries — **Tenant Engine** +- authentication and federation — **Key Cape** +- credential abstraction and lifecycle orchestration — **Secrets Engine** +- secret storage, PKI, leases, dynamic secret engines — **OpenBao** +- approval storage and lifecycle — **Approval Engine** +- audit custody and evidence retention — **Audit Core** +- operational execution, access lanes, SSH certificates, tunnels, host hardening + — **Ops Warden** +- construction, reconciliation, recovery — **Ops Mason** +- anomaly detection, behavioral risk inference, security memory — **King's Guard** +- adversarial testing and attack simulation — **Whitehat Security** +- **the workplans of other repositories** -Also out of scope: inventing a new policy language, becoming an IAM suite, -secret scanning, SIEM, autonomous remediation, and supporting every agent -protocol. See "Non-Goals for the First Prototype" in `ArchitectureBlueprint.md` §3. +That last one is load-bearing. Work structure belongs to the repository doing the +work. Gate House sets doctrine and reviews conformance; an HQ that starts managing +the estate's chores has become a second decision point wearing management clothes. + +Also out of scope: inventing a new policy language, becoming an IAM suite, secret +scanning, SIEM, autonomous remediation, and supporting every agent protocol. + +## What would put this repository out of scope + +If work here starts producing services, schemas that resolve, or anything +evaluated at request time, it belongs to an engine. A decision point inside Gate +House would put the deterministic authority boundary inside the non-deterministic +management layer, violating `INV-02` — the first invariant this repository +defends. See `decisions/decisions.md` `GH-DEC-2026-001` and +`history/2026-08-28-security-layer-model-and-gate-house-recut.md`. + +The `v0.1` milestones `M0`–`M8` and the reference implementation tree +(`api/`, `policy/`, `grants/`, `deploy/`) described the withdrawn authority-plane +design and must not be revived.