coulomb/gate-house
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Teach SEC-DSM as the secrets best-practice guide.

Browse source 
Keep ASM v0.3 for estate invariants, operating modes, and assurance tests. Secrets-practice sentences yield to the security-canon standard.

Assistant: grok
Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4
This commit is contained in:
tegwick 2026-10-11 23:41:30 +02:00
parent b589fcb061
commit bc890c4d05
7 changed files with 98 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

11
ArchitectureBlueprint.md
View file

@ -29,12 +29,15 @@ and the complete historical text remains available at Git object
This document is subordinate, in order, to:
1. `decisions/decisions.md`;
2. `spec/ActiveSecretsManagementCanon_v0.3.md`;
3. `INTENT.md`;
4. the accepted NetKingdom security-layer standard.
2. SecurityCanon `SEC-DSM` 1.0.0, for secrets practice
(`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`);
3. `spec/ActiveSecretsManagementCanon_v0.3.md`, for estate invariants, operating
modes, and assurance tests;
4. `INTENT.md`;
5. the accepted NetKingdom security-layer standard.
Where they conflict, the higher artifact wins and this Blueprint must be
corrected.
corrected. A secrets-practice sentence in the ASM canon yields to `SEC-DSM`.
The architectural maxim is:

34
CLAUDE.md
View file

@ -43,24 +43,33 @@ estate's layering rule:
## Document hierarchy — read in this order
1. **`spec/ActiveSecretsManagementCanon_v0.3.md`** — the normative standard Gate House
implements. Uses RFC-style MUST/SHOULD/MAY. Owns the numbered invariants `INV-01`…`INV-12`
and the assurance tests `T-01`…`T-10`. Gate House conforms to the Canon; the Canon is not
edited to accommodate Gate House.
2. **`INTENT.md`** — mission, scope boundaries, domain concepts, the 15 numbered Core Rules,
1. **SecurityCanon `SEC-DSM` 1.0.0** —
`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`.
The secrets best-practice guide from 2026-10-11. Preference hierarchy, decision
procedure (Q1–Q5), and the `DSM-*` requirements. Gate House teaches it. ops-mason
builds to it. ops-warden operates lanes inside it. Do not edit the standard to
fit this estate. Where a secrets-practice sentence here conflicts with it, follow
the standard and record the conflict.
2. **`spec/ActiveSecretsManagementCanon_v0.3.md`** — estate doctrine Gate House still
owns: invariants `INV-01`…`INV-12`, operating modes, and assurance tests
`T-01`…`T-10`. It is no longer the secrets best-practice guide. Its banner says
so. Controls that restate secrets practice yield to `SEC-DSM`.
3. **`INTENT.md`** — mission, scope boundaries, domain concepts, the 15 numbered Core Rules,
use cases `UC-01`…`UC-05`, success criteria. This is the "why".
3. **`decisions/decisions.md`** — decision records. GH-DEC-2026-001 ratifies the layer
4. **`decisions/decisions.md`** — decision records. GH-DEC-2026-001 ratifies the layer
model, the re-cut, and the access-engine reframing. Binding.
4. **`ArchitectureBlueprint.md`** — the current doctrine architecture: responsibility
5. **`ArchitectureBlueprint.md`** — the current doctrine architecture: responsibility
boundaries, domain model, authority context, operating modes, posture and credential
contracts, MCP doctrine, change dynamics, audit, invariants, and conformance. The
withdrawn v0.1 authority-plane design is mapped in
`history/2026-09-01-authority-plane-blueprint-retirement.md` and remains available at
Git object `75ce372:ArchitectureBlueprint.md` for historical review only.
5. **`README.md`** — public-facing summary. A derivative, not a source of truth.
6. **`README.md`** — public-facing summary. A derivative, not a source of truth.
When these conflict: the decision record wins over everything, then the Canon, then INTENT,
then the Blueprint. Fix the lower document rather than diverging.
When these conflict: the decision record wins over everything. For secrets
practice, `SEC-DSM` then wins over the ASM canon. For estate invariants, modes,
and assurance tests, the ASM canon wins over INTENT. Then the Blueprint. Fix the
lower document rather than diverging.
## The doctrine Gate House maintains
@ -133,8 +142,9 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the
## Where new work goes
- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root. External
standards Gate House conforms to — the Canon — live in `spec/`.
- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root. The
secrets best-practice guide is SecurityCanon `SEC-DSM`, outside this repo. Estate
doctrine that Gate House still authors — the ASM canon — lives in `spec/`.
- ADRs → `docs/adr/`, with disposition recorded in Blueprint §17. ADR-003
(policy engine selection) has lapsed with the re-cut; ADR-001, ADR-002,
ADR-006, ADR-009, ADR-010, ADR-013, ADR-014 remain meaningful as contract and

10
INTENT.md
View file

@ -162,9 +162,13 @@ whether they may. Gate House owns neither, and says so here because the word
## What Gate House Owns
- **The doctrine.** The Active Secrets Management Canon, its invariants, and
the argument behind them. Invariants graduate into
`net-kingdom/canon/standards/` as they stabilize; the working canon lives here.
- **The doctrine.** Estate invariants, operating modes, and the argument behind
them. The secrets best-practice guide is SecurityCanon `SEC-DSM` 1.0.0
(`security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`).
Gate House teaches it to ops-mason and ops-warden and does not edit it.
Invariants graduate into `net-kingdom/canon/standards/` as they stabilize.
The Active Secrets Management Canon v0.3 remains the working estate canon for
what `SEC-DSM` does not cover.
- **The authority context schema.** The vocabulary of an agentic authority
request — principal, actor, runtime identity, tenant, environment, mandate,
task, operating mode — defined here and consumed by access-engine as input

18
README.md
View file

@ -2,9 +2,13 @@
**The council where NetKingdom's security and defence doctrine is established, documented, taught, and supervised.**
Gate House is a NetKingdom **Staff**-layer repository and the home of the
Active Secrets Management (ASM) Canon. It is the headquarters of the
operational staff that does the chores of IT security in NetKingdom.
Gate House is a NetKingdom **Staff**-layer repository. It teaches and supervises
security doctrine. From 2026-10-11 the secrets best-practice guide is
SecurityCanon's DevOps Secrets Management Standard (`SEC-DSM` 1.0.0), at
`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`.
The Active Secrets Management (ASM) Canon v0.3 remains the estate doctrine for
invariants, operating modes, and assurance tests. Gate House is the headquarters
of the operational staff that does the chores of IT security in NetKingdom.
A word about the name, because it argues the other way. A gate house sounds
like the thing requests pass through. It is not. In a real castle the gate
@ -68,8 +72,9 @@ The boundary, in one line:
## What Gate House owns
- **The doctrine** — the ASM Canon, its invariants, and the argument behind
them. Invariants graduate into `net-kingdom/canon/standards/`.
- **The doctrine** — estate invariants, operating modes, and the argument behind
them. Secrets practice is taught from SecurityCanon `SEC-DSM`, not reinvented
here. Invariants graduate into `net-kingdom/canon/standards/`.
- **The authority context** — principal, actor, runtime identity, tenant,
environment, mandate, task, operating mode. Defined here, consumed by
access-engine as input claims.
@ -181,7 +186,8 @@ gate-house asserts an invariant
|---|---|
| [`INTENT.md`](INTENT.md) | why this repository exists; the re-cut in full |
| [`SCOPE.md`](SCOPE.md) | in scope / out of scope |
| [`spec/ActiveSecretsManagementCanon_v0.3.md`](spec/ActiveSecretsManagementCanon_v0.3.md) | the working canon — invariants, controls, profiles, assurance tests |
| [SecurityCanon DevOps Secrets Management Standard](../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md) | the secrets best-practice guide (`SEC-DSM` 1.0.0) |
| [`spec/ActiveSecretsManagementCanon_v0.3.md`](spec/ActiveSecretsManagementCanon_v0.3.md) | estate doctrine — invariants, operating modes, assurance tests |
| [`docs/contracts/authority-context.md`](docs/contracts/authority-context.md) | normative authority-context vocabulary consumed by access-engine |
| [`docs/assurance/asm-t01-t10-executable-targets.md`](docs/assurance/asm-t01-t10-executable-targets.md) | executable assurance targets handed to whitehat-security |
| [`docs/conformance/`](docs/conformance/) | Gate House dispositions for returned assurance and posture reports |

7
SCOPE.md
View file

@ -11,9 +11,10 @@ authorization decision.
## In scope
- **doctrine** — the Active Secrets Management Canon, its invariants, and the
argument behind them; doctrine graduates into `net-kingdom/canon/standards/`
as it stabilizes
- **doctrine** — estate invariants, operating modes, and the argument behind
them. The secrets best-practice guide is SecurityCanon `SEC-DSM` 1.0.0, which
Gate House teaches and does not edit. Doctrine that stabilizes here graduates
into `net-kingdom/canon/standards/`
- the **authority context schema** — what must be *sayable* about an agentic
authority request (principal, actor, runtime identity, tenant, environment,
mandate, task, operating mode), consumed by access-engine as input claims

36
history/2026-10-11-sec-dsm-practice-guide.md Normal file
View file

@ -0,0 +1,36 @@
# 2026-10-11 — SEC-DSM is the secrets best-practice guide
The repository owner inserted DevOps Secrets Management Canon v1.0 into
security-canon as `SEC-DSM` 1.0.0
(`security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`,
decision SECURITY-DEC-2026-004) and asked Gate House to use that standard as
the best-practice guide from now on, with ops-mason and ops-warden guided by it.
## What changed
- Secrets practice — preference hierarchy, decision procedure Q1–Q5, and the
`DSM-*` requirements — is read from `SEC-DSM`. Gate House teaches it and does
not edit it.
- `spec/ActiveSecretsManagementCanon_v0.3.md` stays the estate doctrine for
`INV-01`…`INV-12`, assistant and autonomous modes, and assurance tests
`T-01`…`T-10`. Secrets-practice controls in that file yield to `SEC-DSM`
where they differ.
- ops-mason construction plans must answer Q1–Q5 before proposing a new
credential. ops-warden routes inside the same hierarchy and still does not
take custody of static secrets. SSH certificates remain the short-lived path
ops-warden actually issues.
## What did not move
Custody and issuance stay with secrets-engine. Authorization stays with
access-engine. Route construction stays with ops-mason. Lane operation stays
with ops-warden. The layer maxim is unchanged: cognition proposes, authority
disposes, infrastructure executes.
## Staff reading
| Role | Follow first |
| --- | --- |
| ops-mason, when designing a route | `SEC-DSM` §5 preference hierarchy, §37 decision procedure, §35 OpenBao mapping, §36 Kubernetes mapping, `DSM-ARCH-001` through `DSM-ARCH-004`, `DSM-TRANS-003` |
| ops-warden, when operating a lane | `SEC-DSM` §5 and §37, `DSM-DELIV-*`, `DSM-HUM-001`, `DSM-AUDIT-002`, `DSM-AP-020`. Issue SSH certificates as ephemeral credentials. Do not become the store. |
| Gate House | Teach the standard. Keep ASM v0.3 for modes, invariants, and assurance. Record conflicts; do not fork the standard. |

11
spec/ActiveSecretsManagementCanon_v0.3.md
View file

@ -1,10 +1,19 @@
# Active Secrets Management Canon
**Version:** 0.3
**Status:** Working Canon / Review Draft
**Status:** Estate doctrine — no longer the secrets best-practice guide
**Date:** 2026-08-24
**Scope:** Human, agent-assisted, and autonomous development and operations environments
> **Practice guide.** From 2026-10-11, secrets practice follows SecurityCanon
> `SEC-DSM` 1.0.0:
> `security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`.
> This document remains Gate House's estate doctrine for invariants `INV-01`…`INV-12`,
> assistant and autonomous modes, and assurance tests `T-01`…`T-10`. Where a
> control below restates how a secret should be avoided, issued, stored,
> delivered, rotated, or revoked, `SEC-DSM` wins. Do not edit `SEC-DSM` to match
> this file. See `history/2026-10-11-sec-dsm-practice-guide.md`.
---
## 1. Purpose