From bc890c4d050a2e726ce8988a8260ab9caea133e3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 23:41:30 +0200 Subject: [PATCH] Teach SEC-DSM as the secrets best-practice guide. Keep ASM v0.3 for estate invariants, operating modes, and assurance tests. Secrets-practice sentences yield to the security-canon standard. Assistant: grok Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4 --- ArchitectureBlueprint.md | 11 +++--- CLAUDE.md | 34 +++++++++++------- INTENT.md | 10 ++++-- README.md | 18 ++++++---- SCOPE.md | 7 ++-- history/2026-10-11-sec-dsm-practice-guide.md | 36 ++++++++++++++++++++ spec/ActiveSecretsManagementCanon_v0.3.md | 11 +++++- 7 files changed, 98 insertions(+), 29 deletions(-) create mode 100644 history/2026-10-11-sec-dsm-practice-guide.md diff --git a/ArchitectureBlueprint.md b/ArchitectureBlueprint.md index 498621e..3c38f4a 100644 --- a/ArchitectureBlueprint.md +++ b/ArchitectureBlueprint.md @@ -29,12 +29,15 @@ and the complete historical text remains available at Git object This document is subordinate, in order, to: 1. `decisions/decisions.md`; -2. `spec/ActiveSecretsManagementCanon_v0.3.md`; -3. `INTENT.md`; -4. the accepted NetKingdom security-layer standard. +2. SecurityCanon `SEC-DSM` 1.0.0, for secrets practice + (`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`); +3. `spec/ActiveSecretsManagementCanon_v0.3.md`, for estate invariants, operating + modes, and assurance tests; +4. `INTENT.md`; +5. the accepted NetKingdom security-layer standard. Where they conflict, the higher artifact wins and this Blueprint must be -corrected. +corrected. A secrets-practice sentence in the ASM canon yields to `SEC-DSM`. The architectural maxim is: diff --git a/CLAUDE.md b/CLAUDE.md index 19a0866..e514818 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -43,24 +43,33 @@ estate's layering rule: ## Document hierarchy — read in this order -1. **`spec/ActiveSecretsManagementCanon_v0.3.md`** — the normative standard Gate House - implements. Uses RFC-style MUST/SHOULD/MAY. Owns the numbered invariants `INV-01`…`INV-12` - and the assurance tests `T-01`…`T-10`. Gate House conforms to the Canon; the Canon is not - edited to accommodate Gate House. -2. **`INTENT.md`** — mission, scope boundaries, domain concepts, the 15 numbered Core Rules, +1. **SecurityCanon `SEC-DSM` 1.0.0** — + `../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`. + The secrets best-practice guide from 2026-10-11. Preference hierarchy, decision + procedure (Q1–Q5), and the `DSM-*` requirements. Gate House teaches it. ops-mason + builds to it. ops-warden operates lanes inside it. Do not edit the standard to + fit this estate. Where a secrets-practice sentence here conflicts with it, follow + the standard and record the conflict. +2. **`spec/ActiveSecretsManagementCanon_v0.3.md`** — estate doctrine Gate House still + owns: invariants `INV-01`…`INV-12`, operating modes, and assurance tests + `T-01`…`T-10`. It is no longer the secrets best-practice guide. Its banner says + so. Controls that restate secrets practice yield to `SEC-DSM`. +3. **`INTENT.md`** — mission, scope boundaries, domain concepts, the 15 numbered Core Rules, use cases `UC-01`…`UC-05`, success criteria. This is the "why". -3. **`decisions/decisions.md`** — decision records. GH-DEC-2026-001 ratifies the layer +4. **`decisions/decisions.md`** — decision records. GH-DEC-2026-001 ratifies the layer model, the re-cut, and the access-engine reframing. Binding. -4. **`ArchitectureBlueprint.md`** — the current doctrine architecture: responsibility +5. **`ArchitectureBlueprint.md`** — the current doctrine architecture: responsibility boundaries, domain model, authority context, operating modes, posture and credential contracts, MCP doctrine, change dynamics, audit, invariants, and conformance. The withdrawn v0.1 authority-plane design is mapped in `history/2026-09-01-authority-plane-blueprint-retirement.md` and remains available at Git object `75ce372:ArchitectureBlueprint.md` for historical review only. -5. **`README.md`** — public-facing summary. A derivative, not a source of truth. +6. **`README.md`** — public-facing summary. A derivative, not a source of truth. -When these conflict: the decision record wins over everything, then the Canon, then INTENT, -then the Blueprint. Fix the lower document rather than diverging. +When these conflict: the decision record wins over everything. For secrets +practice, `SEC-DSM` then wins over the ASM canon. For estate invariants, modes, +and assurance tests, the ASM canon wins over INTENT. Then the Blueprint. Fix the +lower document rather than diverging. ## The doctrine Gate House maintains @@ -133,8 +142,9 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the ## Where new work goes -- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root. External - standards Gate House conforms to — the Canon — live in `spec/`. +- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root. The + secrets best-practice guide is SecurityCanon `SEC-DSM`, outside this repo. Estate + doctrine that Gate House still authors — the ASM canon — lives in `spec/`. - ADRs → `docs/adr/`, with disposition recorded in Blueprint §17. ADR-003 (policy engine selection) has lapsed with the re-cut; ADR-001, ADR-002, ADR-006, ADR-009, ADR-010, ADR-013, ADR-014 remain meaningful as contract and diff --git a/INTENT.md b/INTENT.md index e2782fe..4e9bf96 100644 --- a/INTENT.md +++ b/INTENT.md @@ -162,9 +162,13 @@ whether they may. Gate House owns neither, and says so here because the word ## What Gate House Owns -- **The doctrine.** The Active Secrets Management Canon, its invariants, and - the argument behind them. Invariants graduate into - `net-kingdom/canon/standards/` as they stabilize; the working canon lives here. +- **The doctrine.** Estate invariants, operating modes, and the argument behind + them. The secrets best-practice guide is SecurityCanon `SEC-DSM` 1.0.0 + (`security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`). + Gate House teaches it to ops-mason and ops-warden and does not edit it. + Invariants graduate into `net-kingdom/canon/standards/` as they stabilize. + The Active Secrets Management Canon v0.3 remains the working estate canon for + what `SEC-DSM` does not cover. - **The authority context schema.** The vocabulary of an agentic authority request — principal, actor, runtime identity, tenant, environment, mandate, task, operating mode — defined here and consumed by access-engine as input diff --git a/README.md b/README.md index f2be8df..2aac6eb 100644 --- a/README.md +++ b/README.md @@ -2,9 +2,13 @@ **The council where NetKingdom's security and defence doctrine is established, documented, taught, and supervised.** -Gate House is a NetKingdom **Staff**-layer repository and the home of the -Active Secrets Management (ASM) Canon. It is the headquarters of the -operational staff that does the chores of IT security in NetKingdom. +Gate House is a NetKingdom **Staff**-layer repository. It teaches and supervises +security doctrine. From 2026-10-11 the secrets best-practice guide is +SecurityCanon's DevOps Secrets Management Standard (`SEC-DSM` 1.0.0), at +`../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`. +The Active Secrets Management (ASM) Canon v0.3 remains the estate doctrine for +invariants, operating modes, and assurance tests. Gate House is the headquarters +of the operational staff that does the chores of IT security in NetKingdom. A word about the name, because it argues the other way. A gate house sounds like the thing requests pass through. It is not. In a real castle the gate @@ -68,8 +72,9 @@ The boundary, in one line: ## What Gate House owns -- **The doctrine** — the ASM Canon, its invariants, and the argument behind - them. Invariants graduate into `net-kingdom/canon/standards/`. +- **The doctrine** — estate invariants, operating modes, and the argument behind + them. Secrets practice is taught from SecurityCanon `SEC-DSM`, not reinvented + here. Invariants graduate into `net-kingdom/canon/standards/`. - **The authority context** — principal, actor, runtime identity, tenant, environment, mandate, task, operating mode. Defined here, consumed by access-engine as input claims. @@ -181,7 +186,8 @@ gate-house asserts an invariant |---|---| | [`INTENT.md`](INTENT.md) | why this repository exists; the re-cut in full | | [`SCOPE.md`](SCOPE.md) | in scope / out of scope | -| [`spec/ActiveSecretsManagementCanon_v0.3.md`](spec/ActiveSecretsManagementCanon_v0.3.md) | the working canon — invariants, controls, profiles, assurance tests | +| [SecurityCanon DevOps Secrets Management Standard](../security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md) | the secrets best-practice guide (`SEC-DSM` 1.0.0) | +| [`spec/ActiveSecretsManagementCanon_v0.3.md`](spec/ActiveSecretsManagementCanon_v0.3.md) | estate doctrine — invariants, operating modes, assurance tests | | [`docs/contracts/authority-context.md`](docs/contracts/authority-context.md) | normative authority-context vocabulary consumed by access-engine | | [`docs/assurance/asm-t01-t10-executable-targets.md`](docs/assurance/asm-t01-t10-executable-targets.md) | executable assurance targets handed to whitehat-security | | [`docs/conformance/`](docs/conformance/) | Gate House dispositions for returned assurance and posture reports | diff --git a/SCOPE.md b/SCOPE.md index 2eccf22..4302807 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -11,9 +11,10 @@ authorization decision. ## In scope -- **doctrine** — the Active Secrets Management Canon, its invariants, and the - argument behind them; doctrine graduates into `net-kingdom/canon/standards/` - as it stabilizes +- **doctrine** — estate invariants, operating modes, and the argument behind + them. The secrets best-practice guide is SecurityCanon `SEC-DSM` 1.0.0, which + Gate House teaches and does not edit. Doctrine that stabilizes here graduates + into `net-kingdom/canon/standards/` - the **authority context schema** — what must be *sayable* about an agentic authority request (principal, actor, runtime identity, tenant, environment, mandate, task, operating mode), consumed by access-engine as input claims diff --git a/history/2026-10-11-sec-dsm-practice-guide.md b/history/2026-10-11-sec-dsm-practice-guide.md new file mode 100644 index 0000000..8beb20a --- /dev/null +++ b/history/2026-10-11-sec-dsm-practice-guide.md @@ -0,0 +1,36 @@ +# 2026-10-11 — SEC-DSM is the secrets best-practice guide + +The repository owner inserted DevOps Secrets Management Canon v1.0 into +security-canon as `SEC-DSM` 1.0.0 +(`security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`, +decision SECURITY-DEC-2026-004) and asked Gate House to use that standard as +the best-practice guide from now on, with ops-mason and ops-warden guided by it. + +## What changed + +- Secrets practice — preference hierarchy, decision procedure Q1–Q5, and the + `DSM-*` requirements — is read from `SEC-DSM`. Gate House teaches it and does + not edit it. +- `spec/ActiveSecretsManagementCanon_v0.3.md` stays the estate doctrine for + `INV-01`…`INV-12`, assistant and autonomous modes, and assurance tests + `T-01`…`T-10`. Secrets-practice controls in that file yield to `SEC-DSM` + where they differ. +- ops-mason construction plans must answer Q1–Q5 before proposing a new + credential. ops-warden routes inside the same hierarchy and still does not + take custody of static secrets. SSH certificates remain the short-lived path + ops-warden actually issues. + +## What did not move + +Custody and issuance stay with secrets-engine. Authorization stays with +access-engine. Route construction stays with ops-mason. Lane operation stays +with ops-warden. The layer maxim is unchanged: cognition proposes, authority +disposes, infrastructure executes. + +## Staff reading + +| Role | Follow first | +| --- | --- | +| ops-mason, when designing a route | `SEC-DSM` §5 preference hierarchy, §37 decision procedure, §35 OpenBao mapping, §36 Kubernetes mapping, `DSM-ARCH-001` through `DSM-ARCH-004`, `DSM-TRANS-003` | +| ops-warden, when operating a lane | `SEC-DSM` §5 and §37, `DSM-DELIV-*`, `DSM-HUM-001`, `DSM-AUDIT-002`, `DSM-AP-020`. Issue SSH certificates as ephemeral credentials. Do not become the store. | +| Gate House | Teach the standard. Keep ASM v0.3 for modes, invariants, and assurance. Record conflicts; do not fork the standard. | diff --git a/spec/ActiveSecretsManagementCanon_v0.3.md b/spec/ActiveSecretsManagementCanon_v0.3.md index 3a6f1e1..ca2af90 100644 --- a/spec/ActiveSecretsManagementCanon_v0.3.md +++ b/spec/ActiveSecretsManagementCanon_v0.3.md @@ -1,10 +1,19 @@ # Active Secrets Management Canon **Version:** 0.3 -**Status:** Working Canon / Review Draft +**Status:** Estate doctrine — no longer the secrets best-practice guide **Date:** 2026-08-24 **Scope:** Human, agent-assisted, and autonomous development and operations environments +> **Practice guide.** From 2026-10-11, secrets practice follows SecurityCanon +> `SEC-DSM` 1.0.0: +> `security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`. +> This document remains Gate House's estate doctrine for invariants `INV-01`…`INV-12`, +> assistant and autonomous modes, and assurance tests `T-01`…`T-10`. Where a +> control below restates how a secret should be avoided, issued, stored, +> delivered, rotated, or revoked, `SEC-DSM` wins. Do not edit `SEC-DSM` to match +> this file. See `history/2026-10-11-sec-dsm-practice-guide.md`. + --- ## 1. Purpose