tegwick
62c6399ddd
Four returns arrived overnight, two of them corrections to rules written yesterday. Both corrections are right. A-16 GAINS A RIDER. informed-decision pointed out the rule is silent on who writes the route marker, and the guarantee is only as good as that party's independence from what the marker asserts. Its own instance is the weak one: erased versus never-held is written by the party the evidence is about, so A-16 there reduces to a self-attestation and GH-DEC-2026-014 section 4 narrows it without removing it. Without the rider A-16 becomes the thing it exists to prevent — a sound check read as establishing a property it does not carry. The four instances are now graded by marker independence rather than listed as equals. A-17 GAINS A PRECONDITION. It asks which way a case fails, which is unanswerable where the case cannot be seen. Their commitment-only path had no failure direction at all as proposed: a reviewer got a blank, indistinguishable from erased, withheld, lost and never held. GH-DEC-2026-014 section 4 did not test the direction of failure, it manufactured one — the right outcome reached without noticing it was a different operation. So making the distinguishing case observable is a precondition of applying A-17, not an outcome of it, and A-17 therefore depends on A-16. Neither dependency was noticed when both were written a day apart. GH-DEC-2026-015 revises GH-DEC-2026-012 R3. approval-engine recommended exactly the option we refused, informed-decision could not comply with both, changed nothing, and raised it as a finding rather than choosing — having previously offered to let approval-engine settle R3 and declined to take that route twice. Nesting is permitted for this pair. The cycle objection needed mutual containment and approval-engine's digest structurally excludes presentation material for an independent reason. But the decisive ground is that the original ruling worked against its own rule: R3 forbade recomputing the other layer's digest from one's own vocabulary, and co-reference by identifier left informed-decision canonicalizing principal and target, two of the five fields in that digest. Nesting removes the duplication; co-reference manages it. We reached for the management option while stating the rule that recommends removal. Conditioned on approval-engine making the exclusion normative and tested rather than intentional, because the cycle cannot arise here is a belief and the cycle may not arise here is a rule with an owner — A-17's precondition applied to our own permission. The ordering objection is withdrawn as mistaken and the withdrawal is recorded: a cost accepted from the requester and never checked is how a wrong reason survives into a ruling. GH-DEC-2026-016 rules NC-03, which both repositories referred up and neither benefits from. Where an approval is declared as discharging a human-in-the-loop control, the approver must be a human principal and approval-engine must refuse at bind time rather than record it. Recording the principal type is the auditable half and stops nothing; an approval control satisfiable by the same class of actor it exists to check is theatre. Scoped to declared approvals, declared at issue and never inferred, on approval-engine's own pdp_path shape. One surface enforcing it is not the property being held — the guarantee would read as human-approved unless someone used a different client. Section 5 leaves what makes a principal human to the identity layer and notes it inherits A-16: refusing a service principal while accepting an unverified assertion of humanity moves the defect rather than closing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm Assistant: claude-code Assistant-Model: opus Assistant-Process: 1754332@bnt-lap001 Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
202 lines
9.6 KiB
Markdown
202 lines
9.6 KiB
Markdown
# Gate House
|
|
|
|
**The council where NetKingdom's security and defence doctrine is established, documented, taught, and supervised.**
|
|
|
|
Gate House is a NetKingdom **Staff**-layer repository and the home of the
|
|
Active Secrets Management (ASM) Canon. It is the headquarters of the
|
|
operational staff that does the chores of IT security in NetKingdom.
|
|
|
|
A word about the name, because it argues the other way. A gate house sounds
|
|
like the thing requests pass through. It is not. In a real castle the gate
|
|
house is where the guard is quartered, the watch is set, and the porter's rules
|
|
are posted — the rules of entry are decided there, and the gate itself is held
|
|
by someone else.
|
|
|
|
> **Gate House does not stand in the gate. It decides what the gate is for, who
|
|
> may be asked to open it, and how we know it held.**
|
|
|
|
Its artifacts are specifications, decisions, workplans, and tasks. It holds no
|
|
runtime position, renders no authorization decision, and stores no state that
|
|
anything depends on at runtime.
|
|
|
|
---
|
|
|
|
## Where it sits
|
|
|
|
NetKingdom's IT security is layered by determinism and by the kind of artifact
|
|
each layer produces — see
|
|
[`net-kingdom/canon/standards/security-layer-model_v0.7.md`](../net-kingdom/canon/standards/security-layer-model_v0.7.md).
|
|
|
|
```text
|
|
Taxonomy cross-cutting language info-tech-canon, net-kingdom canon
|
|
Tooling deterministic state key-cape (authelia, lldap, privacy-idea), OpenBao
|
|
Engines deterministic APIs user / tenant / zone / secrets / access-engine
|
|
Staff interactive, non-deterministic gate-house, ops-mason, ops-warden,
|
|
kings-guard, whitehat-security
|
|
```
|
|
|
|
Read by determinism, those layers reproduce the Canon's three planes — which is
|
|
the point:
|
|
|
|
> **Cognition proposes. Authority disposes. Infrastructure executes.**
|
|
|
|
The rule that binds every repository:
|
|
|
|
> **Staff never touches Tooling directly. It acts only through Engine APIs.**
|
|
|
|
## Why Gate House is not the decision point
|
|
|
|
Gate House was seeded as a deterministic authority plane — an `/authorize` API,
|
|
grant storage, a revocation service. That was withdrawn on its own argument:
|
|
|
|
> **A decision point inside Gate House would place the deterministic authority
|
|
> boundary inside the non-deterministic management layer, violating INV-02, "No
|
|
> Privilege from Cognition" — the first invariant this repository exists to
|
|
> defend.**
|
|
|
|
NetKingdom already has a policy decision point: `access-engine` (currently
|
|
`flex-auth`). It stays the only one. Gate House writes the doctrine that
|
|
decision point implements, and checks that it did.
|
|
|
|
The boundary, in one line:
|
|
|
|
> **The mandate and the operating mode are Gate House's. The decision is
|
|
> access-engine's. The credential is secrets-engine's. The perimeter is
|
|
> ops-mason's and ops-warden's.**
|
|
|
|
---
|
|
|
|
## What Gate House owns
|
|
|
|
- **The doctrine** — the ASM Canon, its invariants, and the argument behind
|
|
them. Invariants graduate into `net-kingdom/canon/standards/`.
|
|
- **The authority context** — principal, actor, runtime identity, tenant,
|
|
environment, mandate, task, operating mode. Defined here, consumed by
|
|
access-engine as input claims.
|
|
- **The agentic operating modes** — assistant and autonomous as distinct
|
|
security regimes.
|
|
- **Mandates, authority ceilings, and kill switches** for autonomous actors, as
|
|
a model and a governance obligation.
|
|
- **The Change Dynamics Envelope** — how much change the organization tolerates.
|
|
- **The MCP doctrine** — tool availability is not permission.
|
|
- **The posture contract** with kings-guard, including its asymmetry.
|
|
- **Conformance review** — whether authority in practice matches the declared
|
|
mandate and ceiling.
|
|
- **The assurance specifications** T-01…T-10, executed by whitehat-security.
|
|
- **The security curriculum.**
|
|
|
|
## What Gate House does not own
|
|
|
|
The authorization decision or any `/authorize` surface; policy engines,
|
|
packages, or rollout; grants, credentials, leases, or revocation; identity,
|
|
tenancy, zone, or user lifecycle; secret storage or PKI; anomaly detection or
|
|
threat intelligence; access lanes, SSH certificates, or host hardening;
|
|
deployment or remediation execution; and other repositories' workplans.
|
|
|
|
| Component | Layer | Responsibility |
|
|
|---|---|---|
|
|
| info-tech-canon | Taxonomy | ecosystem-wide semantic contracts |
|
|
| net-kingdom | Taxonomy | NetKingdom standards of record |
|
|
| key-cape | Tooling | packaged identity tooling; IAM profile; authentication |
|
|
| OpenBao | Tooling | secret storage, leases, PKI |
|
|
| user-engine | Engine | users, accounts, memberships |
|
|
| tenant-engine | Engine | tenant-as-an-entity facts |
|
|
| zone-engine | Engine | zone identity and membership |
|
|
| secrets-engine | Engine | credential abstraction, custody, lifecycle |
|
|
| **access-engine** | Engine | **the decision — the only decision point** |
|
|
| **gate-house** | **Staff** | **doctrine, authority context, conformance, curriculum** |
|
|
| ops-mason | Staff | builds and tears down access routes and perimeters |
|
|
| ops-warden | Staff | operational access lanes, stewardship, runbooks |
|
|
| kings-guard | Staff | adaptive defence, observation, containment |
|
|
| whitehat-security | Staff | offensive validation |
|
|
|
|
Two words that must not drift: **ops-warden and ops-mason own access lanes** —
|
|
how a worker reaches a host. **access-engine owns access rules** — whether they
|
|
may.
|
|
|
|
---
|
|
|
|
## The doctrine in seventeen lines
|
|
|
|
1. No privilege from cognition.
|
|
2. Every privileged action crosses a deterministic authority boundary.
|
|
3. Tool availability is not permission.
|
|
4. Principal and actor remain distinguishable.
|
|
5. Assistant and autonomous operation are different security modes.
|
|
6. Autonomous agents use independent identities and explicit mandates.
|
|
7. Authority is least-privileged, scoped, and time-bounded.
|
|
8. Delegation attenuates.
|
|
9. Security posture may reduce authority but must not expand it.
|
|
10. Emergency revocation works without agent cooperation.
|
|
11. Agents do not casually modify the policies defining their own ceiling.
|
|
12. Credentials are ephemeral implementation artifacts of authorization.
|
|
13. Audit evidence is protected from the actor being audited.
|
|
14. Failure of critical policy or authorization dependencies fails closed.
|
|
15. Production guarantees must survive incorrect agent behavior.
|
|
16. Where one appearance is reachable by two routes, the record says which route.
|
|
17. A transitional deviation is admissible only where it fails closed on the case that distinguishes it from the conformant state.
|
|
|
|
The last two are September 2026 and are repository-level, not estate doctrine. 16
|
|
is why an `unknown` and an `absent` stance cell must be told apart in the record
|
|
even though both fail closed, and why a decision envelope that looks authentic is
|
|
not therefore attributable. 17 is why one request for transitional relief was
|
|
granted and another declined in the same week. Both were corrected within a day of
|
|
being written, by the repository that bears their weakest instance: 16 holds only
|
|
as far as the marker-writer is independent of what the marker asserts, and 17
|
|
cannot be applied at all until the distinguishing case is observable. See
|
|
`INTENT.md` § Core Rules.
|
|
|
|
## Agentic operating modes
|
|
|
|
The distinction Gate House exists to keep sharp.
|
|
|
|
**Assistant** — a human is engaged and can redirect or stop at human latency.
|
|
The human remains the principal; the agent remains a visible actor. *A human
|
|
disconnecting must never silently promote the session into autonomous
|
|
privileged operation.*
|
|
|
|
**Autonomous** — a scheduled or triggered agent acts without supervision, and
|
|
therefore requires unique identity, a named owner, an explicit mandate, an
|
|
authority ceiling, runtime and concurrency limits, budgets, an independent kill
|
|
switch, and audit reconstruction.
|
|
|
|
## The conformance loop
|
|
|
|
Doctrine that no engine implements is fiction. Gate House is only real if this
|
|
turns:
|
|
|
|
```text
|
|
gate-house asserts an invariant
|
|
→ the engines implement it
|
|
→ whitehat-security tries to break it
|
|
→ kings-guard observes it in operation
|
|
→ findings return to gate-house as doctrine change
|
|
```
|
|
|
|
---
|
|
|
|
## Repository map
|
|
|
|
| Path | What it is |
|
|
|---|---|
|
|
| [`INTENT.md`](INTENT.md) | why this repository exists; the re-cut in full |
|
|
| [`SCOPE.md`](SCOPE.md) | in scope / out of scope |
|
|
| [`spec/ActiveSecretsManagementCanon_v0.3.md`](spec/ActiveSecretsManagementCanon_v0.3.md) | the working canon — invariants, controls, profiles, assurance tests |
|
|
| [`docs/contracts/authority-context.md`](docs/contracts/authority-context.md) | normative authority-context vocabulary consumed by access-engine |
|
|
| [`docs/assurance/asm-t01-t10-executable-targets.md`](docs/assurance/asm-t01-t10-executable-targets.md) | executable assurance targets handed to whitehat-security |
|
|
| [`docs/conformance/`](docs/conformance/) | Gate House dispositions for returned assurance and posture reports |
|
|
| [`docs/adr/`](docs/adr/) | architecture decisions for Gate House doctrine and contracts |
|
|
| [`ArchitectureBlueprint.md`](ArchitectureBlueprint.md) | current doctrine architecture and responsibility contracts |
|
|
| [`decisions/decisions.md`](decisions/decisions.md) | decision records — start with GH-DEC-2026-001 |
|
|
| [`history/`](history/) | reference notes; the 2026-08-28 review is the origin of the current shape |
|
|
| [`workplans/`](workplans/) | work in flight |
|
|
|
|
**Status.** Specification-only; no code, by design. `INTENT.md`, the decision
|
|
record, the canon standard, and `ArchitectureBlueprint.md` reflect the current
|
|
shape. The withdrawn authority-plane design is preserved under `history/` and
|
|
in Git, not in the working architecture.
|
|
|
|
---
|
|
|
|
> **Agents decide what to attempt. Engines decide what may cross the boundary.
|
|
> Gate House decides what the boundary is for.**
|