coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
gate-house/SCOPE.md
tegwick a97e7c8ee1 Register with repo-manager and add agent guidance 
Register gate-house as category: tooling, domain: infotech, workplan
prefix GH-WP, via rmgr scaffold. Baseline files: .repo-classification.yaml,
SCOPE.md, AGENTS.md, workplans/GH-WP-0001-foundation.md. rmgr conform
passes with no findings.

SCOPE.md is derived from INTENT.md; GH-WP-0001 targets milestone M0
(executable skeleton) from ArchitectureBlueprint.md §41.

Move ArchitectureBlueprint.md to the repository root, matching its own
reference layout (§32). spec/ retains the Active Secrets Management Canon,
the external standard Gate House conforms to.

Add CLAUDE.md documenting the document precedence (Canon → INTENT →
Blueprint → README), the load-bearing security invariants, the fixed
domain vocabulary, and the stable identifier scheme.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
2026-08-24 20:41:58 +02:00

1.7 KiB
Raw Blame History

Scope

Derived from INTENT.md. Gate House is deliberately narrow: it decides whether a requested action is authorized, and represents that decision as bounded, time-limited authority that downstream systems enforce.

In scope

  • deterministic authorization decisions (GRANT / DENY / REQUIRE_APPROVAL / DEFER)
  • principal / actor / runtime-identity separation
  • mandates, delegation, and attenuation
  • authority ceilings
  • tenant-, environment-, resource-, task-, and time-scoped grants
  • approval binding and step-up requirements
  • posture intake from King's Guard, restricting only
  • change-dynamics limits: quotas, budgets, concurrency, circuit breakers
  • credential-binding contract to Secrets Engine / OpenBao
  • emergency revocation independent of the actor
  • decision evidence, explainability, and protected audit
  • policy and decision versioning; fail-closed semantics

Out of scope

Owned elsewhere in NetKingdom — see the responsibility table in INTENT.md:

  • human identity lifecycle and memberships — User Engine
  • tenant and organizational boundaries — Tenant Engine
  • authentication and federation — Key Cape
  • credential abstraction and lifecycle orchestration — Secrets Engine
  • secret storage, PKI, leases, dynamic secret engines — OpenBao
  • operational execution — Ops Warden
  • construction, reconciliation, recovery — Ops Mason
  • anomaly detection, behavioral risk inference, security memory — King's Guard
  • adversarial testing and attack simulation — Whitehat Security

Also out of scope: inventing a new policy language, becoming an IAM suite, secret scanning, SIEM, autonomous remediation, and supporting every agent protocol. See "Non-Goals for the First Prototype" in ArchitectureBlueprint.md §3.