coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add bounded resource audiences and enforce browser scope grants
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b
This commit is contained in:
tegwick 2026-09-05 00:41:17 +02:00
parent b8dda4115a
commit 403904b901
22 changed files with 449 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

24
INTENT.md
View file

@ -1,19 +1,15 @@
# INTENT
> **NetKingdom layering review — 2026-08-28.** This repository's role was reviewed
> against the NetKingdom IT-security layer model: **Taxonomy → Tooling → Engines →
> Staff**, layered by determinism and by the kind of artifact each layer produces.
> Findings and the argument behind them:
> `gate-house/history/2026-08-28-security-layer-model-and-gate-house-recut.md`.
> The model is `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed),
> ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001.
>
> The layer rule that binds every repository: **Staff never touches tooling
> directly. It acts only through engine APIs.**
>
> **This repository is Tooling — deterministic infrastructure and state.** State the layer: key-cape packages the third-party identity tooling (authelia, lldap, privacy-idea) behind a versioned IAM profile. It owns authentication and identity claims only. Because "auth" is ambiguous across the estate, this INTENT should say explicitly that key-cape is **not** an authorization decision point — that is access-engine's, and it stays the only one.
>
> *This note records what should change. The body below is not yet adapted.*
KeyCape declares its layer as **Tooling** under the NetKingdom security layer
model v0.4. It provides deterministic authentication and identity claims through
the versioned IAM profile, packaging Authelia, LLDAP, and privacyIDEA.
Authorization decisions belong to access-engine; KeyCape is not an authorization
decision point. Issuing a role or scope claim does not decide access to a resource.
These backend components are implementation dependencies of KeyCape's tooling
boundary. Separate catalog entries are unnecessary until they expose independently
owned estate capabilities. Staff integration follows engine APIs as required by
the layer model; this declaration does not certify every existing caller path.
## Purpose