From 61ee563b1ff7f027527ea0c6d5b0e305ed66e5f0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 14 Oct 2026 06:39:53 +0200 Subject: [PATCH] docs(reuse): establish reviewed NetKingdom security capabilities Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684 --- .../capabilities/capability.iam.key-cape.md | 125 ++++++++++-------- registry/indexes/capabilities.yaml | 16 +-- 2 files changed, 77 insertions(+), 64 deletions(-) diff --git a/registry/capabilities/capability.iam.key-cape.md b/registry/capabilities/capability.iam.key-cape.md index 0c096ec..59cc40e 100644 --- a/registry/capabilities/capability.iam.key-cape.md +++ b/registry/capabilities/capability.iam.key-cape.md @@ -1,9 +1,7 @@ --- id: capability.iam.key-cape -name: KeyCape Lightweight IAM (NetKingdom Profile) -summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), - orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against - implementation internals. +name: OIDC identity and assurance +summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. owner: key-cape status: draft domain: infotech @@ -12,20 +10,23 @@ tags: - oidc - netkingdom - security +- framework-reuse maturity: discovery: current: D4 target: D5 confidence: high rationale: README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), - explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status - (all 23 workplan tasks, 21 green test packages). + explicit lightweight-vs-expanded (Keycloak) migration story, and a completed + implementation status (all 23 workplan tasks, 21 green test packages). availability: - current: A2 - target: A3 + current: A4 + target: A4 confidence: high - rationale: README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/` - CI already in place — ahead of most siblings on the Forgejo transition. + rationale: 'Source interface assessed 2026-10-14: OIDC code with PKCE, service + tokens, JWKS, MFA and caller CLI. Availability describes the delivery form, + not production acceptance. Current stack is Authelia, LLDAP and privacyIDEA; + service secrets remain static and recovery proof has open gates.' external_evidence: completeness: level: C2 @@ -42,36 +43,46 @@ external_evidence: confidence: low basis: consumer_quality_signals known_reliability_risks: - - maturity claims rely on the repo's own workplan completion record, not independently re-verified - in this sweep + - maturity claims rely on the repo's own workplan completion record, not independently + re-verified in this sweep discovery: - intent: Let applications integrate against a versioned IAM profile contract rather than against Keycape - internals, so migrating from lightweight (Authelia/LLDAP/privacyIDEA) to expanded (Keycloak) mode - is a tested operation, not a rewrite. + intent: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI includes: - - NetKingdom IAM Profile v0.2 lightweight-mode orchestration (Authelia, LLDAP, privacyIDEA) - - profile-contract conformance + - OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI excludes: - - expanded-mode (Keycloak) implementation itself (separate deployment target for the same profile) + - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static + and recovery proof has open gates assumptions: [] - use_cases: [] + use_cases: + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' research_memos: [] availability: - current_level: A2 - target_level: A3 + current_level: A4 + target_level: A4 current_artifacts: - - deployable lightweight-mode IAM stack + - SCOPE.md + - README.md target_artifacts: [] consumption_modes: - - service (self-hosted deployment) + - HTTP API + - source relations: depends_on: [] supports: [] - related_to: [] + related_to: + - capability.identity.user-engine + - capability.identity.tenant-facts + - capability.authorization.policy-evaluate evidence: documentation: + - SCOPE.md - README.md - - workplans/KEY-WP-0001-keycape-implementation.md tests: - .gitea/workflows/ - .forgejo/workflows/ @@ -80,46 +91,48 @@ evidence: incidents: [] consumer_guidance: recommended_for: - - NetKingdom deployments wanting a lightweight, self-hosted IAM profile implementation with a tested - migration path to Keycloak + - Human signs in with MFA and manages account or factor recovery + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator recovers identity, custody or data with independently held recovery material not_recommended_for: - - deployments already committed to expanded/Keycloak mode + - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static + and recovery proof has open gates known_limitations: - - v0.1 completion claim not independently re-verified during this coverage sweep -promotion_history: [] + - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static + and recovery proof has open gates + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A2 + to: A4 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex --- -# KeyCape Lightweight IAM (NetKingdom Profile) +# OIDC identity and assurance -## Overview +OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. -KeyCape is the lightweight IAM component of NetKingdom, implementing the versioned NetKingdom IAM Profile (OIDC/PKCE) by orchestrating Authelia, LLDAP, and privacyIDEA — the same profile Keycloak implements in expanded-mode deployments, so migration is a tested operation rather than a rewrite. +## Reuse boundary -## Assessment notes +Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates. -### Discovery +## Supported use cases -README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status (all 23 workplan tasks, 21 green test packages). +- U02: Human signs in with MFA and manages account or factor recovery +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U10: Operator recovers identity, custody or data with independently held recovery material -### Availability +## Evidence and integration -README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/` CI already in place — ahead of most siblings on the Forgejo transition. +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) -### Completeness - -First-pass honest assessment from the REUSE-WP-0017 coverage campaign -(reuse-surface). No external consumer feedback exists yet; levels reflect -scope-vs-intent documentation quality, not internal code quality. - -### Reliability - -No production consumer telemetry exists yet; reliability level is -intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. - -## Promotion checklist - -- [x] ID follows `capability..` pattern -- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` -- [x] `external_evidence` is populated separately from `maturity` -- [ ] Relations reference valid capability IDs (none yet) -- [x] Index entry added in `registry/indexes/capabilities.yaml` +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index af664bf..0718f52 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,21 +1,21 @@ version: 1 -updated: '2026-07-06' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.iam.key-cape - name: KeyCape Lightweight IAM (NetKingdom Profile) - summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), - orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not - against implementation internals. - vector: D4 / A2 / C2 / R1 + name: OIDC identity and assurance + summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. domain: infotech status: draft owner: key-cape - path: registry/capabilities/capability.iam.key-cape.md tags: - iam - oidc - netkingdom - security + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.iam.key-cape.md consumption_modes: - - service (self-hosted deployment) + - HTTP API + - source