coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(reuse): establish reviewed NetKingdom security capabilities

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
tegwick 2026-10-14 06:39:53 +02:00
parent 1344fc80e5
commit 61ee563b1f
2 changed files with 77 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

125
registry/capabilities/capability.iam.key-cape.md
View file

@ -1,9 +1,7 @@
--- ---
id: capability.iam.key-cape id: capability.iam.key-cape
name: KeyCape Lightweight IAM (NetKingdom Profile) name: OIDC identity and assurance
summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.
orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against
implementation internals.
owner: key-cape owner: key-cape
status: draft status: draft
domain: infotech domain: infotech
@ -12,20 +10,23 @@ tags:
- oidc - oidc
- netkingdom - netkingdom
- security - security
- framework-reuse
maturity: maturity:
discovery: discovery:
current: D4 current: D4
target: D5 target: D5
confidence: high confidence: high
rationale: README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), rationale: README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md),
explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status explicit lightweight-vs-expanded (Keycloak) migration story, and a completed
(all 23 workplan tasks, 21 green test packages). implementation status (all 23 workplan tasks, 21 green test packages).
availability: availability:
current: A2 current: A4
target: A3 target: A4
confidence: high confidence: high
rationale: README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/` rationale: 'Source interface assessed 2026-10-14: OIDC code with PKCE, service
CI already in place — ahead of most siblings on the Forgejo transition. tokens, JWKS, MFA and caller CLI. Availability describes the delivery form,
not production acceptance. Current stack is Authelia, LLDAP and privacyIDEA;
service secrets remain static and recovery proof has open gates.'
external_evidence: external_evidence:
completeness: completeness:
level: C2 level: C2
@ -42,36 +43,46 @@ external_evidence:
confidence: low confidence: low
basis: consumer_quality_signals basis: consumer_quality_signals
known_reliability_risks: known_reliability_risks:
- maturity claims rely on the repo's own workplan completion record, not independently re-verified - maturity claims rely on the repo's own workplan completion record, not independently
in this sweep re-verified in this sweep
discovery: discovery:
intent: Let applications integrate against a versioned IAM profile contract rather than against Keycape intent: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI
internals, so migrating from lightweight (Authelia/LLDAP/privacyIDEA) to expanded (Keycloak) mode
is a tested operation, not a rewrite.
includes: includes:
- NetKingdom IAM Profile v0.2 lightweight-mode orchestration (Authelia, LLDAP, privacyIDEA) - OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI
- profile-contract conformance
excludes: excludes:
- expanded-mode (Keycloak) implementation itself (separate deployment target for the same profile) - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static
and recovery proof has open gates
assumptions: [] assumptions: []
use_cases: [] use_cases:
- 'U02: Human signs in with MFA and manages account or factor recovery'
- 'U03: Application combines identity, tenant and resource facts and enforces a
bound decision'
- 'U04: Protected operation obtains and consumes exact human approval before its
side effect'
- 'U10: Operator recovers identity, custody or data with independently held recovery
material'
research_memos: [] research_memos: []
availability: availability:
current_level: A2 current_level: A4
target_level: A3 target_level: A4
current_artifacts: current_artifacts:
- deployable lightweight-mode IAM stack - SCOPE.md
- README.md
target_artifacts: [] target_artifacts: []
consumption_modes: consumption_modes:
- service (self-hosted deployment) - HTTP API
- source
relations: relations:
depends_on: [] depends_on: []
supports: [] supports: []
related_to: [] related_to:
- capability.identity.user-engine
- capability.identity.tenant-facts
- capability.authorization.policy-evaluate
evidence: evidence:
documentation: documentation:
- SCOPE.md
- README.md - README.md
- workplans/KEY-WP-0001-keycape-implementation.md
tests: tests:
- .gitea/workflows/ - .gitea/workflows/
- .forgejo/workflows/ - .forgejo/workflows/
@ -80,46 +91,48 @@ evidence:
incidents: [] incidents: []
consumer_guidance: consumer_guidance:
recommended_for: recommended_for:
- NetKingdom deployments wanting a lightweight, self-hosted IAM profile implementation with a tested - Human signs in with MFA and manages account or factor recovery
migration path to Keycloak - Application combines identity, tenant and resource facts and enforces a bound
decision
- Protected operation obtains and consumes exact human approval before its side
effect
- Operator recovers identity, custody or data with independently held recovery material
not_recommended_for: not_recommended_for:
- deployments already committed to expanded/Keycloak mode - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static
and recovery proof has open gates
known_limitations: known_limitations:
- v0.1 completion claim not independently re-verified during this coverage sweep - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static
promotion_history: [] and recovery proof has open gates
- 2026-10-14 architecture review estimates operational maturity separately; a registry
entry does not authorize execution or establish deployment.
promotion_history:
- date: '2026-10-14'
dimension: availability
from: A2
to: A4
rationale: Interface-form reassessment from current owner sources; no completeness/reliability
promotion.
author: codex
--- ---
# KeyCape Lightweight IAM (NetKingdom Profile) # OIDC identity and assurance
## Overview OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.
KeyCape is the lightweight IAM component of NetKingdom, implementing the versioned NetKingdom IAM Profile (OIDC/PKCE) by orchestrating Authelia, LLDAP, and privacyIDEA — the same profile Keycloak implements in expanded-mode deployments, so migration is a tested operation rather than a rewrite. ## Reuse boundary
## Assessment notes Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates.
### Discovery ## Supported use cases
README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status (all 23 workplan tasks, 21 green test packages). - U02: Human signs in with MFA and manages account or factor recovery
- U03: Application combines identity, tenant and resource facts and enforces a bound decision
- U04: Protected operation obtains and consumes exact human approval before its side effect
- U10: Operator recovers identity, custody or data with independently held recovery material
### Availability ## Evidence and integration
README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/` CI already in place — ahead of most siblings on the Forgejo transition. - [SCOPE.md](../../SCOPE.md)
- [README.md](../../README.md)
### Completeness Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

16
registry/indexes/capabilities.yaml
View file

@ -1,21 +1,21 @@
version: 1 version: 1
updated: '2026-07-06' updated: '2026-10-14'
domain: helix_forge domain: helix_forge
capabilities: capabilities:
- id: capability.iam.key-cape - id: capability.iam.key-cape
name: KeyCape Lightweight IAM (NetKingdom Profile) name: OIDC identity and assurance
summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.
orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not
against implementation internals.
vector: D4 / A2 / C2 / R1
domain: infotech domain: infotech
status: draft status: draft
owner: key-cape owner: key-cape
path: registry/capabilities/capability.iam.key-cape.md
tags: tags:
- iam - iam
- oidc - oidc
- netkingdom - netkingdom
- security - security
- framework-reuse
vector: D4 / A4 / C2 / R1
path: registry/capabilities/capability.iam.key-cape.md
consumption_modes: consumption_modes:
- service (self-hosted deployment) - HTTP API
- source