Implement KeyCape provider and service identity contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

capabilities/playbooks/key-cape.lightweight-sso.yaml

@@ -0,0 +1,107 @@
+apiVersion: netkingdom.io/playbook-capability/v0.1
+kind: PlaybookCapabilityDeclaration
+metadata:
+  id: key-cape.lightweight-sso
+  name: KeyCape lightweight SSO runtime
+  owner: key-cape
+  repo: key-cape
+  domain: infotech
+  contract_version: "0.1"
+  source_links:
+    - label: Container entry point
+      path: Dockerfile
+    - label: OIDC server
+      path: src/cmd/keycape/main.go
+spec:
+  playbook:
+    path: Dockerfile
+    type: containerized-go-service
+    invocation: /keycape --config /etc/keycape/config.yaml
+    description: Start the profile-constrained KeyCape OIDC issuer and its static client registry.
+  capabilities:
+    - id: c1.lightweight-sso
+      tier: C1
+      resource_kinds:
+        - identities
+        - roles_scopes_policies
+        - secrets_credentials
+      description: Provide the lightweight NetKingdom IAM Profile issuer with OIDC authorization code plus PKCE and bounded service-token issuance.
+  parameters:
+    - name: config_path
+      type: string
+      required: false
+      default: /etc/keycape/config.yaml
+      sensitivity: secret_reference
+      tuning_authority: platform_only
+      description: Mounted KeyCape configuration path; secret values remain in the owning delivery system.
+    - name: issuer
+      type: string
+      required: false
+      default: https://kc.coulomb.social
+      constraints:
+        pattern: ^https://[^\n\r]+$
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Exact issuer used in discovery and every signed token.
+    - name: default_token_lifetime
+      type: string
+      required: false
+      default: 15m
+      constraints:
+        pattern: ^[1-9][0-9]*[smh]$
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Server default token lifetime; confidential clients may declare a shorter bounded lifetime.
+    - name: signing_key_path
+      type: string
+      required: false
+      default: /etc/keycape/key.pem
+      sensitivity: secret_reference
+      tuning_authority: platform_only
+      description: Mounted RS256 signing-key path; the declaration never carries key material.
+  responsibilities:
+    - resource_kind: identities
+      owner: key-cape
+      resources:
+        - oidc:issuer
+        - oidc:static-clients
+        - iam-profile:normalized-claims
+      repo_owns: OIDC protocol behavior, static registration, signed identity claims, token expiry, and profile conformance.
+      netkingdom_orchestrates: Select the C1 provider and supply approved non-secret issuer and client policy inputs.
+    - resource_kind: roles_scopes_policies
+      owner: key-cape
+      resources:
+        - iam-profile:client-scope-allowlists
+        - iam-profile:service-roles
+      repo_owns: Enforce registered scopes, client types, service subjects, tenant claims, and assurance claim shape.
+      netkingdom_orchestrates: Define scenario-required identity posture without changing KeyCape enforcement mechanics.
+    - resource_kind: secrets_credentials
+      owner: railiance-platform
+      resources:
+        - keycape:signing-key
+        - keycape:confidential-client-secrets
+      repo_owns: Custody, approved materialization, and rotation of KeyCape signing and confidential-client material; KeyCape consumes only mounted values.
+      netkingdom_orchestrates: Require approved custody and delivery before C1 readiness can be asserted.
+  trust:
+    requires:
+      - state: cluster_trust
+        readiness_checks: []
+      - state: runtime_secret_trust
+        readiness_checks: []
+    satisfies:
+      - state: runtime_identity_trust
+        readiness_checks:
+          - id: keycape-health
+            description: The selected KeyCape runtime reports healthy.
+            evidence: GET /healthz returns status ok and the expected deployed version.
+          - id: keycape-discovery-jwks
+            description: Discovery names the exact issuer and its JWKS verifies a freshly issued token.
+            evidence: /.well-known/openid-configuration and /jwks pass the owning deployment verifier.
+          - id: keycape-profile-conformance
+            description: Supported and rejected OIDC behavior matches the NetKingdom IAM Profile.
+            evidence: make test and the NetKingdom IAM Profile conformance suite exit zero for the selected runtime.
+  catalog:
+    publish: capabilities/playbooks/key-cape.lightweight-sso.yaml
+    maturity: implemented
+    consumers:
+      - netkingdom-security-scenario-composer

capabilities/playbooks/key-cape.privacyidea-token-authority.yaml

@@ -0,0 +1,96 @@
+apiVersion: netkingdom.io/playbook-capability/v0.1
+kind: PlaybookCapabilityDeclaration
+metadata:
+  id: key-cape.privacyidea-token-authority
+  name: KeyCape privacyIDEA token-authority integration
+  owner: key-cape
+  repo: key-cape
+  domain: infotech
+  contract_version: "0.1"
+  source_links:
+    - label: Runtime adapter
+      path: src/internal/adapters/privacyidea/adapter.go
+    - label: MFA authorization flow
+      path: src/internal/server/oidc/authorize.go
+spec:
+  playbook:
+    path: src/internal/adapters/privacyidea/adapter.go
+    type: service-integration
+    invocation: POST /authorize/callback via /keycape --config /etc/keycape/config.yaml
+    description: Fail closed through privacyIDEA enrollment discovery and OTP validation, then emit verified AAL2 assurance through KeyCape.
+  capabilities:
+    - id: c2b.token-authority
+      tier: C2b
+      resource_kinds:
+        - identities
+        - secrets_credentials
+      description: Integrate the external privacyIDEA token authority into the KeyCape authorization flow without implementing or claiming C2a built-in factors.
+  parameters:
+    - name: privacyidea_base_url
+      type: string
+      required: false
+      default: http://privacyidea.sso.svc.cluster.local:80
+      constraints:
+        pattern: ^https?://[^\n\r]+$
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Cluster-local privacyIDEA API endpoint selected by the deployment owner.
+    - name: privacyidea_admin_token_ref
+      type: string
+      required: false
+      default: kubernetes://sso/keycape-config#config.yaml
+      sensitivity: secret_reference
+      tuning_authority: platform_only
+      description: Reference to the mounted KeyCape configuration carrying privacyIDEA API authentication; never a token value.
+    - name: realm
+      type: string
+      required: false
+      default: coulomb
+      constraints:
+        pattern: ^[a-z0-9][a-z0-9_-]{0,62}$
+      sensitivity: operational
+      tuning_authority: platform_only
+      description: Exact privacyIDEA realm used for token lookup and validation.
+    - name: require_for_all
+      type: boolean
+      required: false
+      default: true
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Fail-closed bootstrap posture requiring MFA for upstream users while enrollment remains independently verified.
+  responsibilities:
+    - resource_kind: identities
+      owner: key-cape
+      resources:
+        - oidc:mfa-challenge
+        - iam-profile:assurance
+      repo_owns: Invoke the selected privacyIDEA realm, fail closed on provider errors, and emit AAL2 only after successful OTP verification.
+      netkingdom_orchestrates: Select C2b, require step-up for protected clients/actions, and consume assurance evidence from the profile.
+    - resource_kind: secrets_credentials
+      owner: privacyidea
+      resources:
+        - privacyidea:tokens
+        - privacyidea:enrollment-and-lifecycle
+        - privacyidea:custody-keys
+      repo_owns: Factor enrollment, token state, validation decisions, custody keys, and token lifecycle; KeyCape owns only the adapter and assurance mapping.
+      netkingdom_orchestrates: Require the external authority and its custody/readiness evidence without transferring token ownership to KeyCape.
+  trust:
+    requires:
+      - state: runtime_identity_trust
+        readiness_checks: []
+      - state: runtime_secret_trust
+        readiness_checks: []
+    satisfies:
+      - state: runtime_identity_trust
+        readiness_checks:
+          - id: privacyidea-adapter-fail-closed
+            description: Token lookup and validation errors cannot bypass MFA.
+            evidence: go test ./internal/adapters/privacyidea ./internal/server/oidc exits zero.
+          - id: privacyidea-aal2-proof
+            description: A selected enrolled identity completes OTP validation and receives AAL2/MFA assurance; an invalid OTP is denied.
+            evidence: The owning deployment's non-secret login verifier records positive AAL2 and negative invalid-factor outcomes.
+  catalog:
+    publish: capabilities/playbooks/key-cape.privacyidea-token-authority.yaml
+    maturity: implemented-integration
+    consumers:
+      - netkingdom-security-scenario-composer