Implement KeyCape provider and service identity contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

capabilities/playbooks/key-cape.lightweight-sso.yaml

@@ -0,0 +1,107 @@
+apiVersion: netkingdom.io/playbook-capability/v0.1
+kind: PlaybookCapabilityDeclaration
+metadata:
+  id: key-cape.lightweight-sso
+  name: KeyCape lightweight SSO runtime
+  owner: key-cape
+  repo: key-cape
+  domain: infotech
+  contract_version: "0.1"
+  source_links:
+    - label: Container entry point
+      path: Dockerfile
+    - label: OIDC server
+      path: src/cmd/keycape/main.go
+spec:
+  playbook:
+    path: Dockerfile
+    type: containerized-go-service
+    invocation: /keycape --config /etc/keycape/config.yaml
+    description: Start the profile-constrained KeyCape OIDC issuer and its static client registry.
+  capabilities:
+    - id: c1.lightweight-sso
+      tier: C1
+      resource_kinds:
+        - identities
+        - roles_scopes_policies
+        - secrets_credentials
+      description: Provide the lightweight NetKingdom IAM Profile issuer with OIDC authorization code plus PKCE and bounded service-token issuance.
+  parameters:
+    - name: config_path
+      type: string
+      required: false
+      default: /etc/keycape/config.yaml
+      sensitivity: secret_reference
+      tuning_authority: platform_only
+      description: Mounted KeyCape configuration path; secret values remain in the owning delivery system.
+    - name: issuer
+      type: string
+      required: false
+      default: https://kc.coulomb.social
+      constraints:
+        pattern: ^https://[^\n\r]+$
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Exact issuer used in discovery and every signed token.
+    - name: default_token_lifetime
+      type: string
+      required: false
+      default: 15m
+      constraints:
+        pattern: ^[1-9][0-9]*[smh]$
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Server default token lifetime; confidential clients may declare a shorter bounded lifetime.
+    - name: signing_key_path
+      type: string
+      required: false
+      default: /etc/keycape/key.pem
+      sensitivity: secret_reference
+      tuning_authority: platform_only
+      description: Mounted RS256 signing-key path; the declaration never carries key material.
+  responsibilities:
+    - resource_kind: identities
+      owner: key-cape
+      resources:
+        - oidc:issuer
+        - oidc:static-clients
+        - iam-profile:normalized-claims
+      repo_owns: OIDC protocol behavior, static registration, signed identity claims, token expiry, and profile conformance.
+      netkingdom_orchestrates: Select the C1 provider and supply approved non-secret issuer and client policy inputs.
+    - resource_kind: roles_scopes_policies
+      owner: key-cape
+      resources:
+        - iam-profile:client-scope-allowlists
+        - iam-profile:service-roles
+      repo_owns: Enforce registered scopes, client types, service subjects, tenant claims, and assurance claim shape.
+      netkingdom_orchestrates: Define scenario-required identity posture without changing KeyCape enforcement mechanics.
+    - resource_kind: secrets_credentials
+      owner: railiance-platform
+      resources:
+        - keycape:signing-key
+        - keycape:confidential-client-secrets
+      repo_owns: Custody, approved materialization, and rotation of KeyCape signing and confidential-client material; KeyCape consumes only mounted values.
+      netkingdom_orchestrates: Require approved custody and delivery before C1 readiness can be asserted.
+  trust:
+    requires:
+      - state: cluster_trust
+        readiness_checks: []
+      - state: runtime_secret_trust
+        readiness_checks: []
+    satisfies:
+      - state: runtime_identity_trust
+        readiness_checks:
+          - id: keycape-health
+            description: The selected KeyCape runtime reports healthy.
+            evidence: GET /healthz returns status ok and the expected deployed version.
+          - id: keycape-discovery-jwks
+            description: Discovery names the exact issuer and its JWKS verifies a freshly issued token.
+            evidence: /.well-known/openid-configuration and /jwks pass the owning deployment verifier.
+          - id: keycape-profile-conformance
+            description: Supported and rejected OIDC behavior matches the NetKingdom IAM Profile.
+            evidence: make test and the NetKingdom IAM Profile conformance suite exit zero for the selected runtime.
+  catalog:
+    publish: capabilities/playbooks/key-cape.lightweight-sso.yaml
+    maturity: implemented
+    consumers:
+      - netkingdom-security-scenario-composer