apiVersion: netkingdom.io/playbook-capability/v0.1
kind: PlaybookCapabilityDeclaration
metadata:
  id: key-cape.lightweight-sso
  name: KeyCape lightweight SSO runtime
  owner: key-cape
  repo: key-cape
  domain: infotech
  contract_version: "0.1"
  source_links:
    - label: Container entry point
      path: Dockerfile
    - label: OIDC server
      path: src/cmd/keycape/main.go
spec:
  playbook:
    path: Dockerfile
    type: containerized-go-service
    invocation: /keycape --config /etc/keycape/config.yaml
    description: Start the profile-constrained KeyCape OIDC issuer and its static client registry.
  capabilities:
    - id: c1.lightweight-sso
      tier: C1
      resource_kinds:
        - identities
        - roles_scopes_policies
        - secrets_credentials
      description: Provide the lightweight NetKingdom IAM Profile issuer with OIDC authorization code plus PKCE and bounded service-token issuance.
  parameters:
    - name: config_path
      type: string
      required: false
      default: /etc/keycape/config.yaml
      sensitivity: secret_reference
      tuning_authority: platform_only
      description: Mounted KeyCape configuration path; secret values remain in the owning delivery system.
    - name: issuer
      type: string
      required: false
      default: https://kc.coulomb.social
      constraints:
        pattern: ^https://[^\n\r]+$
      sensitivity: security_sensitive
      tuning_authority: platform_only
      description: Exact issuer used in discovery and every signed token.
    - name: default_token_lifetime
      type: string
      required: false
      default: 15m
      constraints:
        pattern: ^[1-9][0-9]*[smh]$
      sensitivity: security_sensitive
      tuning_authority: platform_only
      description: Server default token lifetime; confidential clients may declare a shorter bounded lifetime.
    - name: signing_key_path
      type: string
      required: false
      default: /etc/keycape/key.pem
      sensitivity: secret_reference
      tuning_authority: platform_only
      description: Mounted RS256 signing-key path; the declaration never carries key material.
  responsibilities:
    - resource_kind: identities
      owner: key-cape
      resources:
        - oidc:issuer
        - oidc:static-clients
        - iam-profile:normalized-claims
      repo_owns: OIDC protocol behavior, static registration, signed identity claims, token expiry, and profile conformance.
      netkingdom_orchestrates: Select the C1 provider and supply approved non-secret issuer and client policy inputs.
    - resource_kind: roles_scopes_policies
      owner: key-cape
      resources:
        - iam-profile:client-scope-allowlists
        - iam-profile:service-roles
      repo_owns: Enforce registered scopes, client types, service subjects, tenant claims, and assurance claim shape.
      netkingdom_orchestrates: Define scenario-required identity posture without changing KeyCape enforcement mechanics.
    - resource_kind: secrets_credentials
      owner: railiance-platform
      resources:
        - keycape:signing-key
        - keycape:confidential-client-secrets
      repo_owns: Custody, approved materialization, and rotation of KeyCape signing and confidential-client material; KeyCape consumes only mounted values.
      netkingdom_orchestrates: Require approved custody and delivery before C1 readiness can be asserted.
  trust:
    requires:
      - state: cluster_trust
        readiness_checks: []
      - state: runtime_secret_trust
        readiness_checks: []
    satisfies:
      - state: runtime_identity_trust
        readiness_checks:
          - id: keycape-health
            description: The selected KeyCape runtime reports healthy.
            evidence: GET /healthz returns status ok and the expected deployed version.
          - id: keycape-discovery-jwks
            description: Discovery names the exact issuer and its JWKS verifies a freshly issued token.
            evidence: /.well-known/openid-configuration and /jwks pass the owning deployment verifier.
          - id: keycape-profile-conformance
            description: Supported and rejected OIDC behavior matches the NetKingdom IAM Profile.
            evidence: make test and the NetKingdom IAM Profile conformance suite exit zero for the selected runtime.
  catalog:
    publish: capabilities/playbooks/key-cape.lightweight-sso.yaml
    maturity: implemented
    consumers:
      - netkingdom-security-scenario-composer