coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
key-cape/registry/capabilities/capability.iam.key-cape.md
tegwick 61ee563b1f docs(reuse): establish reviewed NetKingdom security capabilities 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
2026-10-14 06:39:53 +02:00

4.7 KiB
Raw Blame History

id name summary owner status domain tags maturity external_evidence discovery availability relations evidence consumer_guidance promotion_history
capability.iam.key-cape OIDC identity and assurance OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. key-cape draft infotech
iam
oidc
netkingdom
security
framework-reuse
discovery availability
current target confidence rationale
D4 D5 high README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status (all 23 workplan tasks, 21 green test packages).
current target confidence rationale
A4 A4 high Source interface assessed 2026-10-14: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. Availability describes the delivery form, not production acceptance. Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates.
completeness reliability
level confidence basis satisfied_expectations broken_expectations out_of_scope_expectations
C2 low scope_vs_intent_and_consumer_expectations
full v0.1 implementation per its own workplan (23/23 tasks)
21 test packages, all green
documented lightweight-to-expanded (Keycloak) migration path
level confidence basis known_reliability_risks
R1 low consumer_quality_signals
maturity claims rely on the repo's own workplan completion record, not independently re-verified in this sweep
intent includes excludes assumptions use_cases research_memos
OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI
OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI
Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates
U02: Human signs in with MFA and manages account or factor recovery
U03: Application combines identity, tenant and resource facts and enforces a bound decision
U04: Protected operation obtains and consumes exact human approval before its side effect
U10: Operator recovers identity, custody or data with independently held recovery material
current_level target_level current_artifacts target_artifacts consumption_modes
A4 A4
SCOPE.md
README.md
HTTP API
source
depends_on supports related_to
capability.identity.user-engine
capability.identity.tenant-facts
capability.authorization.policy-evaluate
documentation tests consumer_feedback bug_reports incidents
SCOPE.md
README.md
.gitea/workflows/
.forgejo/workflows/
recommended_for not_recommended_for known_limitations
Human signs in with MFA and manages account or factor recovery
Application combines identity, tenant and resource facts and enforces a bound decision
Protected operation obtains and consumes exact human approval before its side effect
Operator recovers identity, custody or data with independently held recovery material
Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates
Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates
2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.
date dimension from to rationale author
2026-10-14 availability A2 A4 Interface-form reassessment from current owner sources; no completeness/reliability promotion. codex

OIDC identity and assurance

OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.

Reuse boundary

Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates.

Supported use cases

  • U02: Human signs in with MFA and manages account or factor recovery
  • U03: Application combines identity, tenant and resource facts and enforces a bound decision
  • U04: Protected operation obtains and consumes exact human approval before its side effect
  • U10: Operator recovers identity, custody or data with independently held recovery material

Evidence and integration

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.