300 lines
12 KiB
Python
300 lines
12 KiB
Python
|
"""Seed data: statute §13 snapshot, §13.1 stance inventory, first two ladders.
|
|||
|
|
|
|||
|
|
Ladder *content* is not authored here. ASM-0…ASM-6 is gate-house's
|
|||
|
|
(Active Secrets Management Canon v0.3 §38). PEP-stance publication is
|
|||
|
|
ops-warden's (ADR-0009). This module registers those ladders as data.
|
|||
|
|
"""
|
|||
|
|
|
|||
|
|
from __future__ import annotations
|
|||
|
|
|
|||
|
|
from maturity_engine.models import Criterion, Gap, Ladder, Level, StanceMap
|
|||
|
|
|
|||
|
|
REVIEW = "2026-11-28"
|
|||
|
|
|
|||
|
|
|
|||
|
|
def _c(criterion_id: str, kind: str, description: str) -> Criterion:
|
|||
|
|
return Criterion(id=criterion_id, evidence_kind=kind, description=description)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def asm_ladder() -> Ladder:
|
|||
|
|
"""ASM-0…ASM-6. Criteria kinds are mechanical; doctrine stays gate-house's."""
|
|||
|
|
levels = (
|
|||
|
|
Level(0, "ASM-0", "Embedded", ()),
|
|||
|
|
Level(
|
|||
|
|
1,
|
|||
|
|
"ASM-1",
|
|||
|
|
"Stored",
|
|||
|
|
(
|
|||
|
|
_c("asm-1-manager", "central-secret-manager", "Central secret manager exists"),
|
|||
|
|
_c("asm-1-rbac", "secret-rbac", "RBAC on secrets exists"),
|
|||
|
|
_c("asm-1-scan", "basic-secret-scanning", "Basic secret scanning exists"),
|
|||
|
|
_c("asm-1-rotate", "basic-rotation", "Basic rotation exists"),
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
Level(
|
|||
|
|
2,
|
|||
|
|
"ASM-2",
|
|||
|
|
"Managed",
|
|||
|
|
(
|
|||
|
|
_c("asm-2-owner", "secret-ownership", "Ownership is established"),
|
|||
|
|
_c("asm-2-auto", "automated-rotation", "Automated rotation is established"),
|
|||
|
|
_c("asm-2-inv", "secret-inventory", "Inventory is established"),
|
|||
|
|
_c("asm-2-detect", "exposure-detection", "Detection is established"),
|
|||
|
|
_c("asm-2-remediate", "measurable-remediation", "Measurable remediation is established"),
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
Level(
|
|||
|
|
3,
|
|||
|
|
"ASM-3",
|
|||
|
|
"Dynamic",
|
|||
|
|
(
|
|||
|
|
_c("asm-3-fed", "workload-federation", "Workload federation reduces standing credentials"),
|
|||
|
|
_c("asm-3-jit", "jit-access", "JIT access reduces standing credentials"),
|
|||
|
|
_c("asm-3-dyn", "dynamic-secrets", "Dynamic secrets reduce standing credentials"),
|
|||
|
|
_c("asm-3-ci", "secretless-cicd", "Secretless CI/CD reduces standing credentials"),
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
Level(
|
|||
|
|
4,
|
|||
|
|
"ASM-4",
|
|||
|
|
"Agent-Aware",
|
|||
|
|
(
|
|||
|
|
_c("asm-4-split", "principal-actor-distinction", "Human principal and agent actor are distinguished"),
|
|||
|
|
_c("asm-4-asst", "assistant-mode-modeled", "Assistant mode is explicitly modeled"),
|
|||
|
|
_c("asm-4-auto", "autonomous-mode-modeled", "Autonomous mode is explicitly modeled"),
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
Level(
|
|||
|
|
5,
|
|||
|
|
"ASM-5",
|
|||
|
|
"Governed Autonomy",
|
|||
|
|
(
|
|||
|
|
_c("asm-5-id", "agent-identities", "Autonomous agents have identities"),
|
|||
|
|
_c("asm-5-man", "agent-mandates", "Autonomous agents have mandates"),
|
|||
|
|
_c("asm-5-budget", "agent-budgets", "Autonomous agents have budgets"),
|
|||
|
|
_c("asm-5-ceil", "authority-ceilings", "Authority ceilings are in force"),
|
|||
|
|
_c("asm-5-env", "change-envelopes", "Change envelopes are in force"),
|
|||
|
|
_c("asm-5-cb", "circuit-breakers", "Deterministic circuit breakers are in force"),
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
Level(
|
|||
|
|
6,
|
|||
|
|
"ASM-6",
|
|||
|
|
"Closed-Loop Authority",
|
|||
|
|
(
|
|||
|
|
_c("asm-6-id", "identity-join", "Identity is in the reconciled authority lifecycle"),
|
|||
|
|
_c("asm-6-del", "delegation-join", "Delegation is in the reconciled authority lifecycle"),
|
|||
|
|
_c("asm-6-iss", "issuance-join", "Credential issuance is in the reconciled authority lifecycle"),
|
|||
|
|
_c("asm-6-exec", "execution-join", "Execution is in the reconciled authority lifecycle"),
|
|||
|
|
_c("asm-6-ev", "evidence-join", "Evidence is in the reconciled authority lifecycle"),
|
|||
|
|
_c("asm-6-exp", "exposure-join", "Exposure detection is in the reconciled authority lifecycle"),
|
|||
|
|
_c("asm-6-rev", "revocation-join", "Revocation is in the reconciled authority lifecycle"),
|
|||
|
|
_c("asm-6-rem", "remediation-join", "Remediation is in the reconciled authority lifecycle"),
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
)
|
|||
|
|
return Ladder(
|
|||
|
|
id="asm",
|
|||
|
|
version="0.3",
|
|||
|
|
owner="gate-house",
|
|||
|
|
name="Active Secrets Management",
|
|||
|
|
levels=levels,
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def pep_stance_publication_ladder() -> Ladder:
|
|||
|
|
"""Publication of unreachable-engine stance maps. Doctrine is ops-warden's."""
|
|||
|
|
levels = (
|
|||
|
|
Level(0, "PSP-0", "Unpublished", ()),
|
|||
|
|
Level(
|
|||
|
|
1,
|
|||
|
|
"PSP-1",
|
|||
|
|
"Published",
|
|||
|
|
(_c("psp-1-file", "stance-map-published", "Stance map published at a named path"),),
|
|||
|
|
),
|
|||
|
|
Level(
|
|||
|
|
2,
|
|||
|
|
"PSP-2",
|
|||
|
|
"Tested",
|
|||
|
|
(
|
|||
|
|
_c(
|
|||
|
|
"psp-2-test",
|
|||
|
|
"stance-map-equality-test",
|
|||
|
|
"A test asserts the published map equals shipped behaviour",
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
)
|
|||
|
|
return Ladder(
|
|||
|
|
id="pep-stance-publication",
|
|||
|
|
version="0.1",
|
|||
|
|
owner="ops-warden",
|
|||
|
|
name="PEP stance-map publication",
|
|||
|
|
levels=levels,
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def section_13_gaps() -> tuple[Gap, ...]:
|
|||
|
|
"""Statute §13 snapshot. state and owner_status survive the migration."""
|
|||
|
|
return (
|
|||
|
|
Gap(
|
|||
|
|
id="ssh-ca-signing-write",
|
|||
|
|
capability="SSH-CA signing write (VaultCA, bao kv put)",
|
|||
|
|
intended_owner="secrets-engine",
|
|||
|
|
blocked_on="No engine exposes an SSH certificate signing surface",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="declared-contact",
|
|||
|
|
owner_status="proposed",
|
|||
|
|
declared_by="ops-warden",
|
|||
|
|
mark="declared-gap",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="authentication-assurance-evidence",
|
|||
|
|
capability="Authentication / assurance evidence",
|
|||
|
|
intended_owner="identity layer + audit-core",
|
|||
|
|
blocked_on="access-engine declined (FLEX-DEC-2026-002); no identity-layer evidence surface",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="unowned-capability",
|
|||
|
|
owner_status="declined",
|
|||
|
|
declared_by="kings-guard",
|
|||
|
|
mark="pending",
|
|||
|
|
notes="access-engine declined; reproposed, not assented",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="secret-use-evidence",
|
|||
|
|
capability="Secret-use evidence",
|
|||
|
|
intended_owner="secrets-engine",
|
|||
|
|
blocked_on="No engine exposes secret-use evidence; OpenBao is Tooling",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="unowned-capability",
|
|||
|
|
owner_status="proposed",
|
|||
|
|
declared_by="kings-guard",
|
|||
|
|
mark="pending",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="actuation-containment-surface",
|
|||
|
|
capability="Reduce authority, require step-up, isolate a workload — as a deterministic engine API",
|
|||
|
|
intended_owner="access-engine + runtime PEPs",
|
|||
|
|
blocked_on="Ruled in v0.7 §9.2 to be an Engine concept, unowned and held at zero",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="unowned-capability",
|
|||
|
|
owner_status="proposed",
|
|||
|
|
declared_by="gate-house (estate-wide)",
|
|||
|
|
mark="pending",
|
|||
|
|
notes="kings-guard proposes containment and does not own it",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="identity-and-secret-observation",
|
|||
|
|
capability="Identity and secret observation",
|
|||
|
|
intended_owner="identity layer + secrets-engine + audit-core",
|
|||
|
|
blocked_on="No engine exposes the observation surface; kings-guard makes no Tooling contact",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="unowned-capability",
|
|||
|
|
owner_status="proposed",
|
|||
|
|
declared_by="kings-guard",
|
|||
|
|
mark="pending",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="stance-map-register",
|
|||
|
|
capability="Stance-map register had no implementation",
|
|||
|
|
intended_owner="gate-house",
|
|||
|
|
blocked_on=None,
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="resolved",
|
|||
|
|
owner_status="resolved",
|
|||
|
|
declared_by="ops-warden, access-engine",
|
|||
|
|
mark=None,
|
|||
|
|
notes="resolved in statute §13.1; inventory now held here",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="registry-snapshot-digest",
|
|||
|
|
capability="Registry-snapshot digest in decision provenance",
|
|||
|
|
intended_owner="flex-auth",
|
|||
|
|
blocked_on="Decision provenance holds no snapshot digest; a registry compile of a level would be unfalsifiable",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="declared-contact",
|
|||
|
|
owner_status="self-declared",
|
|||
|
|
declared_by="flex-auth",
|
|||
|
|
mark="declared-gap",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="approval-storage-lifecycle",
|
|||
|
|
capability="Approval storage and lifecycle",
|
|||
|
|
intended_owner="approval-engine",
|
|||
|
|
blocked_on=None,
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="assigned",
|
|||
|
|
owner_status="assigned",
|
|||
|
|
declared_by="flex-auth",
|
|||
|
|
mark=None,
|
|||
|
|
notes="assigned (§9.4)",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="approval-evidence",
|
|||
|
|
capability="Approval evidence",
|
|||
|
|
intended_owner="audit-core",
|
|||
|
|
blocked_on=None,
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="assigned",
|
|||
|
|
owner_status="assented",
|
|||
|
|
declared_by="gate-house",
|
|||
|
|
mark=None,
|
|||
|
|
notes="assented (AUDIT-IN-0001)",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="approval-evidence-custody-stronger",
|
|||
|
|
capability="Approval evidence custody stronger than the shipped bound — WORM, object lock, transparency log",
|
|||
|
|
intended_owner=None,
|
|||
|
|
blocked_on="Doctrine work not yet done; approval evidence carries the same bound as every other source",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="unowned-capability",
|
|||
|
|
owner_status="unassigned",
|
|||
|
|
declared_by="audit-core",
|
|||
|
|
mark="pending",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="approval-emission-atomicity",
|
|||
|
|
capability="Emission atomicity for approval state changes",
|
|||
|
|
intended_owner="approval-engine",
|
|||
|
|
blocked_on=None,
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="assigned",
|
|||
|
|
owner_status="assigned",
|
|||
|
|
declared_by="audit-core",
|
|||
|
|
mark=None,
|
|||
|
|
notes="assigned (§9.4)",
|
|||
|
|
),
|
|||
|
|
Gap(
|
|||
|
|
id="ssh-signing-non-atomic-audit",
|
|||
|
|
capability="Non-atomic audit emission on the SSH signing lane",
|
|||
|
|
intended_owner="ops-warden",
|
|||
|
|
blocked_on="Declared trade so an audit-store failure cannot remove production host access",
|
|||
|
|
review=REVIEW,
|
|||
|
|
state="declared-contact",
|
|||
|
|
owner_status="self-declared",
|
|||
|
|
declared_by="ops-warden",
|
|||
|
|
mark="declared-gap",
|
|||
|
|
notes="attributive (§9.6)",
|
|||
|
|
),
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def section_13_1_stances() -> tuple[StanceMap, ...]:
|
|||
|
|
return (
|
|||
|
|
StanceMap(
|
|||
|
|
consumer="ops-warden",
|
|||
|
|
published=True,
|
|||
|
|
path="ops-warden/pep-stance.yaml",
|
|||
|
|
shape=(
|
|||
|
|
"total per-zone; open z0–z2 and unknown, closed z3-critical; "
|
|||
|
|
"test asserts the published map equals the shipped default (ADR-0009)"
|
|||
|
|
),
|
|||
|
|
),
|
|||
|
|
StanceMap(
|
|||
|
|
consumer="ops-mason",
|
|||
|
|
published=False,
|
|||
|
|
path=None,
|
|||
|
|
shape="catalogued PEP-shaped in §4; map not published",
|
|||
|
|
),
|
|||
|
|
)
|