coulomb/maturity-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
maturity-engine/src/maturity_engine/seed.py
tegwick 4cde4e489a Stand up the Engine/PIP surface for MAT-WP-0001 
Declare layer.yaml, add a Python engine over a local SQLite store,
and cover deterministic assessment, the §13 gap register, stance-map
inventory, claim guardrails, and the gate-house review path with tests.

Assistant: grok
Assistant-Session: 01a04ceb-150e-7e80-a542-ec8b1372e164
2026-08-29 12:54:37 +02:00

299 lines
12 KiB
Python
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

"""Seed data: statute §13 snapshot, §13.1 stance inventory, first two ladders.
Ladder *content* is not authored here. ASM-0…ASM-6 is gate-house's
(Active Secrets Management Canon v0.3 §38). PEP-stance publication is
ops-warden's (ADR-0009). This module registers those ladders as data.
"""
from __future__ import annotations
from maturity_engine.models import Criterion, Gap, Ladder, Level, StanceMap
REVIEW = "2026-11-28"
def _c(criterion_id: str, kind: str, description: str) -> Criterion:
return Criterion(id=criterion_id, evidence_kind=kind, description=description)
def asm_ladder() -> Ladder:
"""ASM-0…ASM-6. Criteria kinds are mechanical; doctrine stays gate-house's."""
levels = (
Level(0, "ASM-0", "Embedded", ()),
Level(
1,
"ASM-1",
"Stored",
(
_c("asm-1-manager", "central-secret-manager", "Central secret manager exists"),
_c("asm-1-rbac", "secret-rbac", "RBAC on secrets exists"),
_c("asm-1-scan", "basic-secret-scanning", "Basic secret scanning exists"),
_c("asm-1-rotate", "basic-rotation", "Basic rotation exists"),
),
),
Level(
2,
"ASM-2",
"Managed",
(
_c("asm-2-owner", "secret-ownership", "Ownership is established"),
_c("asm-2-auto", "automated-rotation", "Automated rotation is established"),
_c("asm-2-inv", "secret-inventory", "Inventory is established"),
_c("asm-2-detect", "exposure-detection", "Detection is established"),
_c("asm-2-remediate", "measurable-remediation", "Measurable remediation is established"),
),
),
Level(
3,
"ASM-3",
"Dynamic",
(
_c("asm-3-fed", "workload-federation", "Workload federation reduces standing credentials"),
_c("asm-3-jit", "jit-access", "JIT access reduces standing credentials"),
_c("asm-3-dyn", "dynamic-secrets", "Dynamic secrets reduce standing credentials"),
_c("asm-3-ci", "secretless-cicd", "Secretless CI/CD reduces standing credentials"),
),
),
Level(
4,
"ASM-4",
"Agent-Aware",
(
_c("asm-4-split", "principal-actor-distinction", "Human principal and agent actor are distinguished"),
_c("asm-4-asst", "assistant-mode-modeled", "Assistant mode is explicitly modeled"),
_c("asm-4-auto", "autonomous-mode-modeled", "Autonomous mode is explicitly modeled"),
),
),
Level(
5,
"ASM-5",
"Governed Autonomy",
(
_c("asm-5-id", "agent-identities", "Autonomous agents have identities"),
_c("asm-5-man", "agent-mandates", "Autonomous agents have mandates"),
_c("asm-5-budget", "agent-budgets", "Autonomous agents have budgets"),
_c("asm-5-ceil", "authority-ceilings", "Authority ceilings are in force"),
_c("asm-5-env", "change-envelopes", "Change envelopes are in force"),
_c("asm-5-cb", "circuit-breakers", "Deterministic circuit breakers are in force"),
),
),
Level(
6,
"ASM-6",
"Closed-Loop Authority",
(
_c("asm-6-id", "identity-join", "Identity is in the reconciled authority lifecycle"),
_c("asm-6-del", "delegation-join", "Delegation is in the reconciled authority lifecycle"),
_c("asm-6-iss", "issuance-join", "Credential issuance is in the reconciled authority lifecycle"),
_c("asm-6-exec", "execution-join", "Execution is in the reconciled authority lifecycle"),
_c("asm-6-ev", "evidence-join", "Evidence is in the reconciled authority lifecycle"),
_c("asm-6-exp", "exposure-join", "Exposure detection is in the reconciled authority lifecycle"),
_c("asm-6-rev", "revocation-join", "Revocation is in the reconciled authority lifecycle"),
_c("asm-6-rem", "remediation-join", "Remediation is in the reconciled authority lifecycle"),
),
),
)
return Ladder(
id="asm",
version="0.3",
owner="gate-house",
name="Active Secrets Management",
levels=levels,
)
def pep_stance_publication_ladder() -> Ladder:
"""Publication of unreachable-engine stance maps. Doctrine is ops-warden's."""
levels = (
Level(0, "PSP-0", "Unpublished", ()),
Level(
1,
"PSP-1",
"Published",
(_c("psp-1-file", "stance-map-published", "Stance map published at a named path"),),
),
Level(
2,
"PSP-2",
"Tested",
(
_c(
"psp-2-test",
"stance-map-equality-test",
"A test asserts the published map equals shipped behaviour",
),
),
),
)
return Ladder(
id="pep-stance-publication",
version="0.1",
owner="ops-warden",
name="PEP stance-map publication",
levels=levels,
)
def section_13_gaps() -> tuple[Gap, ...]:
"""Statute §13 snapshot. state and owner_status survive the migration."""
return (
Gap(
id="ssh-ca-signing-write",
capability="SSH-CA signing write (VaultCA, bao kv put)",
intended_owner="secrets-engine",
blocked_on="No engine exposes an SSH certificate signing surface",
review=REVIEW,
state="declared-contact",
owner_status="proposed",
declared_by="ops-warden",
mark="declared-gap",
),
Gap(
id="authentication-assurance-evidence",
capability="Authentication / assurance evidence",
intended_owner="identity layer + audit-core",
blocked_on="access-engine declined (FLEX-DEC-2026-002); no identity-layer evidence surface",
review=REVIEW,
state="unowned-capability",
owner_status="declined",
declared_by="kings-guard",
mark="pending",
notes="access-engine declined; reproposed, not assented",
),
Gap(
id="secret-use-evidence",
capability="Secret-use evidence",
intended_owner="secrets-engine",
blocked_on="No engine exposes secret-use evidence; OpenBao is Tooling",
review=REVIEW,
state="unowned-capability",
owner_status="proposed",
declared_by="kings-guard",
mark="pending",
),
Gap(
id="actuation-containment-surface",
capability="Reduce authority, require step-up, isolate a workload — as a deterministic engine API",
intended_owner="access-engine + runtime PEPs",
blocked_on="Ruled in v0.7 §9.2 to be an Engine concept, unowned and held at zero",
review=REVIEW,
state="unowned-capability",
owner_status="proposed",
declared_by="gate-house (estate-wide)",
mark="pending",
notes="kings-guard proposes containment and does not own it",
),
Gap(
id="identity-and-secret-observation",
capability="Identity and secret observation",
intended_owner="identity layer + secrets-engine + audit-core",
blocked_on="No engine exposes the observation surface; kings-guard makes no Tooling contact",
review=REVIEW,
state="unowned-capability",
owner_status="proposed",
declared_by="kings-guard",
mark="pending",
),
Gap(
id="stance-map-register",
capability="Stance-map register had no implementation",
intended_owner="gate-house",
blocked_on=None,
review=REVIEW,
state="resolved",
owner_status="resolved",
declared_by="ops-warden, access-engine",
mark=None,
notes="resolved in statute §13.1; inventory now held here",
),
Gap(
id="registry-snapshot-digest",
capability="Registry-snapshot digest in decision provenance",
intended_owner="flex-auth",
blocked_on="Decision provenance holds no snapshot digest; a registry compile of a level would be unfalsifiable",
review=REVIEW,
state="declared-contact",
owner_status="self-declared",
declared_by="flex-auth",
mark="declared-gap",
),
Gap(
id="approval-storage-lifecycle",
capability="Approval storage and lifecycle",
intended_owner="approval-engine",
blocked_on=None,
review=REVIEW,
state="assigned",
owner_status="assigned",
declared_by="flex-auth",
mark=None,
notes="assigned (§9.4)",
),
Gap(
id="approval-evidence",
capability="Approval evidence",
intended_owner="audit-core",
blocked_on=None,
review=REVIEW,
state="assigned",
owner_status="assented",
declared_by="gate-house",
mark=None,
notes="assented (AUDIT-IN-0001)",
),
Gap(
id="approval-evidence-custody-stronger",
capability="Approval evidence custody stronger than the shipped bound — WORM, object lock, transparency log",
intended_owner=None,
blocked_on="Doctrine work not yet done; approval evidence carries the same bound as every other source",
review=REVIEW,
state="unowned-capability",
owner_status="unassigned",
declared_by="audit-core",
mark="pending",
),
Gap(
id="approval-emission-atomicity",
capability="Emission atomicity for approval state changes",
intended_owner="approval-engine",
blocked_on=None,
review=REVIEW,
state="assigned",
owner_status="assigned",
declared_by="audit-core",
mark=None,
notes="assigned (§9.4)",
),
Gap(
id="ssh-signing-non-atomic-audit",
capability="Non-atomic audit emission on the SSH signing lane",
intended_owner="ops-warden",
blocked_on="Declared trade so an audit-store failure cannot remove production host access",
review=REVIEW,
state="declared-contact",
owner_status="self-declared",
declared_by="ops-warden",
mark="declared-gap",
notes="attributive (§9.6)",
),
)
def section_13_1_stances() -> tuple[StanceMap, ...]:
return (
StanceMap(
consumer="ops-warden",
published=True,
path="ops-warden/pep-stance.yaml",
shape=(
"total per-zone; open z0–z2 and unknown, closed z3-critical; "
"test asserts the published map equals the shipped default (ADR-0009)"
),
),
StanceMap(
consumer="ops-mason",
published=False,
path=None,
shape="catalogued PEP-shaped in §4; map not published",
),
)
Reference in a new issue View git blame Copy permalink