net-kingdom/tools/security-tools.json

{
  "schema": "netkingdom.security-tools-index.v1",
  "purpose": "One place for any agent (Claude Code, Codex, Grok) or person to find NetKingdom's security tools, what question each answers, how to run it, and whether an agent may run it. Tool availability is not permission (SECURITY-COMPANION.md section 7).",
  "agent_may_run_values": {
    "yes": "offline and read-only; any agent may run it",
    "fixtures-only": "an agent may run it on synthetic fixtures; real inputs are the owner's",
    "no-attended": "needs a person's private input or authority; an agent prepares and the person runs it",
    "no-live": "contacts a live service; only under the owner's admitted procedure"
  },
  "orientation": [
    {"what": "Security rules, operative form", "where": "SECURITY-COMPANION.md"},
    {"what": "Credential and access routing (who owns a credential)", "command": "warden route find \"<need>\" --json", "where": "~/ops-warden"},
    {"what": "Shared security orientation cards", "command": "PYTHONPATH=../emergent-security/src python3 -m emergent_security.knowledge --repositories .. show start --audience generic", "note": "A withheld card means: read its listed sources instead."},
    {"what": "Standards of record", "where": "canon/standards/"},
    {"what": "Upstream security vocabulary and secrets standard", "where": "../security-canon (Mode of Authority, SEC-DSM 1.0.0)"},
    {"what": "Accounts, authority and accountable automation", "where": "canon/standards/service-identity-privilege_v0.1.md"},
    {"what": "Who and what unlocks recovery", "where": "docs/crisis-custody-list.md"}
  ],
  "tools": [
    {"id": "service-identity", "path": "tools/service-identity", "answers": "Do the declared service accounts conform to the identity and privilege standard?",
     "run": "make service-identity-check", "test": "make service-identity-test", "agent_may_run": "yes",
     "standard": "canon/standards/service-identity-privilege_v0.1.md"},
    {"id": "rotation-lanes", "path": "tools/rotation-lanes", "answers": "Does every known credential have a rotation lane with blast radius, verification step and owner?",
     "run": "make rotation-lanes-check", "test": "make rotation-lanes-test", "agent_may_run": "yes",
     "standard": "canon/standards/credential-management_v0.2.md"},
    {"id": "custody-record", "path": "tools/custody-record", "answers": "Is a platform-root custody record valid, and may a root grant be observed from it?",
     "run": "uv run tools/custody-record/validate.py <record.json>", "test": "make custody-record-test", "agent_may_run": "yes",
     "standard": "docs/adr/ADR-0017-root-grant-custody-and-account-authority.md"},
    {"id": "tenancy-posture", "path": "tools/tenancy-posture", "answers": "Is a tenancy.yaml declaration valid against the tenancy posture standard?",
     "run": "python3 tools/tenancy-posture/validate.py <tenancy.yaml>", "test": "make posture-feedback-test", "agent_may_run": "yes",
     "standard": "canon/standards/tenancy-posture_v0.1.md"},
    {"id": "posture-feedback", "path": "tools/posture-feedback", "answers": "Which owner should get which remediation proposal for a posture finding?",
     "run": "make posture-feedback-reference", "test": "make posture-feedback-test", "agent_may_run": "yes",
     "standard": "canon/standards/posture-feedback_v0.1.md", "note": "Proposal-only: never writes State Hub or policy."},
    {"id": "iam-profile-conformance", "path": "tools/iam-profile-conformance", "answers": "Does an OIDC issuer conform to the NetKingdom IAM Profile?",
     "run": "see tools/iam-profile-conformance/README.md", "test": "make iam-profile-conformance-test", "agent_may_run": "fixtures-only",
     "standard": "canon/standards/iam-profile_v0.3.md", "note": "A live check needs a freshly minted access token from the issuer's owner."},
    {"id": "playbook-capability-contract", "path": "tools/playbook-capability-contract", "answers": "Is a Railiance playbook capability declaration valid?",
     "run": "see tools/playbook-capability-contract/README.md", "test": "make playbook-contract-test", "agent_may_run": "yes",
     "standard": "canon/standards/playbook-capability-contract_v0.1.md"},
    {"id": "security-scenario-composer", "path": "tools/security-scenario-composer", "answers": "Which providers, trust transitions and responsibilities does a security scenario need?",
     "run": "make security-scenario-compose-lightweight", "test": "make security-scenario-composer-test", "agent_may_run": "yes",
     "standard": "canon/standards/security-scenario-composition_v0.1.md", "note": "Plan-only; executes nothing."},
    {"id": "security-case-types", "path": "tools/security-case-types", "answers": "Are a SecurityCaseType and a SecurityCase valid?",
     "run": "see tools/security-case-types/README.md", "test": "python3 -m pytest tools/security-case-types/tests", "agent_may_run": "yes",
     "standard": "canon/standards/security-case-types_v0.1.md"},
    {"id": "emission-cadence-profile", "path": "tools/emission-cadence-profile", "answers": "Does an emission-cadence declaration meet the NetKingdom security overlay?",
     "run": "see tools/emission-cadence-profile/README.md", "test": "make emission-cadence-profile-test", "agent_may_run": "yes",
     "standard": "canon/standards/emission-cadence-security-profile_v0.1.md"},
    {"id": "security-bootstrap-console", "path": "tools/security-bootstrap-console", "answers": "Where is the guided security bootstrap, and what is the next safe action?",
     "run": "make security-bootstrap-console", "test": "make security-bootstrap-console-test", "agent_may_run": "fixtures-only",
     "standard": "docs/smooth-bootstrap-guide.md", "note": "Can write an explicit custody-mode approval record; that is the person's act."},
    {"id": "bootstrap-recovery", "path": "tools/bootstrap-recovery", "answers": "Can the identity backup be retrieved and each service restored in isolation?",
     "run": "tools/bootstrap-recovery/run-isolated-*.sh <transfer receipt>", "test": "NK49_RUN_ISOLATED_*_TEST=1 python3 -m pytest tests/test_isolated_*", "agent_may_run": "no-attended",
     "standard": "docs/identity-restore-drill.md", "note": "Needs the backup age key and private test inputs. Agents prepare and test on fixtures; the operator (admin) runs the real stages (standard SI-13)."}
  ],
  "not_security_tools": {
    "coordination-frame": "Renders the coordination receiver from staged sources; repository maintenance.",
    "tutorial-verify": "Verifies runbook tutorial packs."
  }
}