NK-WP-0054-T03: service identity schema, offline validator and first declarations
Schema, validator (30 tests), make targets and eight declarations authored from the
inventory, all unconfirmed by their owners. First run: 0 non-conformant, 12 unknown,
2 excepted, 5 planned, 6 conformant. Provisional: built against draft-1 before the
founder's review. Building it changed the draft: custody is a list, SI-X1 now covers
SI-9 and NAMING, and the reserved-name rule applies only to credential-holding
identities (open question 7). Unknown is a finding for every class.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2026-10-24 22:38:23 +02:00
|
|
|
{
|
|
|
|
|
"schema_version": "0.1",
|
|
|
|
|
"service": "example",
|
|
|
|
|
"owner": "Example owners",
|
|
|
|
|
"declared_at": "2026-10-24",
|
2026-10-24 23:35:30 +02:00
|
|
|
"attestation": {
|
|
|
|
|
"authored_by": "fixture",
|
|
|
|
|
"basis": [
|
|
|
|
|
"fixture"
|
|
|
|
|
],
|
|
|
|
|
"owner_confirmed": true
|
|
|
|
|
},
|
NK-WP-0054-T03: service identity schema, offline validator and first declarations
Schema, validator (30 tests), make targets and eight declarations authored from the
inventory, all unconfirmed by their owners. First run: 0 non-conformant, 12 unknown,
2 excepted, 5 planned, 6 conformant. Provisional: built against draft-1 before the
founder's review. Building it changed the draft: custody is a list, SI-X1 now covers
SI-9 and NAMING, and the reserved-name rule applies only to credential-holding
identities (open question 7). Unknown is a finding for every class.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2026-10-24 22:38:23 +02:00
|
|
|
"complete": true,
|
|
|
|
|
"identities": [
|
2026-10-24 23:35:30 +02:00
|
|
|
{
|
|
|
|
|
"name": "svc-example",
|
|
|
|
|
"purpose": "Read-only lookup",
|
|
|
|
|
"interactive_login": false,
|
|
|
|
|
"second_factor": "not_applicable",
|
|
|
|
|
"custody": [
|
|
|
|
|
"delivered-secret"
|
|
|
|
|
],
|
|
|
|
|
"consumers": [
|
|
|
|
|
{
|
|
|
|
|
"name": "example",
|
|
|
|
|
"kind": "service"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"owner": "Example owners",
|
|
|
|
|
"rotation": {
|
|
|
|
|
"path": "Rotate with the consumer",
|
|
|
|
|
"coupling": [
|
|
|
|
|
"example"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"status": "active",
|
|
|
|
|
"principal_type": "SERVICE",
|
|
|
|
|
"conventions": [
|
|
|
|
|
"bind"
|
|
|
|
|
],
|
|
|
|
|
"grants": [
|
|
|
|
|
{
|
|
|
|
|
"mode": "USE",
|
|
|
|
|
"scope": "directory",
|
|
|
|
|
"activation": "STANDING",
|
|
|
|
|
"environments": [
|
|
|
|
|
"PRODUCTION"
|
|
|
|
|
],
|
|
|
|
|
"read_only": true
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"name": "ex-admin",
|
|
|
|
|
"purpose": "Administer the example service",
|
|
|
|
|
"interactive_login": true,
|
|
|
|
|
"second_factor": "required",
|
|
|
|
|
"custody": [
|
|
|
|
|
"personal-safe"
|
|
|
|
|
],
|
|
|
|
|
"consumers": [
|
|
|
|
|
{
|
|
|
|
|
"name": "operator",
|
|
|
|
|
"kind": "person"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"owner": "Example owners",
|
|
|
|
|
"rotation": {
|
|
|
|
|
"path": "Owner-managed",
|
|
|
|
|
"coupling": []
|
|
|
|
|
},
|
|
|
|
|
"status": "active",
|
|
|
|
|
"principal_type": "HUMAN",
|
|
|
|
|
"conventions": [
|
|
|
|
|
"service-admin"
|
|
|
|
|
],
|
|
|
|
|
"grants": [
|
|
|
|
|
{
|
|
|
|
|
"mode": "ADMINISTER",
|
|
|
|
|
"scope": "example",
|
|
|
|
|
"activation": "STANDING",
|
|
|
|
|
"environments": [
|
|
|
|
|
"PRODUCTION"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
NK-WP-0054-T03: service identity schema, offline validator and first declarations
Schema, validator (30 tests), make targets and eight declarations authored from the
inventory, all unconfirmed by their owners. First run: 0 non-conformant, 12 unknown,
2 excepted, 5 planned, 6 conformant. Provisional: built against draft-1 before the
founder's review. Building it changed the draft: custody is a list, SI-X1 now covers
SI-9 and NAMING, and the reserved-name rule applies only to credential-holding
identities (open question 7). Unknown is a finding for every class.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2026-10-24 22:38:23 +02:00
|
|
|
]
|
|
|
|
|
}
|