coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T02: Service Identity and Privilege standard ratified as v0.1
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The founder ratified the standard (status accepted) on 2026-10-25 and accepted the
emergent-security start card 0.2.7. Ratification applies no exception's elimination path,
changes no live service and does not make any declaration owner-confirmed. T02 done.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-25 00:03:24 +02:00
parent d0f259b12c
commit 2de259a46d
6 changed files with 29 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tools/service-identity/README.md
View file

@ -2,9 +2,9 @@
NK-WP-0054-T03. Offline and read-only. Checks declarations against
`canon/schemas/service-identity_v0.1.schema.json` and evaluates the rules of the
proposed [Service Identity and Privilege standard](../../canon/standards/service-identity-privilege_v0.1.md)
accepted [Service Identity and Privilege standard](../../canon/standards/service-identity-privilege_v0.1.md)
that a declaration alone can decide. It was built against draft-1, before the founder's review,
so a rule change in the standard changes this tool. It follows draft-3.
so a rule change in the standard changes this tool. It follows the accepted v0.1 text (draft-4).
```bash
make service-identity-test # unit tests

6
tools/service-identity/validate.py
View file

@ -2,10 +2,10 @@
# /// script
# dependencies = ["jsonschema>=4.10,<5", "PyYAML>=6,<7"]
# ///
"""Check service identity declarations against the proposed standard (NK-WP-0054-T03).
"""Check service identity declarations against the accepted standard (NK-WP-0054-T03).
Validates `canon/schemas/service-identity_v0.1.schema.json`, then evaluates the rules of
NetKingdom Service Identity and Privilege v0.1 (draft-3, a SecurityCanon profile) that a declaration alone can decide.
NetKingdom Service Identity and Privilege v0.1 (v0.1, a SecurityCanon profile) that a declaration alone can decide.
Each identity ends as `conformant`, `non-conformant`, `excepted` or `unknown`; unknown is a
finding, not a pass. Observed state is the health check's job (T04), not this tool's.
@ -98,7 +98,7 @@ NON_HUMAN = {"SERVICE", "WORKLOAD", "AGENT", "CONTROLLER", "DEVICE"}
def _violations(identity: dict[str, Any]) -> tuple[set[str], list[str]]:
"""Rules broken by one account on declared facts, and the facts still unknown (standard draft-3)."""
"""Rules broken by one account on declared facts, and the facts still unknown (standard v0.1)."""
broken: set[str] = set()
unknown: list[str] = []
principal = identity["principal_type"]