Add STATUS.md — NetKingdom ecosystem status snapshot
Documents net-kingdom delivery state, sister-repo maturity from reuse.coulomb.social federation, capability ladder position, backlog, and cross-ecosystem coordination gaps as of 2026-07-08.
This commit is contained in:
parent
3d23f8c4e2
commit
75cfaed593
1 changed files with 330 additions and 0 deletions
330
STATUS.md
Normal file
330
STATUS.md
Normal file
|
|
@ -0,0 +1,330 @@
|
|||
# NetKingdom Ecosystem Status
|
||||
|
||||
> Living status for the NetKingdom identity and security platform and its
|
||||
> sister repositories. Updated from repo workplans, State Hub, and the
|
||||
> [reuse.coulomb.social](https://reuse.coulomb.social) federated capability
|
||||
> registry.
|
||||
>
|
||||
> **Last updated:** 2026-07-08
|
||||
|
||||
---
|
||||
|
||||
## At a Glance
|
||||
|
||||
| Area | Status |
|
||||
|------|--------|
|
||||
| **NetKingdom core** | Delivered — IAM Profile v0.2, bootstrap/custody arc, security console, boundary contracts |
|
||||
| **Lightweight identity** | Stable — key-cape v0.1 complete; Authelia + LLDAP + privacyIDEA stack live |
|
||||
| **Authorization** | Baseline complete — flex-auth PDP shipped; production `policy.enabled` still off pending ecosystem flip |
|
||||
| **Operational access** | Production-verified — ops-warden SSH cert lane live on Railiance OpenBao |
|
||||
| **User domain** | Planning arc complete — user-engine WP-0001–0019 finished; live stack wiring not yet evidenced |
|
||||
| **Deployment substrate** | S2 stable (single-node k3s), S3 emerging (OpenBao + CNPG live), S5 first app operational |
|
||||
| **Capability discovery** | Federation live — 61 capabilities across 62 workstation repos via reuse-surface |
|
||||
| **Active NetKingdom backlog** | NK-WP-0009 (security tutorials), NK-WP-0011 (enterprise SAML federation) |
|
||||
|
||||
**Bottom line:** The security spine is bootstrappable, standards are canonical,
|
||||
and the lightweight identity + SSH access lanes are production-proven. The next
|
||||
meaningful expansions are enterprise federation (expanded-mode Keycloak),
|
||||
operator tutorials, flex-auth live enforcement, and user-engine production
|
||||
integration.
|
||||
|
||||
---
|
||||
|
||||
## NetKingdom (this repo)
|
||||
|
||||
**Role:** Platform domain for identity and security — owns normative contracts,
|
||||
bootstrap tooling, and meta-orchestration responsibility over the security
|
||||
landscape. See `SCOPE.md`, `INTENT.md`, and `docs/responsibility-map.md`.
|
||||
|
||||
### Maturity (reuse federation)
|
||||
|
||||
| Capability | ID | Vector | Status |
|
||||
|------------|-----|--------|--------|
|
||||
| NetKingdom Security/IAM Tooling Suite | `capability.security.iam-tooling-suite` | D3 / A2 / C1 / R1 | draft |
|
||||
|
||||
Source: [reuse.coulomb.social/v1/federated](https://reuse.coulomb.social/v1/federated) — net-kingdom index at `registry/indexes/capabilities.yaml`.
|
||||
|
||||
### Delivered workplans
|
||||
|
||||
| ID | Title | Notes |
|
||||
|----|-------|-------|
|
||||
| NK-WP-0001 | SSO & MFA Platform (Keycloak + privacyIDEA) | Archived — expanded-mode baseline |
|
||||
| NK-WP-0002 | Local Identity (bootstrap OIDC) | Finished |
|
||||
| NK-WP-0003 | KeyCape + privacyIDEA cluster deployment | Completed |
|
||||
| NK-WP-0004 | Credential Management Foundation | Done |
|
||||
| NK-WP-0005 | Agent-Driven Credential Bootstrap | Done |
|
||||
| NK-WP-0006 | Recursive platform identity architecture | Finished |
|
||||
| NK-WP-0007 | Object Storage STS credential vending | Finished |
|
||||
| NK-WP-0008 | IT Security Architecture Patterns (infospace) | Done |
|
||||
| NK-WP-0010 | Genesis Security Pattern Completion | Finished |
|
||||
| NK-WP-0012 | NetKingdom IAM Profile Specification | Finished — `canon/standards/iam-profile_v0.2.md` |
|
||||
| NK-WP-0013 | Playbook Capability Contract | Finished — `canon/standards/playbook-capability-contract_v0.1.md` |
|
||||
| NK-WP-0014 | User Engine boundary contracts | Finished — `canon/standards/user-engine-boundary-contract_v0.1.md` |
|
||||
| NET-WP-0015 | King Credential & OpenBao identity bootstrap | Finished |
|
||||
| NET-WP-0016 | Guided Security Bootstrap Experience | Finished |
|
||||
| NET-WP-0017 | IT Security Readiness for User Onboarding | Finished |
|
||||
| NET-WP-0018 | Bootstrap Automation & Rebuild Readiness | Finished |
|
||||
| NET-WP-0019 | User lifecycle dry-run polish | Finished |
|
||||
| NET-WP-0020 | OpenBao unseal custody models & SSH automation | Finished — greenfield init/unseal proof 2026-07-02 |
|
||||
|
||||
User-engine implementation workplans NK-WP-0015–0019 (isolated MVP through
|
||||
conformance) are archived here but executed in `user-engine`.
|
||||
|
||||
### Backlog
|
||||
|
||||
| ID | Title | Status | Depends on |
|
||||
|----|-------|--------|------------|
|
||||
| NK-WP-0009 | NetKingdom Security Pattern Tutorials | backlog | NK-WP-0008 (done) |
|
||||
| NK-WP-0011 | Enterprise Federation & SAML (expanded-mode Keycloak) | backlog | NK-WP-0003, 0004, 0006 |
|
||||
|
||||
### Runnable artifacts
|
||||
|
||||
| Artifact | Path | Purpose |
|
||||
|----------|------|---------|
|
||||
| IAM Profile conformance checker | `tools/iam-profile-conformance/` | Verify OIDC/PKCE claim shapes against v0.2 |
|
||||
| Playbook capability contract validator | `tools/playbook-capability-contract/` | Validate scenario playbooks against v0.1 contract |
|
||||
| Security bootstrap console | `tools/security-bootstrap-console/` | Custody gates, roster, evidence validators (non-secret) |
|
||||
| Bootstrap agent | `sso-mfa/bootstrap/creds-bootstrap-agent.sh` | Unattended credential + OpenBao init/unseal (Phase 7b) |
|
||||
| OpenBao init/unseal script | `sso-mfa/bootstrap/openbao-init-unseal.sh` | Greenfield-proven custody-gated init/unseal |
|
||||
|
||||
### Key standards (canonical)
|
||||
|
||||
- `canon/standards/iam-profile_v0.2.md` — OIDC/PKCE contract all apps target
|
||||
- `canon/standards/playbook-capability-contract_v0.1.md` — meta-orchestration interface
|
||||
- `canon/standards/user-engine-boundary-contract_v0.1.md` — user-domain integration
|
||||
- `canon/standards/credential-management_v0.2.md` — credential lifecycle model
|
||||
- `docs/platform-identity-security-architecture.md` — capability ladder C0–C6
|
||||
|
||||
---
|
||||
|
||||
## Capability Ladder Position
|
||||
|
||||
NetKingdom's architecture progresses by capability tier, not user count
|
||||
(`docs/platform-identity-security-architecture.md`):
|
||||
|
||||
```text
|
||||
C0 Bootstrap local identity ✅ NK-WP-0002
|
||||
C1 Lightweight SSO (KeyCape) ✅ NK-WP-0003, key-cape v0.1
|
||||
C2 MFA / 2FA ✅ privacyIDEA in KeyCape stack
|
||||
C3 Runtime secrets (OpenBao) ✅ NET-WP-0015–0020, railiance-platform
|
||||
C4 Fine-grained authorization 🟡 flex-auth baseline done; live enforcement pending
|
||||
C5 User-domain service 🟡 user-engine WP arc done; production wiring pending
|
||||
C6 Enterprise federation (SAML) ⏸ NK-WP-0011 backlog
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Sister Repositories
|
||||
|
||||
### Identity & security runtime
|
||||
|
||||
#### key-cape
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Lightweight IAM implementation of the NetKingdom IAM Profile (Authelia + LLDAP + privacyIDEA). |
|
||||
| **Maturity** | `capability.iam.key-cape` — **D4 / A2 / C2 / R1** (draft) |
|
||||
| **Workplans** | KEY-WP-0001–0003 all finished |
|
||||
| **NetKingdom relation** | Primary lightweight implementer of `iam-profile_v0.2.md`; applications integrate against the profile, not KeyCape internals. |
|
||||
| **Status** | Stable v0.1 — container image, acceptance suite, bootstrap console OIDC/MFA verification client shipped. |
|
||||
|
||||
#### flex-auth
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Policy-as-code authorization registry and PDP — turns verified IAM claims into allow/deny decisions. |
|
||||
| **Maturity** | `capability.authorization.policy-evaluate` — **D4 / A2 / C2 / R1** (draft) |
|
||||
| **Workplans** | FLEX-WP-0001–0007 all finished |
|
||||
| **NetKingdom relation** | Consumes NetKingdom IAM Profile claims; sits between identity and protected systems. First consumer: ops-warden SSH signing gate. |
|
||||
| **Status** | Go service with `POST /v1/check` live; production deployment smoke verified 2026-06-29. **`policy.enabled` deliberately off** — gate verified but not live-enforced. |
|
||||
|
||||
#### user-engine
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Headless user-domain service — accounts, memberships, profiles, projections; not an IdP or PDP. |
|
||||
| **Maturity** | `capability.identity.user-engine` — **D4 / A1 / C2 / R0** (draft) |
|
||||
| **Workplans** | USER-WP-0001–0019 all finished (Jun 2026) |
|
||||
| **NetKingdom relation** | Governed by `user-engine-boundary-contract_v0.1.md` (NK-WP-0014). Consumes IAM claims; defers authZ to flex-auth. |
|
||||
| **Status** | Full planning arc through Postgres durable store + conformance; **production integration with live key-cape/flex-auth not yet evidenced**. |
|
||||
|
||||
#### ops-warden
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Operational access steward — short-lived SSH certs for `adm`/`agt`/`atm`; routes all other credential needs via `warden route`. |
|
||||
| **Maturity** | `capability.security.ssh-certificate-issuance` — **D4 / A3 / C3 / R2** (draft) |
|
||||
| **Workplans** | Through WARDEN-WP-0024 finished (Jul 2026) |
|
||||
| **NetKingdom relation** | Operational face of the NetKingdom security model; maintains routing catalog aligned to NK canon. NetKingdom depends on it for the SSH lane but does not orchestrate its resources. |
|
||||
| **Status** | Mission-complete for SSH lane. Production signing verified on `https://bao.coulomb.social`. `warden access` front door, audit trail, experiential memory shipped. |
|
||||
|
||||
#### ops-bridge
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | SSH reverse tunnel lifecycle manager — keeps remote agents connected to local State Hub. |
|
||||
| **Maturity** | `capability.ops.tunnel-bridge` — **D3 / A2 / C2 / R1** (draft) |
|
||||
| **Workplans** | BRIDGE-WP-0001–0005, OPS-WP-0001–0002 all finished |
|
||||
| **NetKingdom relation** | Tunnel transport layer; consumes ops-warden certs via `cert_command`. |
|
||||
| **Status** | v0.1 core complete (~80%). **`cert_command` live cutover on `agt-state-hub-bridge` pilot pending** — readiness gate shipped by ops-warden (WP-0016). |
|
||||
|
||||
### Standards & canon
|
||||
|
||||
#### info-tech-canon
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Markdown-first InfoTechCanon — evolving standards corpus (kernel, 11 domain models, CARING access-governance). |
|
||||
| **Maturity** | `capability.infotech.canon-service` — **D2 / A2 / C1 / R0** (draft) |
|
||||
| **Workplans** | ITC-WP-0001–0012 all finished |
|
||||
| **NetKingdom relation** | Upstream semantic foundation for security posture canon (ops-warden WP-0015 landing), platform architecture patterns, user-engine evaluation pack. |
|
||||
| **Status** | Seed kernel complete; **next target: Kernel RC1**. |
|
||||
|
||||
#### identity-canon
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Implementation-neutral vocabulary for identity concepts across IAM, directory, federation, authorization. |
|
||||
| **Workplans** | IDENTITY-WP-0001–0003 all finished |
|
||||
| **NetKingdom relation** | Feeds terminology discipline for user-engine and broader IAM vocabulary. Complements net-kingdom normative contracts. |
|
||||
| **Status** | Active research scaffold; next pass: source-note backfill and model revision. |
|
||||
|
||||
### Deployment substrate (Railiance OAS)
|
||||
|
||||
#### railiance-cluster (S2)
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Cluster runtime — k3s, Helm, ingress, cert-manager, operators on COULOMBCORE. |
|
||||
| **Maturity** | `capability.railiance.cluster-bootstrap` — **D3 / A2 / C1 / R0** (draft) |
|
||||
| **Workplans** | RAIL-BS-WP-0002–0006, RAILIANCE-WP-0012–0014 finished; RAIL-BS-WP-0008/0009 finished Jul 2026 |
|
||||
| **NetKingdom relation** | Runtime substrate for SSO/MFA namespaces, CNPG operator, all security services. |
|
||||
| **Status** | Single-node production stable. **Backlog:** RAIL-BS-WP-0007 ThreePhoenix HA cluster. |
|
||||
|
||||
#### railiance-platform (S3)
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Platform services — PostgreSQL (CNPG), Valkey, OpenBao, object storage, identity integration point. |
|
||||
| **Maturity** | `capability.railiance.platform-services` — **D3 / A2 / C1 / R0** (draft) |
|
||||
| **Workplans** | RAILIANCE-WP-0005–0011 all finished |
|
||||
| **NetKingdom relation** | Hosts OpenBao (runtime secret authority), credential broker, identity services integration surface. |
|
||||
| **Status** | CNPG operator deployed; OpenBao platform secrets service live; `warden-sign` broker routing live 2026-07-01. |
|
||||
|
||||
#### railiance-apps (S5)
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Workloads & experience endpoints — application Helm releases, deployment guardrails. |
|
||||
| **Workplans** | RAIL-AP-WP-0001 through RAILIANCE-WP-0011 all finished |
|
||||
| **NetKingdom relation** | Consumes platform identity integrations at S5 deployment layer. |
|
||||
| **Status** | First app (`vergabe-teilnahme`) operational; Gitea/registry extracted to `railiance-forge`. No active workplans. |
|
||||
|
||||
### Reuse & discovery
|
||||
|
||||
#### reuse-surface
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Federated capability registry — discover, compare, validate, promote capabilities by D/A/C/R maturity vector. |
|
||||
| **Maturity** | `capability.registry.register` D3/A4/C2/R3; `capability.registry.validate` D4/A3/C3/R3 |
|
||||
| **Workplans** | REUSE-WP-0017–0019 finished (Jul 2026) |
|
||||
| **NetKingdom relation** | Discovery layer for the ecosystem; net-kingdom registers `capability.security.iam-tooling-suite`. |
|
||||
| **Status** | **62/62 workstation repos established**; production hub at `https://reuse.coulomb.social` (61 federated capabilities as of 2026-07-08). |
|
||||
|
||||
#### open-reuse
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| **Purpose** | Managed continuity for valuable OSS integrations — structured update loops for proven integrations. |
|
||||
| **Workplans** | OPEN-WP-0001–0004 all finished |
|
||||
| **NetKingdom relation** | Adjacent reuse layer; complements reuse-surface's capability maturity registry. |
|
||||
| **Status** | Foundation complete; CLI validator (`open-reuse validate`) shipped. |
|
||||
|
||||
---
|
||||
|
||||
## Integration Flow
|
||||
|
||||
```text
|
||||
Bootstrap plane (net-kingdom)
|
||||
local-identity / creds-bootstrap-agent / security-bootstrap-console
|
||||
│
|
||||
▼
|
||||
Platform control plane
|
||||
key-cape (lightweight) ──or── Keycloak (expanded, NK-WP-0011 backlog)
|
||||
│ verified IAM Profile claims
|
||||
▼
|
||||
flex-auth (authorization PDP)
|
||||
│ allow/deny decisions
|
||||
▼
|
||||
protected systems (ops-warden SSH, Markitect, apps, …)
|
||||
|
||||
Parallel lanes:
|
||||
user-engine ← IAM claims (boundary contract NK-WP-0014)
|
||||
OpenBao ← runtime secrets (railiance-platform, NET-WP-0020 custody models)
|
||||
ops-warden ← SSH certs + credential routing front door
|
||||
ops-bridge ← reverse tunnels (cert_command consumer)
|
||||
```
|
||||
|
||||
Credential routing canon: agents call `warden route find` before requesting
|
||||
secrets — ops-warden issues SSH certs only; all other credentials route to
|
||||
owning subsystems (OpenBao, key-cape, flex-auth). See
|
||||
`~/ops-warden/wiki/CredentialRouting.md`.
|
||||
|
||||
---
|
||||
|
||||
## Cross-Ecosystem Gaps
|
||||
|
||||
| Gap | Primary owners | Impact |
|
||||
|-----|----------------|--------|
|
||||
| flex-auth `policy.enabled` off in production | flex-auth, ops-warden | SSH signing gate verified but not live-enforced |
|
||||
| ops-bridge `cert_command` live cutover | ops-bridge | Short-lived cert tunnels not yet production-default |
|
||||
| NK-WP-0009 security pattern tutorials | net-kingdom | Operator/agent onboarding material missing |
|
||||
| NK-WP-0011 SAML / enterprise federation | net-kingdom | Expanded-mode Keycloak identity broker not started |
|
||||
| Workload Security Posture canon landing | net-kingdom, info-tech-canon | ops-warden drafted M0–M3 model; owner-driven landing pending |
|
||||
| user-engine production integration | user-engine, key-cape, flex-auth | WP arc complete; live stack wiring not evidenced |
|
||||
| railiance-cluster ThreePhoenix HA | railiance-cluster | Single-node stable; multi-node HA in backlog |
|
||||
| info-tech-canon Kernel RC1 | info-tech-canon | Seed kernel complete; schema consolidation remaining |
|
||||
| Unified tool packaging | net-kingdom | Three conformance tools lack single install path (reuse notes) |
|
||||
|
||||
---
|
||||
|
||||
## Recent Milestones
|
||||
|
||||
| Date | Event |
|
||||
|------|-------|
|
||||
| 2026-07-08 | NK-WP-0009 and NK-WP-0011 moved to backlog; reuse federation index refreshed (61 capabilities) |
|
||||
| 2026-07-08 | reuse-surface REUSE-WP-0019 — Forgejo webhook automation + reuse telemetry |
|
||||
| 2026-07-02 | NET-WP-0020 — OpenBao greenfield init/unseal proof; `bao write sys/unseal key=-` fix |
|
||||
| 2026-07-01 | ops-warden `warden-sign` broker routing live on railiance-platform |
|
||||
| 2026-06-29 | flex-auth FLEX-WP-0007 — production policy-gate smoke verified |
|
||||
| 2026-06-18 | ops-warden production SSH signing verified on Railiance OpenBao |
|
||||
| 2026-06 | user-engine USER-WP-0016–0019 — Postgres store + conformance; key-cape KEY-WP-0003 bootstrap console client |
|
||||
| 2026-05 | NK-WP-0012 IAM Profile v0.2 canonical; NK-WP-0014 user-engine boundary contract |
|
||||
|
||||
---
|
||||
|
||||
## State Hub
|
||||
|
||||
- **API:** `http://127.0.0.1:8000` (local) / `http://127.0.0.1:18000` (tunnel)
|
||||
- **Topic:** infotech (`cee7bedf-2b48-46ef-8601-006474f2ad7a`)
|
||||
- **NetKingdom workplans in hub:** NK-WP-0009 and NK-WP-0011 registered as `backlog`; finished plans indexed under `net-kingdom-*` slugs
|
||||
|
||||
Sync after workplan changes:
|
||||
|
||||
```bash
|
||||
statehub fix-consistency --repo net-kingdom
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## How to Refresh This Document
|
||||
|
||||
1. Scan `workplans/` and `workplans/archived/` for status changes.
|
||||
2. Query State Hub: `curl -s "http://127.0.0.1:8000/workplans/?repo=net-kingdom"`.
|
||||
3. Pull reuse federation: `curl -s "https://reuse.coulomb.social/v1/federated"`.
|
||||
4. Check sister-repo `SCOPE.md` and `registry/indexes/capabilities.yaml`.
|
||||
5. Update the **Last updated** date and relevant tables.
|
||||
|
||||
Related orientation files: `SCOPE.md` (scope boundary), `.custodian-brief.md`
|
||||
(auto-generated), `docs/responsibility-map.md` (orchestration relationships).
|
||||
Loading…
Add table
Add a link
Reference in a new issue