From 75cfaed59398049f7730aef3d10ffd169ec85ec3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 8 Jul 2026 12:44:00 +0200 Subject: [PATCH] =?UTF-8?q?Add=20STATUS.md=20=E2=80=94=20NetKingdom=20ecos?= =?UTF-8?q?ystem=20status=20snapshot?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Documents net-kingdom delivery state, sister-repo maturity from reuse.coulomb.social federation, capability ladder position, backlog, and cross-ecosystem coordination gaps as of 2026-07-08. --- STATUS.md | 330 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 330 insertions(+) create mode 100644 STATUS.md diff --git a/STATUS.md b/STATUS.md new file mode 100644 index 0000000..0a62229 --- /dev/null +++ b/STATUS.md @@ -0,0 +1,330 @@ +# NetKingdom Ecosystem Status + +> Living status for the NetKingdom identity and security platform and its +> sister repositories. Updated from repo workplans, State Hub, and the +> [reuse.coulomb.social](https://reuse.coulomb.social) federated capability +> registry. +> +> **Last updated:** 2026-07-08 + +--- + +## At a Glance + +| Area | Status | +|------|--------| +| **NetKingdom core** | Delivered — IAM Profile v0.2, bootstrap/custody arc, security console, boundary contracts | +| **Lightweight identity** | Stable — key-cape v0.1 complete; Authelia + LLDAP + privacyIDEA stack live | +| **Authorization** | Baseline complete — flex-auth PDP shipped; production `policy.enabled` still off pending ecosystem flip | +| **Operational access** | Production-verified — ops-warden SSH cert lane live on Railiance OpenBao | +| **User domain** | Planning arc complete — user-engine WP-0001–0019 finished; live stack wiring not yet evidenced | +| **Deployment substrate** | S2 stable (single-node k3s), S3 emerging (OpenBao + CNPG live), S5 first app operational | +| **Capability discovery** | Federation live — 61 capabilities across 62 workstation repos via reuse-surface | +| **Active NetKingdom backlog** | NK-WP-0009 (security tutorials), NK-WP-0011 (enterprise SAML federation) | + +**Bottom line:** The security spine is bootstrappable, standards are canonical, +and the lightweight identity + SSH access lanes are production-proven. The next +meaningful expansions are enterprise federation (expanded-mode Keycloak), +operator tutorials, flex-auth live enforcement, and user-engine production +integration. + +--- + +## NetKingdom (this repo) + +**Role:** Platform domain for identity and security — owns normative contracts, +bootstrap tooling, and meta-orchestration responsibility over the security +landscape. See `SCOPE.md`, `INTENT.md`, and `docs/responsibility-map.md`. + +### Maturity (reuse federation) + +| Capability | ID | Vector | Status | +|------------|-----|--------|--------| +| NetKingdom Security/IAM Tooling Suite | `capability.security.iam-tooling-suite` | D3 / A2 / C1 / R1 | draft | + +Source: [reuse.coulomb.social/v1/federated](https://reuse.coulomb.social/v1/federated) — net-kingdom index at `registry/indexes/capabilities.yaml`. + +### Delivered workplans + +| ID | Title | Notes | +|----|-------|-------| +| NK-WP-0001 | SSO & MFA Platform (Keycloak + privacyIDEA) | Archived — expanded-mode baseline | +| NK-WP-0002 | Local Identity (bootstrap OIDC) | Finished | +| NK-WP-0003 | KeyCape + privacyIDEA cluster deployment | Completed | +| NK-WP-0004 | Credential Management Foundation | Done | +| NK-WP-0005 | Agent-Driven Credential Bootstrap | Done | +| NK-WP-0006 | Recursive platform identity architecture | Finished | +| NK-WP-0007 | Object Storage STS credential vending | Finished | +| NK-WP-0008 | IT Security Architecture Patterns (infospace) | Done | +| NK-WP-0010 | Genesis Security Pattern Completion | Finished | +| NK-WP-0012 | NetKingdom IAM Profile Specification | Finished — `canon/standards/iam-profile_v0.2.md` | +| NK-WP-0013 | Playbook Capability Contract | Finished — `canon/standards/playbook-capability-contract_v0.1.md` | +| NK-WP-0014 | User Engine boundary contracts | Finished — `canon/standards/user-engine-boundary-contract_v0.1.md` | +| NET-WP-0015 | King Credential & OpenBao identity bootstrap | Finished | +| NET-WP-0016 | Guided Security Bootstrap Experience | Finished | +| NET-WP-0017 | IT Security Readiness for User Onboarding | Finished | +| NET-WP-0018 | Bootstrap Automation & Rebuild Readiness | Finished | +| NET-WP-0019 | User lifecycle dry-run polish | Finished | +| NET-WP-0020 | OpenBao unseal custody models & SSH automation | Finished — greenfield init/unseal proof 2026-07-02 | + +User-engine implementation workplans NK-WP-0015–0019 (isolated MVP through +conformance) are archived here but executed in `user-engine`. + +### Backlog + +| ID | Title | Status | Depends on | +|----|-------|--------|------------| +| NK-WP-0009 | NetKingdom Security Pattern Tutorials | backlog | NK-WP-0008 (done) | +| NK-WP-0011 | Enterprise Federation & SAML (expanded-mode Keycloak) | backlog | NK-WP-0003, 0004, 0006 | + +### Runnable artifacts + +| Artifact | Path | Purpose | +|----------|------|---------| +| IAM Profile conformance checker | `tools/iam-profile-conformance/` | Verify OIDC/PKCE claim shapes against v0.2 | +| Playbook capability contract validator | `tools/playbook-capability-contract/` | Validate scenario playbooks against v0.1 contract | +| Security bootstrap console | `tools/security-bootstrap-console/` | Custody gates, roster, evidence validators (non-secret) | +| Bootstrap agent | `sso-mfa/bootstrap/creds-bootstrap-agent.sh` | Unattended credential + OpenBao init/unseal (Phase 7b) | +| OpenBao init/unseal script | `sso-mfa/bootstrap/openbao-init-unseal.sh` | Greenfield-proven custody-gated init/unseal | + +### Key standards (canonical) + +- `canon/standards/iam-profile_v0.2.md` — OIDC/PKCE contract all apps target +- `canon/standards/playbook-capability-contract_v0.1.md` — meta-orchestration interface +- `canon/standards/user-engine-boundary-contract_v0.1.md` — user-domain integration +- `canon/standards/credential-management_v0.2.md` — credential lifecycle model +- `docs/platform-identity-security-architecture.md` — capability ladder C0–C6 + +--- + +## Capability Ladder Position + +NetKingdom's architecture progresses by capability tier, not user count +(`docs/platform-identity-security-architecture.md`): + +```text +C0 Bootstrap local identity ✅ NK-WP-0002 +C1 Lightweight SSO (KeyCape) ✅ NK-WP-0003, key-cape v0.1 +C2 MFA / 2FA ✅ privacyIDEA in KeyCape stack +C3 Runtime secrets (OpenBao) ✅ NET-WP-0015–0020, railiance-platform +C4 Fine-grained authorization 🟡 flex-auth baseline done; live enforcement pending +C5 User-domain service 🟡 user-engine WP arc done; production wiring pending +C6 Enterprise federation (SAML) ⏸ NK-WP-0011 backlog +``` + +--- + +## Sister Repositories + +### Identity & security runtime + +#### key-cape + +| | | +|---|---| +| **Purpose** | Lightweight IAM implementation of the NetKingdom IAM Profile (Authelia + LLDAP + privacyIDEA). | +| **Maturity** | `capability.iam.key-cape` — **D4 / A2 / C2 / R1** (draft) | +| **Workplans** | KEY-WP-0001–0003 all finished | +| **NetKingdom relation** | Primary lightweight implementer of `iam-profile_v0.2.md`; applications integrate against the profile, not KeyCape internals. | +| **Status** | Stable v0.1 — container image, acceptance suite, bootstrap console OIDC/MFA verification client shipped. | + +#### flex-auth + +| | | +|---|---| +| **Purpose** | Policy-as-code authorization registry and PDP — turns verified IAM claims into allow/deny decisions. | +| **Maturity** | `capability.authorization.policy-evaluate` — **D4 / A2 / C2 / R1** (draft) | +| **Workplans** | FLEX-WP-0001–0007 all finished | +| **NetKingdom relation** | Consumes NetKingdom IAM Profile claims; sits between identity and protected systems. First consumer: ops-warden SSH signing gate. | +| **Status** | Go service with `POST /v1/check` live; production deployment smoke verified 2026-06-29. **`policy.enabled` deliberately off** — gate verified but not live-enforced. | + +#### user-engine + +| | | +|---|---| +| **Purpose** | Headless user-domain service — accounts, memberships, profiles, projections; not an IdP or PDP. | +| **Maturity** | `capability.identity.user-engine` — **D4 / A1 / C2 / R0** (draft) | +| **Workplans** | USER-WP-0001–0019 all finished (Jun 2026) | +| **NetKingdom relation** | Governed by `user-engine-boundary-contract_v0.1.md` (NK-WP-0014). Consumes IAM claims; defers authZ to flex-auth. | +| **Status** | Full planning arc through Postgres durable store + conformance; **production integration with live key-cape/flex-auth not yet evidenced**. | + +#### ops-warden + +| | | +|---|---| +| **Purpose** | Operational access steward — short-lived SSH certs for `adm`/`agt`/`atm`; routes all other credential needs via `warden route`. | +| **Maturity** | `capability.security.ssh-certificate-issuance` — **D4 / A3 / C3 / R2** (draft) | +| **Workplans** | Through WARDEN-WP-0024 finished (Jul 2026) | +| **NetKingdom relation** | Operational face of the NetKingdom security model; maintains routing catalog aligned to NK canon. NetKingdom depends on it for the SSH lane but does not orchestrate its resources. | +| **Status** | Mission-complete for SSH lane. Production signing verified on `https://bao.coulomb.social`. `warden access` front door, audit trail, experiential memory shipped. | + +#### ops-bridge + +| | | +|---|---| +| **Purpose** | SSH reverse tunnel lifecycle manager — keeps remote agents connected to local State Hub. | +| **Maturity** | `capability.ops.tunnel-bridge` — **D3 / A2 / C2 / R1** (draft) | +| **Workplans** | BRIDGE-WP-0001–0005, OPS-WP-0001–0002 all finished | +| **NetKingdom relation** | Tunnel transport layer; consumes ops-warden certs via `cert_command`. | +| **Status** | v0.1 core complete (~80%). **`cert_command` live cutover on `agt-state-hub-bridge` pilot pending** — readiness gate shipped by ops-warden (WP-0016). | + +### Standards & canon + +#### info-tech-canon + +| | | +|---|---| +| **Purpose** | Markdown-first InfoTechCanon — evolving standards corpus (kernel, 11 domain models, CARING access-governance). | +| **Maturity** | `capability.infotech.canon-service` — **D2 / A2 / C1 / R0** (draft) | +| **Workplans** | ITC-WP-0001–0012 all finished | +| **NetKingdom relation** | Upstream semantic foundation for security posture canon (ops-warden WP-0015 landing), platform architecture patterns, user-engine evaluation pack. | +| **Status** | Seed kernel complete; **next target: Kernel RC1**. | + +#### identity-canon + +| | | +|---|---| +| **Purpose** | Implementation-neutral vocabulary for identity concepts across IAM, directory, federation, authorization. | +| **Workplans** | IDENTITY-WP-0001–0003 all finished | +| **NetKingdom relation** | Feeds terminology discipline for user-engine and broader IAM vocabulary. Complements net-kingdom normative contracts. | +| **Status** | Active research scaffold; next pass: source-note backfill and model revision. | + +### Deployment substrate (Railiance OAS) + +#### railiance-cluster (S2) + +| | | +|---|---| +| **Purpose** | Cluster runtime — k3s, Helm, ingress, cert-manager, operators on COULOMBCORE. | +| **Maturity** | `capability.railiance.cluster-bootstrap` — **D3 / A2 / C1 / R0** (draft) | +| **Workplans** | RAIL-BS-WP-0002–0006, RAILIANCE-WP-0012–0014 finished; RAIL-BS-WP-0008/0009 finished Jul 2026 | +| **NetKingdom relation** | Runtime substrate for SSO/MFA namespaces, CNPG operator, all security services. | +| **Status** | Single-node production stable. **Backlog:** RAIL-BS-WP-0007 ThreePhoenix HA cluster. | + +#### railiance-platform (S3) + +| | | +|---|---| +| **Purpose** | Platform services — PostgreSQL (CNPG), Valkey, OpenBao, object storage, identity integration point. | +| **Maturity** | `capability.railiance.platform-services` — **D3 / A2 / C1 / R0** (draft) | +| **Workplans** | RAILIANCE-WP-0005–0011 all finished | +| **NetKingdom relation** | Hosts OpenBao (runtime secret authority), credential broker, identity services integration surface. | +| **Status** | CNPG operator deployed; OpenBao platform secrets service live; `warden-sign` broker routing live 2026-07-01. | + +#### railiance-apps (S5) + +| | | +|---|---| +| **Purpose** | Workloads & experience endpoints — application Helm releases, deployment guardrails. | +| **Workplans** | RAIL-AP-WP-0001 through RAILIANCE-WP-0011 all finished | +| **NetKingdom relation** | Consumes platform identity integrations at S5 deployment layer. | +| **Status** | First app (`vergabe-teilnahme`) operational; Gitea/registry extracted to `railiance-forge`. No active workplans. | + +### Reuse & discovery + +#### reuse-surface + +| | | +|---|---| +| **Purpose** | Federated capability registry — discover, compare, validate, promote capabilities by D/A/C/R maturity vector. | +| **Maturity** | `capability.registry.register` D3/A4/C2/R3; `capability.registry.validate` D4/A3/C3/R3 | +| **Workplans** | REUSE-WP-0017–0019 finished (Jul 2026) | +| **NetKingdom relation** | Discovery layer for the ecosystem; net-kingdom registers `capability.security.iam-tooling-suite`. | +| **Status** | **62/62 workstation repos established**; production hub at `https://reuse.coulomb.social` (61 federated capabilities as of 2026-07-08). | + +#### open-reuse + +| | | +|---|---| +| **Purpose** | Managed continuity for valuable OSS integrations — structured update loops for proven integrations. | +| **Workplans** | OPEN-WP-0001–0004 all finished | +| **NetKingdom relation** | Adjacent reuse layer; complements reuse-surface's capability maturity registry. | +| **Status** | Foundation complete; CLI validator (`open-reuse validate`) shipped. | + +--- + +## Integration Flow + +```text +Bootstrap plane (net-kingdom) + local-identity / creds-bootstrap-agent / security-bootstrap-console + │ + ▼ +Platform control plane + key-cape (lightweight) ──or── Keycloak (expanded, NK-WP-0011 backlog) + │ verified IAM Profile claims + ▼ + flex-auth (authorization PDP) + │ allow/deny decisions + ▼ + protected systems (ops-warden SSH, Markitect, apps, …) + +Parallel lanes: + user-engine ← IAM claims (boundary contract NK-WP-0014) + OpenBao ← runtime secrets (railiance-platform, NET-WP-0020 custody models) + ops-warden ← SSH certs + credential routing front door + ops-bridge ← reverse tunnels (cert_command consumer) +``` + +Credential routing canon: agents call `warden route find` before requesting +secrets — ops-warden issues SSH certs only; all other credentials route to +owning subsystems (OpenBao, key-cape, flex-auth). See +`~/ops-warden/wiki/CredentialRouting.md`. + +--- + +## Cross-Ecosystem Gaps + +| Gap | Primary owners | Impact | +|-----|----------------|--------| +| flex-auth `policy.enabled` off in production | flex-auth, ops-warden | SSH signing gate verified but not live-enforced | +| ops-bridge `cert_command` live cutover | ops-bridge | Short-lived cert tunnels not yet production-default | +| NK-WP-0009 security pattern tutorials | net-kingdom | Operator/agent onboarding material missing | +| NK-WP-0011 SAML / enterprise federation | net-kingdom | Expanded-mode Keycloak identity broker not started | +| Workload Security Posture canon landing | net-kingdom, info-tech-canon | ops-warden drafted M0–M3 model; owner-driven landing pending | +| user-engine production integration | user-engine, key-cape, flex-auth | WP arc complete; live stack wiring not evidenced | +| railiance-cluster ThreePhoenix HA | railiance-cluster | Single-node stable; multi-node HA in backlog | +| info-tech-canon Kernel RC1 | info-tech-canon | Seed kernel complete; schema consolidation remaining | +| Unified tool packaging | net-kingdom | Three conformance tools lack single install path (reuse notes) | + +--- + +## Recent Milestones + +| Date | Event | +|------|-------| +| 2026-07-08 | NK-WP-0009 and NK-WP-0011 moved to backlog; reuse federation index refreshed (61 capabilities) | +| 2026-07-08 | reuse-surface REUSE-WP-0019 — Forgejo webhook automation + reuse telemetry | +| 2026-07-02 | NET-WP-0020 — OpenBao greenfield init/unseal proof; `bao write sys/unseal key=-` fix | +| 2026-07-01 | ops-warden `warden-sign` broker routing live on railiance-platform | +| 2026-06-29 | flex-auth FLEX-WP-0007 — production policy-gate smoke verified | +| 2026-06-18 | ops-warden production SSH signing verified on Railiance OpenBao | +| 2026-06 | user-engine USER-WP-0016–0019 — Postgres store + conformance; key-cape KEY-WP-0003 bootstrap console client | +| 2026-05 | NK-WP-0012 IAM Profile v0.2 canonical; NK-WP-0014 user-engine boundary contract | + +--- + +## State Hub + +- **API:** `http://127.0.0.1:8000` (local) / `http://127.0.0.1:18000` (tunnel) +- **Topic:** infotech (`cee7bedf-2b48-46ef-8601-006474f2ad7a`) +- **NetKingdom workplans in hub:** NK-WP-0009 and NK-WP-0011 registered as `backlog`; finished plans indexed under `net-kingdom-*` slugs + +Sync after workplan changes: + +```bash +statehub fix-consistency --repo net-kingdom +``` + +--- + +## How to Refresh This Document + +1. Scan `workplans/` and `workplans/archived/` for status changes. +2. Query State Hub: `curl -s "http://127.0.0.1:8000/workplans/?repo=net-kingdom"`. +3. Pull reuse federation: `curl -s "https://reuse.coulomb.social/v1/federated"`. +4. Check sister-repo `SCOPE.md` and `registry/indexes/capabilities.yaml`. +5. Update the **Last updated** date and relevant tables. + +Related orientation files: `SCOPE.md` (scope boundary), `.custodian-brief.md` +(auto-generated), `docs/responsibility-map.md` (orchestration relationships). \ No newline at end of file