feat(orchestration): compose KeyCape C1 and C2b

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

tools/security-scenario-composer/README.md

@@ -17,6 +17,20 @@ python3 tools/security-scenario-composer/security_scenario_composer.py \
   capabilities/playbooks/net-kingdom.local-identity.yaml
 ```
 
+Compose the KeyCape C1 plus C2b reference from its authoritative sibling
+declarations:
+
+```bash
+python3 tools/security-scenario-composer/security_scenario_composer.py \
+  --scenario examples/security-scenarios/c1-c2b-key-cape.yaml \
+  ../key-cape/capabilities/playbooks/key-cape.lightweight-sso.yaml \
+  ../key-cape/capabilities/playbooks/key-cape.privacyidea-token-authority.yaml
+```
+
+The scenario pins both provider ids. NetKingdom does not copy or reinterpret
+their execution authority; the emitted plan retains `execution.permitted:
+false` and routes readiness to the declaration owners.
+
 Run tests:
 
 ```bash

tools/security-scenario-composer/tests/test_security_scenario_composer.py

@@ -264,3 +264,44 @@ def test_checked_in_c0_scenario_composes():
         "c0.bootstrap-identity": "net-kingdom.local-identity"
     }
     assert plan["execution_steps"][0]["repo"] == "net-kingdom"
+
+
+def test_checked_in_key_cape_scenario_sequences_c1_before_c2b(tmp_path):
+    repo_root = Path(__file__).resolve().parents[3]
+    scenario_path = repo_root / "examples/security-scenarios/c1-c2b-key-cape.yaml"
+    c1_data = declaration_data(
+        "key-cape.lightweight-sso",
+        "c1.lightweight-sso",
+        "C1",
+        requires=["cluster_trust", "runtime_secret_trust"],
+        satisfies=["runtime_identity_trust"],
+    )
+    c1_data["metadata"]["owner"] = "key-cape"
+    c1_data["metadata"]["repo"] = "key-cape"
+    c2b_data = declaration_data(
+        "key-cape.privacyidea-token-authority",
+        "c2b.token-authority",
+        "C2b",
+        requires=["runtime_identity_trust", "runtime_secret_trust"],
+        satisfies=["runtime_identity_trust"],
+    )
+    c2b_data["metadata"]["owner"] = "key-cape"
+    c2b_data["metadata"]["repo"] = "key-cape"
+    declarations = [
+        declaration(tmp_path, c2b_data, "c2b.yaml"),
+        declaration(tmp_path, c1_data, "c1.yaml"),
+    ]
+
+    request = composer.contract.load_yaml(scenario_path)
+    issues, plan = composer.compose_scenario(declarations, request)
+
+    assert messages(issues) == []
+    assert plan["capability_providers"] == {
+        "c1.lightweight-sso": "key-cape.lightweight-sso",
+        "c2b.token-authority": "key-cape.privacyidea-token-authority",
+    }
+    assert [step["declaration_id"] for step in plan["execution_steps"]] == [
+        "key-cape.lightweight-sso",
+        "key-cape.privacyidea-token-authority",
+    ]
+    assert plan["execution"]["permitted"] is False