coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(orchestration): compose KeyCape C1 and C2b
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
This commit is contained in:
tegwick 2026-08-23 13:24:55 +02:00
parent 21f477f699
commit 7f4e4e9f57
8 changed files with 133 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/NK-WP-0030-deterministic-security-scenario-composition.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Implement deterministic security scenario composition"
domain: infotech
repo: net-kingdom
status: blocked
status: finished
owner: codex
topic_slug: netkingdom
planning_priority: P1
@ -69,7 +69,7 @@ executing the CLI entry point.
```task
id: NK-WP-0030-T04
status: wait
status: done
priority: high
state_hub_task_id: "41fd145d-7a37-5c65-ae72-142ac6d49144"
```
@ -80,6 +80,15 @@ authority in NetKingdom. The complete lightweight SSO scenario remains blocked
until those declarations exist and pass the canonical composer. Routed to
`key-cape` in State Hub message `64d247e4-9170-4d18-b7ed-d8b071282104`.
KeyCape published the authoritative C1 and C2b declarations at revision
`34fadae` and notified NetKingdom in State Hub message
`1d5f5f15-d137-4c11-8386-c8cc58c17bb8`. Both pass the canonical declaration
validator. `examples/security-scenarios/c1-c2b-key-cape.yaml` pins the exact
providers, sequences C1 before C2b through `runtime_identity_trust`, and emits
plan digest
`sha256:cd7aeba3c83c83e2de7bc9a64d2dd9922f4f39a4de81c41760f9f9a431a820a6`
with execution forbidden. C2a remains outside the scenario and is not implied.
## Verify the fail-closed and reference paths
```task
@ -89,11 +98,11 @@ priority: medium
state_hub_task_id: "7db26092-35c4-52c6-9a3e-3f24bc3e26c7"
```
Added ten composer tests and five regression tests for the legacy declaration
Added eleven composer tests and five regression tests for the legacy declaration
validator/demo selector, including secret-reference syntax enforcement.
Exact selection, ambiguity refusal, bad pins, override boundaries, duplicate
ids, dependency ordering, unresolved trust, responsibility/readiness mapping,
and the checked-in C0 composition pass. The complete relevant repository suite
passes 70 tests; the isolated local-identity suite passes 142 tests. JSON/YAML
parsing, Python compilation, the reference CLI, and `git diff --check` also
pass.
and the checked-in C0 and KeyCape C1+C2b compositions pass. The current root
repository suite passes 88 tests; the isolated local-identity suite passes 142
tests. JSON/YAML parsing, Python compilation, both reference CLI paths, and
`git diff --check` also pass.