coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T03b: declarations and validator migrated to canon grants (draft-3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Schema, validator, fixtures, declarations and tests (40 pass) now use the imported
principal_type and authority grants MODE @ SCOPE with activation and environments,
estate conventions bind and service-admin, unknown placeholders, and an elimination
path on every exception. SI-4 and SI-7 became decidable. Before/after over the same
declarations: 1/11/2/5/6 to 1/10/2/5/7 (non-conformant/unknown/excepted/planned/
conformant); the only move is KeyCape's secrets-engine-openbao client, whose scope is
established. lldap/admin is now also excepted under SI-4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 23:35:30 +02:00
parent 956a7e11a6
commit ac66753bd4
18 changed files with 528 additions and 230 deletions
Download patch file Download diff file Expand all files Collapse all files

48
tools/service-identity/declarations/keycape.yaml
View file

@ -9,9 +9,11 @@ attestation:
complete: false
identities:
- name: secrets-engine-openbao
classes: [workload]
purpose: "Confidential OIDC client; scopes openbao:login only (deny openbao:admin)"
privilege_level: unknown
principal_type: SERVICE
purpose: "Confidential OIDC client; obtains a login token whose only scope is openbao:login"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: USE, scope: openbao, activation: STANDING, environments: [PRODUCTION], note: "scope openbao:login only; openbao:admin denied"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -20,9 +22,11 @@ identities:
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
status: active
- name: secrets-engine-approval
classes: [workload]
purpose: "Confidential OIDC client; scopes not established in the repository"
privilege_level: unknown
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -31,9 +35,11 @@ identities:
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
status: active
- name: secrets-engine-requester
classes: [workload]
purpose: "Confidential OIDC client; scopes not established in the repository"
privilege_level: unknown
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -42,9 +48,11 @@ identities:
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, secrets-engine]}
status: active
- name: approval-engine-operator
classes: [workload]
purpose: "Confidential OIDC client; scopes not established in the repository"
privilege_level: unknown
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -53,9 +61,11 @@ identities:
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, approval-engine]}
status: active
- name: informed-decision-sitting-requester
classes: [workload]
purpose: "Confidential OIDC client; scopes not established in the repository"
privilege_level: unknown
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]
@ -64,9 +74,11 @@ identities:
rotation: {path: "Mint in custody, then deliver (credential broker); KeyCape reads it at start", coupling: [keycape, informed-decision-sitting]}
status: active
- name: rapp-qonto
classes: [workload]
purpose: "Confidential OIDC client; scopes not established in the repository"
privilege_level: unknown
principal_type: SERVICE
purpose: "Confidential OIDC client; its token scopes are not established in the repository"
grants:
- {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
- {mode: unknown, scope: "token scopes", note: "not established in the repository"}
interactive_login: false
second_factor: not_applicable
custody: [delivered-secret]