coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T03b: declarations and validator migrated to canon grants (draft-3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Schema, validator, fixtures, declarations and tests (40 pass) now use the imported
principal_type and authority grants MODE @ SCOPE with activation and environments,
estate conventions bind and service-admin, unknown placeholders, and an elimination
path on every exception. SI-4 and SI-7 became decidable. Before/after over the same
declarations: 1/11/2/5/6 to 1/10/2/5/7 (non-conformant/unknown/excepted/planned/
conformant); the only move is KeyCape's secrets-engine-openbao client, whose scope is
established. lldap/admin is now also excepted under SI-4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 23:35:30 +02:00
parent 956a7e11a6
commit ac66753bd4
18 changed files with 528 additions and 230 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -142,7 +142,7 @@ SI-10 and SI-13 are not decidable from a declaration.
```task
id: NK-WP-0054-T03b
status: todo
status: done
priority: medium
assignee: claude-code
depends_on: [NK-WP-0054-T03]
@ -158,6 +158,23 @@ same non-conformant, excepted and unknown accounts unless a difference is explai
**Done when:** the schema expresses principal type and grants, the declarations follow §3 of the standard,
the tests pass, and a before/after comparison is recorded.
Completed 2026-10-24. Schema, validator, fixtures, declarations and tests (40 pass) follow draft-3: imported
`principal_type`, grants `MODE @ SCOPE` with activation and environments, estate conventions `bind` and
`service-admin`, `unknown` placeholders, and an `elimination_path` on every exception. SI-4 and SI-7 became
decidable. Before/after, as of 2026-10-24 over the same eight declarations:
| Result | Draft-2 fields | Draft-3 grants |
| --- | --- | --- |
| non-conformant | 1 | 1 (`openbao/coding-agent`, SI-14) |
| unknown | 11 | 10 |
| excepted | 2 | 2 (`lldap/admin` SI-X1, `openbao/netkingdom-platform-admin` SI-X4) |
| planned | 5 | 5 |
| conformant | 6 | 7 |
The only account that moved is KeyCape's `secrets-engine-openbao` client, unknown to conformant: its scope
(`openbao:login` only) is established, so it can be stated as a grant instead of an unknown privilege level.
`lldap/admin` is now also excepted under SI-4, which grants made decidable; SI-X1 lists it.
## Live conformance health check
```task