coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(canon): reconcile workload and tenant grouping semantics
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
This commit is contained in:
tegwick 2026-08-22 14:53:31 +02:00
parent ad2057acff
commit bee22db620
21 changed files with 1118 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

230
canon/schemas/tenancy-posture_v0.1.schema.json
View file

@ -21,6 +21,9 @@
"type": "string",
"minLength": 1
},
"workload_identity": {
"$ref": "#/$defs/workloadIdentity"
},
"tenancy": {
"$ref": "#/$defs/tenancy"
},
@ -28,7 +31,7 @@
"$ref": "#/$defs/provider"
},
"zones": {
"description": "Reserved for security-zone membership (tenancy-posture_v0.1 Decision 5.6). Its internal shape is defined by the NetKingdom security-zone standard drafted by zone-engine, not by this schema, and is deliberately unconstrained here until that standard lands. Present so a conformant combined declaration is not rejected by this validator."
"$ref": "#/$defs/zoneDeclaration"
},
"evidence": {
"$ref": "#/$defs/evidence"
@ -83,6 +86,16 @@
"provider"
]
},
{
"required": [
"workload_identity"
]
},
{
"required": [
"zones"
]
},
{
"required": [
"evidence"
@ -92,12 +105,30 @@
}
}
],
"allOf": [
{
"if": {
"required": [
"zones"
]
},
"then": {
"required": [
"workload_identity"
]
}
}
],
"additionalProperties": false,
"$defs": {
"serviceName": {
"type": "string",
"pattern": "^[a-z0-9][a-z0-9._-]*$"
},
"repoName": {
"type": "string",
"pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
},
"axisName": {
"enum": [
"I",
@ -209,6 +240,183 @@
"minLength": 1
}
},
"identityBinding": {
"type": "object",
"required": [
"scheme",
"authority",
"subject",
"principal_type"
],
"properties": {
"scheme": {
"type": "string",
"pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
"description": "Identity mechanism, for example iam-profile, kubernetes-service-account, ssh-certificate, or openbao-auth-role."
},
"authority": {
"type": "string",
"minLength": 1,
"description": "Authoritative issuer or registry for this principal."
},
"subject": {
"type": "string",
"minLength": 1,
"description": "Exact principal value asserted by the authority."
},
"principal_type": {
"enum": [
"service",
"agent"
],
"description": "IAM Profile principal type. A human identity is caller context and cannot be the sole workload identity."
},
"environment": {
"type": "string",
"minLength": 1
},
"evidence": {
"$ref": "#/$defs/stringList"
}
},
"additionalProperties": false
},
"workloadIdentity": {
"type": "object",
"required": [
"name",
"kind",
"responsible_repo",
"identity_bindings"
],
"properties": {
"name": {
"$ref": "#/$defs/serviceName",
"description": "Stable workload id. It must equal the containing service field."
},
"kind": {
"enum": [
"application",
"platform-service",
"automation",
"operational-control-plane",
"maintenance-job"
]
},
"responsible_repo": {
"$ref": "#/$defs/repoName",
"description": "Repository accountable for the workload identity and zone declaration."
},
"declaration_ref": {
"type": "string",
"minLength": 1,
"description": "Authoritative owner declaration. Required by RMGR-ADR-004 for a managed deployable, for example rapp-user-engine/declarations/rapp.yaml."
},
"identity_bindings": {
"type": "array",
"minItems": 1,
"items": {
"$ref": "#/$defs/identityBinding"
}
}
},
"additionalProperties": false
},
"zoneEvidence": {
"type": "object",
"required": [
"ref",
"supports"
],
"properties": {
"ref": {
"type": "string",
"minLength": 1
},
"supports": {
"type": "array",
"minItems": 1,
"uniqueItems": true,
"items": {
"type": "string",
"minLength": 1
}
}
},
"additionalProperties": false
},
"zoneDeclaration": {
"type": "object",
"required": [
"standard",
"membership",
"responsible_party",
"justification",
"context",
"evidence",
"reviewed",
"review_due"
],
"properties": {
"standard": {
"const": "security-zones_v0.1"
},
"membership": {
"enum": [
"z0-experimental",
"z1-operational",
"z2-protected",
"z3-critical",
"z2-continuity"
]
},
"responsible_party": {
"type": "string",
"minLength": 1
},
"justification": {
"type": "string",
"minLength": 1
},
"context": {
"type": "object",
"required": [
"maturity",
"criticality",
"data_classification"
],
"properties": {
"maturity": {
"enum": ["M0", "M1", "M2", "M3"]
},
"criticality": {
"enum": ["low", "medium", "high", "critical", "n/a"]
},
"data_classification": {
"type": "string",
"minLength": 1
}
},
"additionalProperties": false
},
"evidence": {
"type": "array",
"minItems": 1,
"items": {
"$ref": "#/$defs/zoneEvidence"
}
},
"reviewed": {
"type": "string",
"format": "date"
},
"review_due": {
"type": "string",
"format": "date"
}
},
"additionalProperties": false
},
"paths": {
"type": "object",
"propertyNames": {
@ -408,6 +616,9 @@
"type": "string",
"minLength": 1
},
"workload_identity": {
"$ref": "#/$defs/workloadIdentity"
},
"tenancy": {
"$ref": "#/$defs/tenancy"
},
@ -419,8 +630,25 @@
},
"notes": {
"$ref": "#/$defs/stringList"
},
"zones": {
"$ref": "#/$defs/zoneDeclaration"
}
},
"allOf": [
{
"if": {
"required": [
"zones"
]
},
"then": {
"required": [
"workload_identity"
]
}
}
],
"additionalProperties": false
}
}