From cd8a633ad9a7a82e8f66bfdc1a4a21d12be2b256 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 8 Jul 2026 13:19:06 +0200 Subject: [PATCH] Remove STATUS.md; SCOPE.md is the canonical orientation doc STATUS.md duplicated SCOPE.md intent. Drop the file and point README orientation at SCOPE.md only. --- README.md | 6 +- SCOPE.md | 8 +- STATUS.md | 330 ------------------------------------------------------ 3 files changed, 6 insertions(+), 338 deletions(-) delete mode 100644 STATUS.md diff --git a/README.md b/README.md index 0b422bb..71cead2 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,9 @@ NetKingdom provides a dynamic self optimizing full circle security-platform for kubernetes deployed IT-infrastructures. -## Status & Orientation +## Orientation -- [STATUS.md](STATUS.md) — ecosystem status snapshot for net-kingdom and sister - repos (workplan delivery, capability ladder, reuse federation) -- [SCOPE.md](SCOPE.md) — what this repo owns and when it is relevant +- [SCOPE.md](SCOPE.md) — what this repo owns, current state, and when it is relevant ## Security Infrastructure Documents diff --git a/SCOPE.md b/SCOPE.md index 4fd559c..9a125fa 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -83,8 +83,8 @@ NetKingdom is a self-optimizing security platform for Kubernetes-based IT infras OpenBao init/unseal proof 2026-07-02); production custody models are gated by evidence - Usage: foundational authentication layer for all NetKingdom deployments -- Ecosystem snapshot: `STATUS.md` (sister-repo maturity via - [reuse.coulomb.social](https://reuse.coulomb.social)) +- Sister-repo maturity: [reuse.coulomb.social](https://reuse.coulomb.social) + federated capability registry --- @@ -145,8 +145,8 @@ keywords: [bootstrap, local-identity, oidc, minimal, dev, sandbox] ## Getting Oriented -- Start with: `STATUS.md` (ecosystem snapshot), `wiki/` (specifications and - decisions), `DECISIONS.md` (key architectural choices D1–D5) +- Start with: `wiki/` (specifications and decisions), `DECISIONS.md` (key + architectural choices D1–D5) - Key files / directories: `docs/platform-root-custody.md`, `sso-mfa/` (SSO/MFA platform + bootstrap scripts), `local-identity/`, `tools/security-bootstrap-console/`, `workplans/` (finished plans in diff --git a/STATUS.md b/STATUS.md deleted file mode 100644 index 0a62229..0000000 --- a/STATUS.md +++ /dev/null @@ -1,330 +0,0 @@ -# NetKingdom Ecosystem Status - -> Living status for the NetKingdom identity and security platform and its -> sister repositories. Updated from repo workplans, State Hub, and the -> [reuse.coulomb.social](https://reuse.coulomb.social) federated capability -> registry. -> -> **Last updated:** 2026-07-08 - ---- - -## At a Glance - -| Area | Status | -|------|--------| -| **NetKingdom core** | Delivered — IAM Profile v0.2, bootstrap/custody arc, security console, boundary contracts | -| **Lightweight identity** | Stable — key-cape v0.1 complete; Authelia + LLDAP + privacyIDEA stack live | -| **Authorization** | Baseline complete — flex-auth PDP shipped; production `policy.enabled` still off pending ecosystem flip | -| **Operational access** | Production-verified — ops-warden SSH cert lane live on Railiance OpenBao | -| **User domain** | Planning arc complete — user-engine WP-0001–0019 finished; live stack wiring not yet evidenced | -| **Deployment substrate** | S2 stable (single-node k3s), S3 emerging (OpenBao + CNPG live), S5 first app operational | -| **Capability discovery** | Federation live — 61 capabilities across 62 workstation repos via reuse-surface | -| **Active NetKingdom backlog** | NK-WP-0009 (security tutorials), NK-WP-0011 (enterprise SAML federation) | - -**Bottom line:** The security spine is bootstrappable, standards are canonical, -and the lightweight identity + SSH access lanes are production-proven. The next -meaningful expansions are enterprise federation (expanded-mode Keycloak), -operator tutorials, flex-auth live enforcement, and user-engine production -integration. - ---- - -## NetKingdom (this repo) - -**Role:** Platform domain for identity and security — owns normative contracts, -bootstrap tooling, and meta-orchestration responsibility over the security -landscape. See `SCOPE.md`, `INTENT.md`, and `docs/responsibility-map.md`. - -### Maturity (reuse federation) - -| Capability | ID | Vector | Status | -|------------|-----|--------|--------| -| NetKingdom Security/IAM Tooling Suite | `capability.security.iam-tooling-suite` | D3 / A2 / C1 / R1 | draft | - -Source: [reuse.coulomb.social/v1/federated](https://reuse.coulomb.social/v1/federated) — net-kingdom index at `registry/indexes/capabilities.yaml`. - -### Delivered workplans - -| ID | Title | Notes | -|----|-------|-------| -| NK-WP-0001 | SSO & MFA Platform (Keycloak + privacyIDEA) | Archived — expanded-mode baseline | -| NK-WP-0002 | Local Identity (bootstrap OIDC) | Finished | -| NK-WP-0003 | KeyCape + privacyIDEA cluster deployment | Completed | -| NK-WP-0004 | Credential Management Foundation | Done | -| NK-WP-0005 | Agent-Driven Credential Bootstrap | Done | -| NK-WP-0006 | Recursive platform identity architecture | Finished | -| NK-WP-0007 | Object Storage STS credential vending | Finished | -| NK-WP-0008 | IT Security Architecture Patterns (infospace) | Done | -| NK-WP-0010 | Genesis Security Pattern Completion | Finished | -| NK-WP-0012 | NetKingdom IAM Profile Specification | Finished — `canon/standards/iam-profile_v0.2.md` | -| NK-WP-0013 | Playbook Capability Contract | Finished — `canon/standards/playbook-capability-contract_v0.1.md` | -| NK-WP-0014 | User Engine boundary contracts | Finished — `canon/standards/user-engine-boundary-contract_v0.1.md` | -| NET-WP-0015 | King Credential & OpenBao identity bootstrap | Finished | -| NET-WP-0016 | Guided Security Bootstrap Experience | Finished | -| NET-WP-0017 | IT Security Readiness for User Onboarding | Finished | -| NET-WP-0018 | Bootstrap Automation & Rebuild Readiness | Finished | -| NET-WP-0019 | User lifecycle dry-run polish | Finished | -| NET-WP-0020 | OpenBao unseal custody models & SSH automation | Finished — greenfield init/unseal proof 2026-07-02 | - -User-engine implementation workplans NK-WP-0015–0019 (isolated MVP through -conformance) are archived here but executed in `user-engine`. - -### Backlog - -| ID | Title | Status | Depends on | -|----|-------|--------|------------| -| NK-WP-0009 | NetKingdom Security Pattern Tutorials | backlog | NK-WP-0008 (done) | -| NK-WP-0011 | Enterprise Federation & SAML (expanded-mode Keycloak) | backlog | NK-WP-0003, 0004, 0006 | - -### Runnable artifacts - -| Artifact | Path | Purpose | -|----------|------|---------| -| IAM Profile conformance checker | `tools/iam-profile-conformance/` | Verify OIDC/PKCE claim shapes against v0.2 | -| Playbook capability contract validator | `tools/playbook-capability-contract/` | Validate scenario playbooks against v0.1 contract | -| Security bootstrap console | `tools/security-bootstrap-console/` | Custody gates, roster, evidence validators (non-secret) | -| Bootstrap agent | `sso-mfa/bootstrap/creds-bootstrap-agent.sh` | Unattended credential + OpenBao init/unseal (Phase 7b) | -| OpenBao init/unseal script | `sso-mfa/bootstrap/openbao-init-unseal.sh` | Greenfield-proven custody-gated init/unseal | - -### Key standards (canonical) - -- `canon/standards/iam-profile_v0.2.md` — OIDC/PKCE contract all apps target -- `canon/standards/playbook-capability-contract_v0.1.md` — meta-orchestration interface -- `canon/standards/user-engine-boundary-contract_v0.1.md` — user-domain integration -- `canon/standards/credential-management_v0.2.md` — credential lifecycle model -- `docs/platform-identity-security-architecture.md` — capability ladder C0–C6 - ---- - -## Capability Ladder Position - -NetKingdom's architecture progresses by capability tier, not user count -(`docs/platform-identity-security-architecture.md`): - -```text -C0 Bootstrap local identity ✅ NK-WP-0002 -C1 Lightweight SSO (KeyCape) ✅ NK-WP-0003, key-cape v0.1 -C2 MFA / 2FA ✅ privacyIDEA in KeyCape stack -C3 Runtime secrets (OpenBao) ✅ NET-WP-0015–0020, railiance-platform -C4 Fine-grained authorization 🟡 flex-auth baseline done; live enforcement pending -C5 User-domain service 🟡 user-engine WP arc done; production wiring pending -C6 Enterprise federation (SAML) ⏸ NK-WP-0011 backlog -``` - ---- - -## Sister Repositories - -### Identity & security runtime - -#### key-cape - -| | | -|---|---| -| **Purpose** | Lightweight IAM implementation of the NetKingdom IAM Profile (Authelia + LLDAP + privacyIDEA). | -| **Maturity** | `capability.iam.key-cape` — **D4 / A2 / C2 / R1** (draft) | -| **Workplans** | KEY-WP-0001–0003 all finished | -| **NetKingdom relation** | Primary lightweight implementer of `iam-profile_v0.2.md`; applications integrate against the profile, not KeyCape internals. | -| **Status** | Stable v0.1 — container image, acceptance suite, bootstrap console OIDC/MFA verification client shipped. | - -#### flex-auth - -| | | -|---|---| -| **Purpose** | Policy-as-code authorization registry and PDP — turns verified IAM claims into allow/deny decisions. | -| **Maturity** | `capability.authorization.policy-evaluate` — **D4 / A2 / C2 / R1** (draft) | -| **Workplans** | FLEX-WP-0001–0007 all finished | -| **NetKingdom relation** | Consumes NetKingdom IAM Profile claims; sits between identity and protected systems. First consumer: ops-warden SSH signing gate. | -| **Status** | Go service with `POST /v1/check` live; production deployment smoke verified 2026-06-29. **`policy.enabled` deliberately off** — gate verified but not live-enforced. | - -#### user-engine - -| | | -|---|---| -| **Purpose** | Headless user-domain service — accounts, memberships, profiles, projections; not an IdP or PDP. | -| **Maturity** | `capability.identity.user-engine` — **D4 / A1 / C2 / R0** (draft) | -| **Workplans** | USER-WP-0001–0019 all finished (Jun 2026) | -| **NetKingdom relation** | Governed by `user-engine-boundary-contract_v0.1.md` (NK-WP-0014). Consumes IAM claims; defers authZ to flex-auth. | -| **Status** | Full planning arc through Postgres durable store + conformance; **production integration with live key-cape/flex-auth not yet evidenced**. | - -#### ops-warden - -| | | -|---|---| -| **Purpose** | Operational access steward — short-lived SSH certs for `adm`/`agt`/`atm`; routes all other credential needs via `warden route`. | -| **Maturity** | `capability.security.ssh-certificate-issuance` — **D4 / A3 / C3 / R2** (draft) | -| **Workplans** | Through WARDEN-WP-0024 finished (Jul 2026) | -| **NetKingdom relation** | Operational face of the NetKingdom security model; maintains routing catalog aligned to NK canon. NetKingdom depends on it for the SSH lane but does not orchestrate its resources. | -| **Status** | Mission-complete for SSH lane. Production signing verified on `https://bao.coulomb.social`. `warden access` front door, audit trail, experiential memory shipped. | - -#### ops-bridge - -| | | -|---|---| -| **Purpose** | SSH reverse tunnel lifecycle manager — keeps remote agents connected to local State Hub. | -| **Maturity** | `capability.ops.tunnel-bridge` — **D3 / A2 / C2 / R1** (draft) | -| **Workplans** | BRIDGE-WP-0001–0005, OPS-WP-0001–0002 all finished | -| **NetKingdom relation** | Tunnel transport layer; consumes ops-warden certs via `cert_command`. | -| **Status** | v0.1 core complete (~80%). **`cert_command` live cutover on `agt-state-hub-bridge` pilot pending** — readiness gate shipped by ops-warden (WP-0016). | - -### Standards & canon - -#### info-tech-canon - -| | | -|---|---| -| **Purpose** | Markdown-first InfoTechCanon — evolving standards corpus (kernel, 11 domain models, CARING access-governance). | -| **Maturity** | `capability.infotech.canon-service` — **D2 / A2 / C1 / R0** (draft) | -| **Workplans** | ITC-WP-0001–0012 all finished | -| **NetKingdom relation** | Upstream semantic foundation for security posture canon (ops-warden WP-0015 landing), platform architecture patterns, user-engine evaluation pack. | -| **Status** | Seed kernel complete; **next target: Kernel RC1**. | - -#### identity-canon - -| | | -|---|---| -| **Purpose** | Implementation-neutral vocabulary for identity concepts across IAM, directory, federation, authorization. | -| **Workplans** | IDENTITY-WP-0001–0003 all finished | -| **NetKingdom relation** | Feeds terminology discipline for user-engine and broader IAM vocabulary. Complements net-kingdom normative contracts. | -| **Status** | Active research scaffold; next pass: source-note backfill and model revision. | - -### Deployment substrate (Railiance OAS) - -#### railiance-cluster (S2) - -| | | -|---|---| -| **Purpose** | Cluster runtime — k3s, Helm, ingress, cert-manager, operators on COULOMBCORE. | -| **Maturity** | `capability.railiance.cluster-bootstrap` — **D3 / A2 / C1 / R0** (draft) | -| **Workplans** | RAIL-BS-WP-0002–0006, RAILIANCE-WP-0012–0014 finished; RAIL-BS-WP-0008/0009 finished Jul 2026 | -| **NetKingdom relation** | Runtime substrate for SSO/MFA namespaces, CNPG operator, all security services. | -| **Status** | Single-node production stable. **Backlog:** RAIL-BS-WP-0007 ThreePhoenix HA cluster. | - -#### railiance-platform (S3) - -| | | -|---|---| -| **Purpose** | Platform services — PostgreSQL (CNPG), Valkey, OpenBao, object storage, identity integration point. | -| **Maturity** | `capability.railiance.platform-services` — **D3 / A2 / C1 / R0** (draft) | -| **Workplans** | RAILIANCE-WP-0005–0011 all finished | -| **NetKingdom relation** | Hosts OpenBao (runtime secret authority), credential broker, identity services integration surface. | -| **Status** | CNPG operator deployed; OpenBao platform secrets service live; `warden-sign` broker routing live 2026-07-01. | - -#### railiance-apps (S5) - -| | | -|---|---| -| **Purpose** | Workloads & experience endpoints — application Helm releases, deployment guardrails. | -| **Workplans** | RAIL-AP-WP-0001 through RAILIANCE-WP-0011 all finished | -| **NetKingdom relation** | Consumes platform identity integrations at S5 deployment layer. | -| **Status** | First app (`vergabe-teilnahme`) operational; Gitea/registry extracted to `railiance-forge`. No active workplans. | - -### Reuse & discovery - -#### reuse-surface - -| | | -|---|---| -| **Purpose** | Federated capability registry — discover, compare, validate, promote capabilities by D/A/C/R maturity vector. | -| **Maturity** | `capability.registry.register` D3/A4/C2/R3; `capability.registry.validate` D4/A3/C3/R3 | -| **Workplans** | REUSE-WP-0017–0019 finished (Jul 2026) | -| **NetKingdom relation** | Discovery layer for the ecosystem; net-kingdom registers `capability.security.iam-tooling-suite`. | -| **Status** | **62/62 workstation repos established**; production hub at `https://reuse.coulomb.social` (61 federated capabilities as of 2026-07-08). | - -#### open-reuse - -| | | -|---|---| -| **Purpose** | Managed continuity for valuable OSS integrations — structured update loops for proven integrations. | -| **Workplans** | OPEN-WP-0001–0004 all finished | -| **NetKingdom relation** | Adjacent reuse layer; complements reuse-surface's capability maturity registry. | -| **Status** | Foundation complete; CLI validator (`open-reuse validate`) shipped. | - ---- - -## Integration Flow - -```text -Bootstrap plane (net-kingdom) - local-identity / creds-bootstrap-agent / security-bootstrap-console - │ - ▼ -Platform control plane - key-cape (lightweight) ──or── Keycloak (expanded, NK-WP-0011 backlog) - │ verified IAM Profile claims - ▼ - flex-auth (authorization PDP) - │ allow/deny decisions - ▼ - protected systems (ops-warden SSH, Markitect, apps, …) - -Parallel lanes: - user-engine ← IAM claims (boundary contract NK-WP-0014) - OpenBao ← runtime secrets (railiance-platform, NET-WP-0020 custody models) - ops-warden ← SSH certs + credential routing front door - ops-bridge ← reverse tunnels (cert_command consumer) -``` - -Credential routing canon: agents call `warden route find` before requesting -secrets — ops-warden issues SSH certs only; all other credentials route to -owning subsystems (OpenBao, key-cape, flex-auth). See -`~/ops-warden/wiki/CredentialRouting.md`. - ---- - -## Cross-Ecosystem Gaps - -| Gap | Primary owners | Impact | -|-----|----------------|--------| -| flex-auth `policy.enabled` off in production | flex-auth, ops-warden | SSH signing gate verified but not live-enforced | -| ops-bridge `cert_command` live cutover | ops-bridge | Short-lived cert tunnels not yet production-default | -| NK-WP-0009 security pattern tutorials | net-kingdom | Operator/agent onboarding material missing | -| NK-WP-0011 SAML / enterprise federation | net-kingdom | Expanded-mode Keycloak identity broker not started | -| Workload Security Posture canon landing | net-kingdom, info-tech-canon | ops-warden drafted M0–M3 model; owner-driven landing pending | -| user-engine production integration | user-engine, key-cape, flex-auth | WP arc complete; live stack wiring not evidenced | -| railiance-cluster ThreePhoenix HA | railiance-cluster | Single-node stable; multi-node HA in backlog | -| info-tech-canon Kernel RC1 | info-tech-canon | Seed kernel complete; schema consolidation remaining | -| Unified tool packaging | net-kingdom | Three conformance tools lack single install path (reuse notes) | - ---- - -## Recent Milestones - -| Date | Event | -|------|-------| -| 2026-07-08 | NK-WP-0009 and NK-WP-0011 moved to backlog; reuse federation index refreshed (61 capabilities) | -| 2026-07-08 | reuse-surface REUSE-WP-0019 — Forgejo webhook automation + reuse telemetry | -| 2026-07-02 | NET-WP-0020 — OpenBao greenfield init/unseal proof; `bao write sys/unseal key=-` fix | -| 2026-07-01 | ops-warden `warden-sign` broker routing live on railiance-platform | -| 2026-06-29 | flex-auth FLEX-WP-0007 — production policy-gate smoke verified | -| 2026-06-18 | ops-warden production SSH signing verified on Railiance OpenBao | -| 2026-06 | user-engine USER-WP-0016–0019 — Postgres store + conformance; key-cape KEY-WP-0003 bootstrap console client | -| 2026-05 | NK-WP-0012 IAM Profile v0.2 canonical; NK-WP-0014 user-engine boundary contract | - ---- - -## State Hub - -- **API:** `http://127.0.0.1:8000` (local) / `http://127.0.0.1:18000` (tunnel) -- **Topic:** infotech (`cee7bedf-2b48-46ef-8601-006474f2ad7a`) -- **NetKingdom workplans in hub:** NK-WP-0009 and NK-WP-0011 registered as `backlog`; finished plans indexed under `net-kingdom-*` slugs - -Sync after workplan changes: - -```bash -statehub fix-consistency --repo net-kingdom -``` - ---- - -## How to Refresh This Document - -1. Scan `workplans/` and `workplans/archived/` for status changes. -2. Query State Hub: `curl -s "http://127.0.0.1:8000/workplans/?repo=net-kingdom"`. -3. Pull reuse federation: `curl -s "https://reuse.coulomb.social/v1/federated"`. -4. Check sister-repo `SCOPE.md` and `registry/indexes/capabilities.yaml`. -5. Update the **Last updated** date and relevant tables. - -Related orientation files: `SCOPE.md` (scope boundary), `.custodian-brief.md` -(auto-generated), `docs/responsibility-map.md` (orchestration relationships). \ No newline at end of file