coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0048: canon accepted; SecurityCaseType schemas, validator and template (T01, T03)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
security-case-types_v0.1 accepted by the founder 2026-10-08. Adds JSON schemas
for types and cases, tools/security-case-types/security_case_validator.py
(validate-type, validate-case, render via the scenario composer, plan-only),
and a runnable _template type with README sections, an example case and tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
tegwick 2026-10-08 22:29:13 +02:00
parent dcacdf57f3
commit d8cf42bab6
11 changed files with 1122 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

34
tools/security-case-types/README.md Normal file
View file

@ -0,0 +1,34 @@
# security-case-types tools
Validator and renderer for SecurityCaseTypes and SecurityCases
(`canon/standards/security-case-types_v0.1.md`, schemas
`canon/schemas/security-case-type_v0.1.schema.json` and
`security-case_v0.1.schema.json`).
```bash
# a type directory: type.yaml, README.md sections, tests, example cases
python3 tools/security-case-types/security_case_validator.py validate-type security-case-types/<type-id>
# a case against its type (security-case-types/<type-id>/type.yaml)
python3 tools/security-case-types/security_case_validator.py validate-case <case.yaml> --types security-case-types
# render a case into the composer's plan plus materialization, follow-through,
# verification and rollback; execution is never permitted
python3 tools/security-case-types/security_case_validator.py render <case.yaml> \
--types security-case-types capabilities/playbooks/*.yaml
```
Only `implemented` types accept cases. `--allow-unimplemented` exists for a type's
own example cases while the type is being written and acknowledged.
The validator refuses, among other things: missing sections, unknown or unpinned
capabilities, attended steps without justification, steps or materialized items
without a rollback, verification without a negative check or that reads a value,
templates with unknown parameters, credential-shaped values anywhere, secret
parameters that are not custody references, and high-risk types without founder
acceptance.
To start a type: copy `security-case-types/_template/`, rename the directory to
the type id, and rewrite every section. The template's tests travel with it.
Tests: `python3 -m pytest tools/security-case-types/tests security-case-types/*/tests`.