coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(orchestration): compose security scenarios
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
This commit is contained in:
tegwick 2026-08-23 12:40:52 +02:00
parent ad46cc89fc
commit d96aab2321
20 changed files with 1464 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

16
SCOPE.md
View file

@ -42,6 +42,8 @@ about the current implementation.
model.
- Playbook Capability Contract v0.1 for the boundary between NetKingdom
selection/parameterization and Railiance execution.
- Security Scenario Composition v0.1 for deterministic provider selection,
trust ordering, responsibility mapping, and non-executing owner handoff.
- Tenancy Posture v0.1 and Security Zones v0.1 proposed standards, their schemas,
validators, evidence rules, and publication stewardship. Zone semantics are
owned by `zone-engine`; NetKingdom owns their canon publication.
@ -54,6 +56,9 @@ about the current implementation.
development, test, and sandbox use.
- IAM Profile, playbook-capability, tenancy-posture, custody, evidence, and
bootstrap-policy validators.
- `tools/security-scenario-composer/`: fail-closed, plan-only composition of
declared capabilities, parameters, trust transitions, responsibilities, and
readiness obligations.
- `tools/security-bootstrap-console/`: guarded platform-root and OpenBao
bootstrap workflow, including refusal of unsafe live initialization.
- SOPS/age bootstrap integration, credential-generation and rotation helpers,
@ -99,7 +104,7 @@ repositories while NetKingdom retains the contracts and reference evidence.
| Tier | Current repository/estate capability | Delivery state |
| --- | --- | --- |
| C0 — Bootstrap identity | Local OIDC identity, SOPS/age bootstrap, guarded credential workflow, and greenfield OpenBao init/unseal proof | Implemented as reference/bootstrap tooling |
| C0 — Bootstrap identity | Local OIDC identity, SOPS/age bootstrap, guarded credential workflow, greenfield OpenBao init/unseal proof, and deterministic plan-only C0 composition | Implemented as reference/bootstrap tooling |
| C1 — Lightweight SSO | IAM-profile-based KeyCape composition using Authelia and LLDAP | Live-proven integration; implementation externally owned |
| C2 — MFA/token authority | Authelia factors and privacyIDEA integration | Live-proven integration; implementation externally owned |
| C3 — Runtime secrets | OpenBao custody, bootstrap, policy, delivery, and recovery contracts | Integrated with an externally deployed runtime; production evidence remains gated |
@ -110,7 +115,9 @@ repositories while NetKingdom retains the contracts and reference evidence.
Current open work as of 2026-08-23 is either externally blocked, date-gated, or
explicit backlog: reef carrier/public-classification decisions in NK-WP-0027,
the NK-WP-0022 retirement gate, security tutorials in NK-WP-0009, and
enterprise federation in NK-WP-0011.
enterprise federation in NK-WP-0011. NK-WP-0030 has delivered the local C0
scenario-composition slice and waits for externally owned C1/C2 provider
declarations before the lightweight SSO scenario can compose.
---
@ -144,7 +151,7 @@ enterprise federation in NK-WP-0011.
```capability
type: governance
title: NetKingdom security canon
description: Provider-neutral IAM v0.3, user/tenant boundaries, credential, playbook-composition, tenancy-posture, and workload-zone standards with explicit ownership and conformance rules.
description: Provider-neutral IAM v0.3, user/tenant boundaries, credential, playbook and scenario composition, tenancy-posture, and workload-zone standards with explicit ownership and conformance rules.
keywords: [iam, oidc, tenancy, workload-identity, security-zones, credentials, canon]
```
@ -184,5 +191,6 @@ keywords: [meta-orchestration, railiance, responsibility, capability, trust-stat
`docs/openbao-unseal-custody-models.md`, and
`tools/security-bootstrap-console/`
- Executable surfaces: `local-identity/`, `tools/iam-profile-conformance/`,
`tools/playbook-capability-contract/`, and `tools/tenancy-posture/`
`tools/playbook-capability-contract/`, `tools/security-scenario-composer/`,
and `tools/tenancy-posture/`
- Work state: `.custodian-brief.md` and `workplans/`