feat(orchestration): compose security scenarios

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

canon/schemas/security-scenario_v0.1.schema.json

@@ -0,0 +1,78 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://netkingdom.local/schemas/security-scenario_v0.1.schema.json",
+  "title": "NetKingdom Security Scenario v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "authority", "requires"],
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^scenario:[a-z0-9][a-z0-9._:-]*$"
+    },
+    "authority": {
+      "enum": ["platform", "netkingdom", "tenant"]
+    },
+    "initial_trust": {
+      "$ref": "#/$defs/trustStates"
+    },
+    "requires": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["capabilities"],
+      "properties": {
+        "capabilities": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"$ref": "#/$defs/capability"}
+        }
+      }
+    },
+    "providers": {
+      "type": "object",
+      "propertyNames": {"$ref": "#/$defs/capability"},
+      "additionalProperties": {"type": "string", "minLength": 1}
+    },
+    "parameter_overrides": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object"
+      }
+    }
+  },
+  "$defs": {
+    "capability": {
+      "enum": [
+        "s1.os-baseline",
+        "s1.secret-bootstrap",
+        "s2.cluster-runtime",
+        "s3.platform-services",
+        "c0.bootstrap-identity",
+        "c1.lightweight-sso",
+        "c2a.light-2fa",
+        "c2b.token-authority",
+        "c3.runtime-secrets",
+        "c4.fine-grained-authorization",
+        "c5.enterprise-federation",
+        "c6.self-optimizing-audit"
+      ]
+    },
+    "trustStates": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "enum": [
+          "bare_host_trust",
+          "cluster_trust",
+          "bootstrap_secret_trust",
+          "bootstrap_identity_trust",
+          "runtime_secret_trust",
+          "runtime_identity_trust",
+          "runtime_authorization_trust",
+          "tenant_onboarding_trust"
+        ]
+      }
+    }
+  }
+}