feat(orchestration): compose security scenarios

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

capabilities/playbooks/net-kingdom.local-identity.yaml

@@ -0,0 +1,114 @@
+apiVersion: netkingdom.io/playbook-capability/v0.1
+kind: PlaybookCapabilityDeclaration
+metadata:
+  id: net-kingdom.local-identity
+  name: NetKingdom local bootstrap identity
+  owner: net-kingdom
+  repo: net-kingdom
+  domain: infotech
+  contract_version: "0.1"
+  source_links:
+    - label: implementation
+      path: local-identity/
+    - label: workplan
+      path: workplans/archived/260702-NK-WP-0002-local-identity.md
+spec:
+  playbook:
+    path: local-identity/
+    type: cli-sequence
+    invocation: uv run --project local-identity local-identity init
+    description: Initialize and serve the loopback-only bootstrap OIDC identity store.
+  capabilities:
+    - id: c0.bootstrap-identity
+      tier: C0
+      resource_kinds:
+        - identities
+        - secrets_credentials
+      description: Provide a local OIDC issuer before the managed runtime identity plane exists.
+  parameters:
+    - name: local_identity_home
+      type: string
+      required: false
+      default: .local/local-identity
+      constraints:
+        pattern: ^[^\n\r]+$
+      sensitivity: operational
+      tuning_authority: netkingdom_tunable
+      description: LOCAL_IDENTITY_HOME used by the owning execution environment.
+    - name: bootstrap_username
+      type: string
+      required: true
+      constraints:
+        pattern: ^[a-z_][a-z0-9_-]{0,31}$
+      sensitivity: operational
+      tuning_authority: netkingdom_tunable
+      description: Bootstrap username passed to local-identity init.
+    - name: bootstrap_fullname
+      type: string
+      required: true
+      constraints:
+        pattern: ^[^\n\r]{1,120}$
+      sensitivity: operational
+      tuning_authority: netkingdom_tunable
+      description: Display name passed to local-identity init.
+    - name: bootstrap_email
+      type: string
+      required: true
+      constraints:
+        pattern: ^[^@\s]+@[^@\s]+$
+      sensitivity: operational
+      tuning_authority: netkingdom_tunable
+      description: Bootstrap email passed to local-identity init.
+    - name: listen_port
+      type: integer
+      required: false
+      default: 8443
+      constraints:
+        minimum: 1024
+        maximum: 65535
+      sensitivity: operational
+      tuning_authority: netkingdom_tunable
+      description: Loopback port passed to local-identity serve.
+    - name: token_ttl_seconds
+      type: integer
+      required: false
+      default: 3600
+      constraints:
+        minimum: 60
+        maximum: 3600
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Maximum bootstrap access-token lifetime.
+  responsibilities:
+    - resource_kind: identities
+      owner: net-kingdom
+      resources:
+        - local-identity:bootstrap-store
+        - local-identity:loopback-oidc-issuer
+      repo_owns: Local store initialization, loopback issuer behavior, token lifecycle, and security checks.
+      netkingdom_orchestrates: Select C0, provide non-secret bootstrap identity inputs, and require readiness evidence.
+    - resource_kind: secrets_credentials
+      owner: net-kingdom
+      resources:
+        - local-identity:signing-key
+        - local-identity:filesystem-permissions
+      repo_owns: Generate local signing material and enforce private filesystem permissions.
+      netkingdom_orchestrates: Constrain the store location and retain secret values outside the scenario plan.
+  trust:
+    requires:
+      - state: bare_host_trust
+        readiness_checks: []
+    satisfies:
+      - state: bootstrap_identity_trust
+        readiness_checks:
+          - id: local-identity-permissions
+            description: The local identity store and signing material have private permissions.
+            evidence: local-identity security-check exits zero
+          - id: local-identity-discovery
+            description: The loopback issuer serves OIDC discovery at the planned issuer URL.
+            evidence: discovery document is fetched from loopback and its issuer matches the planned port
+  catalog:
+    publish: capabilities/playbooks/net-kingdom.local-identity.yaml
+    maturity: implemented-reference
+    consumers:
+      - netkingdom-security-scenario-composer