feat(orchestration): compose security scenarios

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

registry/capabilities/capability.security.iam-tooling-suite.md

@@ -1,9 +1,8 @@
 ---
 id: capability.security.iam-tooling-suite
 name: NetKingdom Security/IAM Tooling Suite
-summary: Dynamic, self-optimizing security platform for Kubernetes-deployed IT infrastructure; owns canonical
-  IAM/security standards and executable conformance tooling (IAM profile conformance, playbook capability
-  contract validation, security bootstrap console).
+summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation,
+  and deterministic plan-only security scenario composition.
 owner: net-kingdom
 status: draft
 domain: infotech
@@ -17,17 +16,17 @@ maturity:
     current: D3
     target: D5
     confidence: medium
-    rationale: README plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit
+    rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit
       integration boundary with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon,
-      and State Hub; canon/standards/ holds versioned standards (iam-profile_v0.2.md, playbook-capability-contract_v0.1.md)
-      that key-cape and other repos implement against.
+      and State Hub; canon/standards/ holds versioned IAM v0.3, playbook capability, scenario composition,
+      tenancy, zone, and boundary standards that provider repos implement against.
   availability:
     current: A2
     target: A3
     confidence: medium
-    rationale: 'No top-level package manifest, but tools/ holds three real, independently documented and
-      runnable tools: iam-profile-conformance (executable checks, pytest fixtures), playbook-capability-contract
-      (executable validator), and security-bootstrap-console (local console + localhost web UI).'
+    rationale: 'No top-level package manifest, but tools/ holds independently documented and runnable
+      conformance, posture, scenario-composition, and guarded bootstrap tools; local-identity is separately
+      packaged and tested.'
 external_evidence:
   completeness:
     level: C1
@@ -35,7 +34,7 @@ external_evidence:
     basis: scope_vs_intent_and_consumer_expectations
     satisfied_expectations:
     - versioned canon standards already implemented by a sibling repo (key-cape)
-    - three documented, runnable conformance/bootstrap tools under tools/
+    - documented, runnable conformance, posture, composition, and bootstrap tools under tools/
     broken_expectations: []
     out_of_scope_expectations: []
   reliability:
@@ -46,13 +45,16 @@ external_evidence:
     - no top-level packaging; each tool under tools/ has its own runtime dependencies, no unified install
       path yet
 discovery:
-  intent: Own the canonical IAM/security standards for the Coulomb ecosystem and provide executable conformance
-    tooling so implementers (like key-cape) can verify against the standard rather than guessing.
+  intent: Own canonical NetKingdom security semantics and provide executable reference and conformance tooling
+    so provider implementations can integrate without inferred authority or hidden deployment coupling.
   includes:
-  - canon/standards/ versioned IAM and playbook-capability-contract standards
+  - canon/standards/ versioned IAM, tenancy, zone, credential, boundary, and composition standards
   - IAM profile conformance checker
   - playbook capability contract validator
+  - deterministic plan-only security scenario composer
+  - tenancy posture schema and validator
   - security bootstrap console (local, non-secret-collecting)
+  - packaged local bootstrap identity CLI
   excludes:
   - concrete IAM implementations themselves (see key-cape for lightweight mode)
   - live secret value handling (bootstrap console explicitly refuses live OpenBao initialization)
@@ -65,7 +67,10 @@ availability:
   current_artifacts:
   - tools/iam-profile-conformance
   - tools/playbook-capability-contract
+  - tools/security-scenario-composer
+  - tools/tenancy-posture
   - tools/security-bootstrap-console
+  - local-identity
   target_artifacts: []
   consumption_modes:
   - cli
@@ -98,17 +103,28 @@ promotion_history: []
 
 ## Overview
 
-`net-kingdom` provides a dynamic, self-optimizing security platform for Kubernetes-deployed infrastructure. It owns the canonical IAM and security standards (implemented by sibling repos like `key-cape`) and ships three executable conformance/bootstrap tools under `tools/`: IAM profile conformance checks, a playbook capability contract validator, and a non-secret-collecting security bootstrap console.
+`net-kingdom` provides canonical IAM and security architecture, executable
+conformance and posture checks, deterministic plan-only scenario composition,
+a local bootstrap identity package, and a non-secret-collecting security
+bootstrap console. Provider implementations remain in sibling repositories such
+as `key-cape`; the self-optimizing platform remains an intent rather than a
+current delivery claim.
 
 ## Assessment notes
 
 ### Discovery
 
-README plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit integration boundary with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, and State Hub; canon/standards/ holds versioned standards (iam-profile_v0.2.md, playbook-capability-contract_v0.1.md) that key-cape and other repos implement against.
+SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an
+explicit integration boundary with OpenBao, flex-auth, user-engine, ops-warden,
+ops-bridge, info-tech-canon, and State Hub. `canon/standards/` holds the current
+IAM v0.3 and related boundary, posture, zone, credential, playbook, and scenario
+composition standards.
 
 ### Availability
 
-No top-level package manifest, but tools/ holds three real, independently documented and runnable tools: iam-profile-conformance (executable checks, pytest fixtures), playbook-capability-contract (executable validator), and security-bootstrap-console (local console + localhost web UI).
+No top-level package manifest exists. The independently runnable surfaces are
+documented under `tools/`, and `local-identity` has its own package manifest and
+test environment.
 
 ### Completeness
 

registry/indexes/capabilities.yaml

@@ -1,12 +1,11 @@
 version: 1
-updated: '2026-07-06'
+updated: '2026-08-23'
 domain: helix_forge
 capabilities:
 - id: capability.security.iam-tooling-suite
   name: NetKingdom Security/IAM Tooling Suite
-  summary: Dynamic, self-optimizing security platform for Kubernetes-deployed IT infrastructure; owns
-    canonical IAM/security standards and executable conformance tooling (IAM profile conformance, playbook
-    capability contract validation, security bootstrap console).
+  summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture
+    validation, and deterministic plan-only security scenario composition.
   vector: D3 / A2 / C1 / R1
   domain: infotech
   status: draft