feat(orchestration): compose security scenarios

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

workplans/NK-WP-0030-deterministic-security-scenario-composition.md

@@ -0,0 +1,93 @@
+---
+id: NK-WP-0030
+type: workplan
+title: "Implement deterministic security scenario composition"
+domain: infotech
+repo: net-kingdom
+status: blocked
+owner: codex
+topic_slug: netkingdom
+planning_priority: P1
+created: "2026-08-23"
+updated: "2026-08-23"
+---
+
+# NK-WP-0030 — Deterministic security scenario composition
+
+Authorized by the operator as the first implementation increment following the
+2026-08-23 scope-to-intent gap assessment. This work closes the locally owned
+part of G1 without moving playbook execution into NetKingdom.
+
+## Define the scenario composition contract
+
+```task
+id: NK-WP-0030-T01
+status: done
+priority: high
+```
+
+Published proposed `security-scenario-composition_v0.1` canon and its scenario
+schema. It requires exact provider pins under ambiguity, explicit initial trust,
+fail-closed sequencing, owner attribution, readiness obligations, and an
+unconditional non-execution boundary.
+
+## Implement the canonical composer
+
+```task
+id: NK-WP-0030-T02
+status: done
+priority: high
+```
+
+Implemented `tools/security-scenario-composer/`. It consumes Playbook Capability
+Contract v0.1 declarations, rejects invalid or ambiguous inputs, validates
+authority-bound parameter overrides, orders selected declarations by explicit
+trust transitions, and emits a deterministic owner-routed JSON plan with a
+content digest and `execution.permitted: false`. The older conformance-demo
+selector now also refuses ambiguity and overrides targeting unselected
+declarations.
+
+## Publish a C0 reference composition
+
+```task
+id: NK-WP-0030-T03
+status: done
+priority: high
+```
+
+Published `capabilities/playbooks/net-kingdom.local-identity.yaml` and
+`examples/security-scenarios/c0-local-identity.yaml`. The non-secret reference
+selects the exact local provider, starts from explicit `bare_host_trust`, and
+plans the readiness obligations for `bootstrap_identity_trust` without
+executing the CLI entry point.
+
+## Obtain lightweight-provider declarations
+
+```task
+id: NK-WP-0030-T04
+status: wait
+priority: high
+```
+
+Ask the KeyCape/Railiance owners to publish conformant C1 and selected C2
+declarations beside their execution entry points. Do not fabricate provider
+authority in NetKingdom. The complete lightweight SSO scenario remains blocked
+until those declarations exist and pass the canonical composer. Routed to
+`key-cape` in State Hub message `64d247e4-9170-4d18-b7ed-d8b071282104`.
+
+## Verify the fail-closed and reference paths
+
+```task
+id: NK-WP-0030-T05
+status: done
+priority: medium
+```
+
+Added ten composer tests and five regression tests for the legacy declaration
+validator/demo selector, including secret-reference syntax enforcement.
+Exact selection, ambiguity refusal, bad pins, override boundaries, duplicate
+ids, dependency ordering, unresolved trust, responsibility/readiness mapping,
+and the checked-in C0 composition pass. The complete relevant repository suite
+passes 70 tests; the isolated local-identity suite passes 142 tests. JSON/YAML
+parsing, Python compilation, the reference CLI, and `git diff --check` also
+pass.