From e15b61c074924f471aecf4249e7240ab97edd4fa Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 22:24:54 +0100 Subject: [PATCH] NK-WP-0055-T10: founder production-scope decisions; ADR-0018 defers Topaz Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- WORK-RECORDS.md | 2 +- ...18-access-engine-core-as-production-pdp.md | 65 +++++++++++++++++++ .../2026-10-27-production-readiness-ledger.md | 20 ++++-- ...-security-platform-production-readiness.md | 10 ++- 4 files changed, 89 insertions(+), 8 deletions(-) create mode 100644 docs/adr/ADR-0018-access-engine-core-as-production-pdp.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 0852e3f..beee9d6 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -327,7 +327,7 @@ | task | NK-WP-0055-T07 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-0055-T08 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-0055-T09 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | -| task | NK-WP-0055-T10 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T10 | done | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-0055-T11 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-0055-T12 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-0055-T13 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | diff --git a/docs/adr/ADR-0018-access-engine-core-as-production-pdp.md b/docs/adr/ADR-0018-access-engine-core-as-production-pdp.md new file mode 100644 index 0000000..9f65de0 --- /dev/null +++ b/docs/adr/ADR-0018-access-engine-core-as-production-pdp.md @@ -0,0 +1,65 @@ +--- +id: NK-ADR-0018 +type: architecture-decision-record +title: "The access-engine Core Is the Production PDP; Topaz Is Deferred" +status: accepted +owner: net-kingdom +revision: "1" +decided: "2026-10-27" +last_reviewed: "2026-10-27" +review_interval: 12m +amends: [NK-ADR-0006] +--- + +# ADR-0018 - access-engine Core as Production PDP + +**Status:** Accepted by Bernd Worsch on 2026-10-27, as hub decision `37464824-a939-415f-8a7a-5f81cbf498c8` +(NK-WP-0055-T10). +**Date:** 2026-10-27 +**Decider:** Bernd Worsch + +## Context + +ADR-0006 and `docs/platform-identity-security-architecture.md` name Topaz as the first delegated policy decision point +(PDP) behind flex-auth, now access-engine. In practice Topaz exists only as an adapter shape (FLEX-WP-0004), and nothing +deploys it. Every live decision comes from the access-engine Go core. + +The core already provides: + +- tenant scope; +- relationship facts and inherited access; +- check, list-allowed and explain; +- caller authentication. + +The core was shaped to Topaz's policy-plus-directory model from the start. The production readiness ledger (NK-WP-0055-T01) +lists the Topaz runtime as an open area. + +## Decision + +- The access-engine Go core is the production PDP. A delegated Topaz runtime is not required for production readiness, and + that readiness area is an accepted exception. +- The PDP readiness checks still apply, but they are now run against the core: + - health; + - data freshness; + - policy load status; + - fail-closed behaviour, verified per consumer through each consumer's `pep-stance.yaml`. +- The policy import gap that Topaz bundles would have closed moves to NK-WP-0055-T14. Either policies load without an image + rebuild, or rebuild-and-deploy is accepted as the import path. +- Topaz is no longer an expected audit source (NK-WP-0055-T11). +- Topaz is deferred, not rejected. ADR-0006's rule still holds for any future delegated PDP: it evaluates policy, and it + never becomes the canonical policy model, the identity provider or the control plane. + +## Revisit when + +- a tenant needs per-object sharing, or relationship data outgrows the core's relationship facts; +- the number of tenants or the depth of group nesting makes core evaluation a bottleneck; +- policy changes become too frequent for the T14 import path; +- the production declaration (NK-WP-0055-T09) reviews its accepted exceptions. + +## Consequences + +- There is one less runtime to operate, back up, audit and drill. +- Authorization availability is coupled to access-engine. HA is out of scope by the same decision. +- Reversibility is high: adding Topaz later extends the system rather than rebuilding it. +- Where `docs/platform-identity-security-architecture.md` describes Topaz as the first delegated PDP, read it with this + amendment. diff --git a/docs/evidence/2026-10-27-production-readiness-ledger.md b/docs/evidence/2026-10-27-production-readiness-ledger.md index c74f146..e711e0d 100644 --- a/docs/evidence/2026-10-27-production-readiness-ledger.md +++ b/docs/evidence/2026-10-27-production-readiness-ledger.md @@ -15,18 +15,30 @@ Builder-mode acceptances count as **partial**. The definition is in | # | Area | Status | Gap carried by | |---|---|---|---| -| 1 | Platform root custody | partial | T10 (decisions), NK-WP-0054-T07 | +| 1 | Platform root custody | partial (single-holder custody: accepted exception) | T13, NK-WP-0054-T07 | | 2 | MFA and identity | partial | RPF-WP-0065-T04 (SI-X4), NK-WP-0054-T04/T05/T06, T12 | | 3 | Bootstrap and recovery | partial | T02–T04, T07 (NK-WP-0053), T08 | -| 4 | OpenBao runtime secrets | partial | T10, T07 (RPF-WP-0036-T03), T12 | +| 4 | OpenBao runtime secrets | partial (manual Shamir unseal approved) | T07 (RPF-WP-0036-T03), T12 | | 5 | Secret rotation | partial | T06, T15, RPF-WP-0035, RPF-WP-0055-T01 | | 6 | flex-auth (access-engine) policy state | partial | T14, FLEX-WP-0031, FLEX-WP-0024 | -| 7 | Topaz runtime | open | T10 (is Topaz required?), then T14 | +| 7 | Topaz runtime | **accepted exception** (ADR-0018: the core is the production PDP) | T12 (core checks), T14 | | 8 | Tenant onboarding | partial | T11, T12 | | 9 | Audit sink | open | T11, AUDIT-WP-0013-T02, AUDIT-WP-0015-T01 | | 10 | Break-glass | open | T13 | -None of the ten areas is met. Three are open. +None of the ten areas is met. One is an accepted exception (7), and two are open (9, 10). + + +## Founder decisions, 2026-10-27 (hub decision `37464824`, NK-WP-0055-T10) + +| Decision | Effect on the ledger | +|---|---| +| (a) Manual Shamir unseal is the approved production mechanism for now. | Area 4's unseal gap is closed. Its other gaps remain. | +| (b) Topaz is not required. The access-engine Go core is the production PDP ([ADR-0018](../adr/ADR-0018-access-engine-core-as-production-pdp.md)). | Area 7 is an accepted exception. Its health, freshness, load and fail-closed checks move to the core under T12, and Topaz leaves the T11 audit sources. | +| (c) The founder, as platform-root, holds all OpenBao unseal shares. This is an accepted exception to two-of-three custody. | Area 1's escrow gap becomes an exception. Item 4 (the offline king path with SSO down) stays open under T13. | +| (d) HA is out of scope for now. | No area changes. | + +Each exception is reviewed at the production declaration (T09). ## Per area diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md index 4b515d0..94117b4 100644 --- a/workplans/NK-WP-0055-security-platform-production-readiness.md +++ b/workplans/NK-WP-0055-security-platform-production-readiness.md @@ -233,10 +233,11 @@ their recorded hashes, or the founder accepts single-copy custody as an exceptio ```task id: NK-WP-0055-T10 -status: todo +status: done priority: high assignee: claude-code needs_human: true +decision_id: "37464824-a939-415f-8a7a-5f81cbf498c8" ``` Decide what production requires: @@ -249,6 +250,8 @@ Decide what production requires: 2026-10-27 founder answers: (a) manual Shamir unseal is the approved mechanism for now; (c) the founder, as platform-root, holds the OpenBao unseal shares (single holder; two-of-three escrow holders not named); (d) HA stays out of scope for now. (b) Topaz is pending an explanation of the accepted-exception consequences. + +2026-10-27: done. (b) accepted as an exception: the access-engine core is the production PDP, Topaz is deferred ([ADR-0018](../docs/adr/ADR-0018-access-engine-core-as-production-pdp.md)); (c) single-holder custody accepted as an exception. All answers are in hub decision `37464824` and the ledger. Exceptions are reviewed at T09. ## Get every audit source into the durable sink with one correlation id ```task @@ -261,7 +264,7 @@ state_hub_task_id: "93caa9e0-3d28-58ac-808a-47e15fe6d6ab" Owners are audit-core (receiving), railiance-platform (OpenBao audit forwarding), railiance-cluster (Kubernetes API audit), access-engine (AUDIT-WP-0013-T02 registration) and NetKingdom (identity-provider events and the correlation-id contract). -Topaz joins only if T10 keeps it. +Topaz is not a source (ADR-0018). **Done when:** each owner has a task in its own workplan; identity, authorization, OpenBao, Kubernetes and workload records land durably; one correlation id is defined and tested across the onboarding chain; audit-core has a recurring restore drill and @@ -278,7 +281,8 @@ state_hub_task_id: "c93fa290-663a-582c-a5b2-beb876fcff1e" ``` **Done when:** dated receipts exist for the live IAM issuer conformance run (NK-WP-0054-T04), caller-auth enforcement on every -access-engine release unit (only ops-warden is proven today), the live OpenBao auth methods and mounts against the committed +access-engine release unit (only ops-warden is proven today), the access-engine core's health, data freshness, policy load +status and per-consumer fail-closed stance (ADR-0018), the live OpenBao auth methods and mounts against the committed policies, and the tenant onboarding completion test for `tenant:coulomb`. ## Record and drill break-glass with SSO down