docs(reuse): establish reviewed NetKingdom security capabilities
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
parent
1a36e857cc
commit
e99c3e9791
7 changed files with 658 additions and 87 deletions
100
registry/capabilities/capability.security.bootstrap-recovery.md
Normal file
100
registry/capabilities/capability.security.bootstrap-recovery.md
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
---
|
||||
id: capability.security.bootstrap-recovery
|
||||
owner: net-kingdom
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A2
|
||||
target: A2
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: Local identity, bootstrap console,
|
||||
encrypted custody handoff and caller tools. Availability describes the delivery
|
||||
form, not production acceptance. Source repairs and disposable native fixtures
|
||||
do not prove estate root isolation or recovery.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Guarded bootstrap and recovery preparation
|
||||
summary: Local identity, bootstrap console, encrypted custody handoff and caller tools.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: Local identity, bootstrap console, encrypted custody handoff and caller
|
||||
tools
|
||||
includes:
|
||||
- Local identity, bootstrap console, encrypted custody handoff and caller tools
|
||||
excludes:
|
||||
- Source repairs and disposable native fixtures do not prove estate root isolation
|
||||
or recovery
|
||||
use_cases:
|
||||
- 'U10: Operator recovers identity, custody or data with independently held recovery
|
||||
material'
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A2
|
||||
current_artifacts:
|
||||
- tools/security-bootstrap-console/README.md
|
||||
- tools/custody-record/README.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.practice-canon
|
||||
- capability.security.doctrine-review
|
||||
- capability.iam.key-cape
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.registry.register
|
||||
specializes:
|
||||
- capability.security.iam-tooling-suite
|
||||
evidence:
|
||||
documentation:
|
||||
- tools/security-bootstrap-console/README.md
|
||||
- tools/custody-record/README.md
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Operator recovers identity, custody or data with independently held recovery material
|
||||
not_recommended_for:
|
||||
- Source repairs and disposable native fixtures do not prove estate root isolation
|
||||
or recovery
|
||||
known_limitations:
|
||||
- Source repairs and disposable native fixtures do not prove estate root isolation
|
||||
or recovery
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Guarded bootstrap and recovery preparation
|
||||
|
||||
Local identity, bootstrap console, encrypted custody handoff and caller tools.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Source repairs and disposable native fixtures do not prove estate root isolation or recovery.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U10: Operator recovers identity, custody or data with independently held recovery material
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [tools/security-bootstrap-console/README.md](../../tools/security-bootstrap-console/README.md)
|
||||
- [tools/custody-record/README.md](../../tools/custody-record/README.md)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
110
registry/capabilities/capability.security.case-contracts.md
Normal file
110
registry/capabilities/capability.security.case-contracts.md
Normal file
|
|
@ -0,0 +1,110 @@
|
|||
---
|
||||
id: capability.security.case-contracts
|
||||
owner: net-kingdom
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A2
|
||||
target: A2
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: Versioned types, cases and schema
|
||||
validation. Availability describes the delivery form, not production acceptance.
|
||||
Type acknowledgment, case acceptance, structural materialization and native
|
||||
execution are distinct.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Security case types and instance validation
|
||||
summary: Versioned types, cases and schema validation.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: Versioned types, cases and schema validation
|
||||
includes:
|
||||
- Versioned types, cases and schema validation
|
||||
excludes:
|
||||
- Type acknowledgment, case acceptance, structural materialization and native execution
|
||||
are distinct
|
||||
use_cases:
|
||||
- 'U01: Architect composes a security deployment from explicit owner contracts and
|
||||
case types'
|
||||
- 'U05: Operator provisions and delivers a scoped workload credential through the
|
||||
approved owner lane'
|
||||
- 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity'
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A2
|
||||
current_artifacts:
|
||||
- tools/security-case-types/README.md
|
||||
- canon/standards/security-case-types_v0.1.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.practice-canon
|
||||
- capability.security.doctrine-review
|
||||
- capability.iam.key-cape
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.registry.register
|
||||
specializes:
|
||||
- capability.security.iam-tooling-suite
|
||||
evidence:
|
||||
documentation:
|
||||
- tools/security-case-types/README.md
|
||||
- canon/standards/security-case-types_v0.1.md
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Architect composes a security deployment from explicit owner contracts and case
|
||||
types
|
||||
- Operator provisions and delivers a scoped workload credential through the approved
|
||||
owner lane
|
||||
- Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity
|
||||
not_recommended_for:
|
||||
- Type acknowledgment, case acceptance, structural materialization and native execution
|
||||
are distinct
|
||||
known_limitations:
|
||||
- Type acknowledgment, case acceptance, structural materialization and native execution
|
||||
are distinct
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Security case types and instance validation
|
||||
|
||||
Versioned types, cases and schema validation.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Type acknowledgment, case acceptance, structural materialization and native execution are distinct.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U01: Architect composes a security deployment from explicit owner contracts and case types
|
||||
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
|
||||
- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [tools/security-case-types/README.md](../../tools/security-case-types/README.md)
|
||||
- [canon/standards/security-case-types_v0.1.md](../../canon/standards/security-case-types_v0.1.md)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
---
|
||||
id: capability.security.emission-profile
|
||||
owner: net-kingdom
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A2
|
||||
target: A2
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: Security profile over generic
|
||||
emission contracts and validator. Availability describes the delivery form,
|
||||
not production acceptance. Profile adoption and source completeness require
|
||||
owner-native evidence.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Security emission cadence validation
|
||||
summary: Security profile over generic emission contracts and validator.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: Security profile over generic emission contracts and validator
|
||||
includes:
|
||||
- Security profile over generic emission contracts and validator
|
||||
excludes:
|
||||
- Profile adoption and source completeness require owner-native evidence
|
||||
use_cases:
|
||||
- 'U08: Consumer emits security events and reconciles independently retained evidence'
|
||||
- 'U09: Maintainer observes posture, prioritizes findings, coordinates work and
|
||||
verifies outcomes'
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A2
|
||||
current_artifacts:
|
||||
- tools/emission-cadence-profile/README.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.practice-canon
|
||||
- capability.security.doctrine-review
|
||||
- capability.iam.key-cape
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.registry.register
|
||||
specializes:
|
||||
- capability.security.iam-tooling-suite
|
||||
evidence:
|
||||
documentation:
|
||||
- tools/emission-cadence-profile/README.md
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Consumer emits security events and reconciles independently retained evidence
|
||||
- Maintainer observes posture, prioritizes findings, coordinates work and verifies
|
||||
outcomes
|
||||
not_recommended_for:
|
||||
- Profile adoption and source completeness require owner-native evidence
|
||||
known_limitations:
|
||||
- Profile adoption and source completeness require owner-native evidence
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Security emission cadence validation
|
||||
|
||||
Security profile over generic emission contracts and validator.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Profile adoption and source completeness require owner-native evidence.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U08: Consumer emits security events and reconciles independently retained evidence
|
||||
- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [tools/emission-cadence-profile/README.md](../../tools/emission-cadence-profile/README.md)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
@ -1,8 +1,7 @@
|
|||
---
|
||||
id: capability.security.iam-tooling-suite
|
||||
name: NetKingdom Security/IAM Tooling Suite
|
||||
summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation,
|
||||
deterministic plan-only security scenario composition, and proposal-only posture feedback.
|
||||
name: NetKingdom security architecture and conformance tooling
|
||||
summary: Versioned IAM, layer, tenancy and credential contracts plus validators.
|
||||
owner: net-kingdom
|
||||
status: draft
|
||||
domain: infotech
|
||||
|
|
@ -11,22 +10,26 @@ tags:
|
|||
- iam
|
||||
- kubernetes
|
||||
- conformance
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit
|
||||
integration boundary with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon,
|
||||
and State Hub; canon/standards/ holds versioned IAM v0.3, playbook capability, scenario composition,
|
||||
tenancy, zone, and boundary standards that provider repos implement against.
|
||||
rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md
|
||||
describe an explicit integration boundary with OpenBao, flex-auth, user-engine,
|
||||
ops-warden, ops-bridge, info-tech-canon, and State Hub; canon/standards/ holds
|
||||
versioned IAM v0.3, playbook capability, scenario composition, tenancy, zone,
|
||||
and boundary standards that provider repos implement against.
|
||||
availability:
|
||||
current: A2
|
||||
target: A3
|
||||
confidence: medium
|
||||
rationale: 'No top-level package manifest, but tools/ holds independently documented and runnable
|
||||
conformance, posture, posture-feedback, scenario-composition, and guarded bootstrap tools; local-identity is separately
|
||||
packaged and tested.'
|
||||
rationale: 'Source interface assessed 2026-10-14: Versioned IAM, layer, tenancy
|
||||
and credential contracts plus validators. Availability describes the delivery
|
||||
form, not production acceptance. Mixed accepted and proposed standards; framework
|
||||
integration remains incomplete.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
|
|
@ -34,7 +37,8 @@ external_evidence:
|
|||
basis: scope_vs_intent_and_consumer_expectations
|
||||
satisfied_expectations:
|
||||
- versioned canon standards already implemented by a sibling repo (key-cape)
|
||||
- documented, runnable conformance, posture, composition, and bootstrap tools under tools/
|
||||
- documented, runnable conformance, posture, composition, and bootstrap tools
|
||||
under tools/
|
||||
broken_expectations: []
|
||||
out_of_scope_expectations: []
|
||||
reliability:
|
||||
|
|
@ -42,50 +46,47 @@ external_evidence:
|
|||
confidence: low
|
||||
basis: consumer_quality_signals
|
||||
known_reliability_risks:
|
||||
- no top-level packaging; each tool under tools/ has its own runtime dependencies, no unified install
|
||||
path yet
|
||||
- no top-level packaging; each tool under tools/ has its own runtime dependencies,
|
||||
no unified install path yet
|
||||
discovery:
|
||||
intent: Own canonical NetKingdom security semantics and provide executable reference and conformance tooling
|
||||
so provider implementations can integrate without inferred authority or hidden deployment coupling.
|
||||
intent: Versioned IAM, layer, tenancy and credential contracts plus validators
|
||||
includes:
|
||||
- canon/standards/ versioned IAM, tenancy, zone, credential, boundary, and composition standards
|
||||
- IAM profile conformance checker
|
||||
- playbook capability contract validator
|
||||
- deterministic plan-only security scenario composer
|
||||
- tenancy posture schema and validator
|
||||
- deterministic proposal-only posture feedback evaluator
|
||||
- security bootstrap console (local, non-secret-collecting)
|
||||
- packaged local bootstrap identity CLI
|
||||
- Versioned IAM, layer, tenancy and credential contracts plus validators
|
||||
excludes:
|
||||
- concrete IAM implementations themselves (see key-cape for lightweight mode)
|
||||
- live secret value handling (bootstrap console explicitly refuses live OpenBao initialization)
|
||||
- Mixed accepted and proposed standards; framework integration remains incomplete
|
||||
assumptions: []
|
||||
use_cases: []
|
||||
use_cases:
|
||||
- 'U01: Architect composes a security deployment from explicit owner contracts and
|
||||
case types'
|
||||
- 'U02: Human signs in with MFA and manages account or factor recovery'
|
||||
- 'U03: Application combines identity, tenant and resource facts and enforces a
|
||||
bound decision'
|
||||
- 'U14: Framework adopter validates and reuses selected contracts, tools and reference
|
||||
compositions'
|
||||
research_memos: []
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A3
|
||||
current_artifacts:
|
||||
- tools/iam-profile-conformance
|
||||
- tools/playbook-capability-contract
|
||||
- tools/security-scenario-composer
|
||||
- tools/tenancy-posture
|
||||
- tools/posture-feedback
|
||||
- tools/security-bootstrap-console
|
||||
- local-identity
|
||||
- SCOPE.md
|
||||
- SECURITY-COMPANION.md
|
||||
target_artifacts: []
|
||||
consumption_modes:
|
||||
- cli
|
||||
- local web ui
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
depends_on: []
|
||||
supports: []
|
||||
related_to: []
|
||||
related_to:
|
||||
- capability.security.practice-canon
|
||||
- capability.security.doctrine-review
|
||||
- capability.iam.key-cape
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.registry.register
|
||||
evidence:
|
||||
documentation:
|
||||
- README.md
|
||||
- docs/secrets-engine-security-infrastructure-boundary.md
|
||||
- tools/*/README.md
|
||||
- SCOPE.md
|
||||
- SECURITY-COMPANION.md
|
||||
tests:
|
||||
- tools/iam-profile-conformance (pytest fixtures)
|
||||
consumer_feedback: []
|
||||
|
|
@ -93,56 +94,40 @@ evidence:
|
|||
incidents: []
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- implementers needing to verify IAM/security conformance against Coulomb's canonical standards
|
||||
- Architect composes a security deployment from explicit owner contracts and case
|
||||
types
|
||||
- Human signs in with MFA and manages account or factor recovery
|
||||
- Application combines identity, tenant and resource facts and enforces a bound
|
||||
decision
|
||||
- Framework adopter validates and reuses selected contracts, tools and reference
|
||||
compositions
|
||||
not_recommended_for:
|
||||
- needs for a packaged, single-install security suite (currently three separate tools)
|
||||
- Mixed accepted and proposed standards; framework integration remains incomplete
|
||||
known_limitations:
|
||||
- no unified top-level packaging across the three tools
|
||||
- Mixed accepted and proposed standards; framework integration remains incomplete
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
promotion_history: []
|
||||
---
|
||||
|
||||
# NetKingdom Security/IAM Tooling Suite
|
||||
# NetKingdom security architecture and conformance tooling
|
||||
|
||||
## Overview
|
||||
Versioned IAM, layer, tenancy and credential contracts plus validators.
|
||||
|
||||
`net-kingdom` provides canonical IAM and security architecture, executable
|
||||
conformance and posture checks, deterministic plan-only scenario composition,
|
||||
proposal-only posture feedback, a local bootstrap identity package, and a non-secret-collecting security
|
||||
bootstrap console. Provider implementations remain in sibling repositories such
|
||||
as `key-cape`; the self-optimizing platform remains an intent rather than a
|
||||
current delivery claim.
|
||||
## Reuse boundary
|
||||
|
||||
## Assessment notes
|
||||
Mixed accepted and proposed standards; framework integration remains incomplete.
|
||||
|
||||
### Discovery
|
||||
## Supported use cases
|
||||
|
||||
SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an
|
||||
explicit integration boundary with OpenBao, flex-auth, user-engine, ops-warden,
|
||||
ops-bridge, info-tech-canon, and State Hub. `canon/standards/` holds the current
|
||||
IAM v0.3 and related boundary, posture, zone, credential, playbook, and scenario
|
||||
composition standards.
|
||||
- U01: Architect composes a security deployment from explicit owner contracts and case types
|
||||
- U02: Human signs in with MFA and manages account or factor recovery
|
||||
- U03: Application combines identity, tenant and resource facts and enforces a bound decision
|
||||
- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions
|
||||
|
||||
### Availability
|
||||
## Evidence and integration
|
||||
|
||||
No top-level package manifest exists. The independently runnable surfaces are
|
||||
documented under `tools/`, and `local-identity` has its own package manifest and
|
||||
test environment.
|
||||
- [SCOPE.md](../../SCOPE.md)
|
||||
- [SECURITY-COMPANION.md](../../SECURITY-COMPANION.md)
|
||||
|
||||
### Completeness
|
||||
|
||||
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
|
||||
(reuse-surface). No external consumer feedback exists yet; levels reflect
|
||||
scope-vs-intent documentation quality, not internal code quality.
|
||||
|
||||
### Reliability
|
||||
|
||||
No production consumer telemetry exists yet; reliability level is
|
||||
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
|
||||
|
||||
## Promotion checklist
|
||||
|
||||
- [x] ID follows `capability.<domain>.<name>` pattern
|
||||
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
|
||||
- [x] `external_evidence` is populated separately from `maturity`
|
||||
- [ ] Relations reference valid capability IDs (none yet)
|
||||
- [x] Index entry added in `registry/indexes/capabilities.yaml`
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
|
|||
101
registry/capabilities/capability.security.posture-feedback.md
Normal file
101
registry/capabilities/capability.security.posture-feedback.md
Normal file
|
|
@ -0,0 +1,101 @@
|
|||
---
|
||||
id: capability.security.posture-feedback
|
||||
owner: net-kingdom
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A2
|
||||
target: A2
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: CLI evaluates evidence age and
|
||||
posture into owner-routed findings. Availability describes the delivery form,
|
||||
not production acceptance. Proposal only; no policy changes or remediation execution.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Deterministic posture feedback
|
||||
summary: CLI evaluates evidence age and posture into owner-routed findings.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: CLI evaluates evidence age and posture into owner-routed findings
|
||||
includes:
|
||||
- CLI evaluates evidence age and posture into owner-routed findings
|
||||
excludes:
|
||||
- Proposal only; no policy changes or remediation execution
|
||||
use_cases:
|
||||
- 'U09: Maintainer observes posture, prioritizes findings, coordinates work and
|
||||
verifies outcomes'
|
||||
- 'U14: Framework adopter validates and reuses selected contracts, tools and reference
|
||||
compositions'
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A2
|
||||
current_artifacts:
|
||||
- tools/posture-feedback/README.md
|
||||
- tools/posture-feedback/posture_feedback.py
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.practice-canon
|
||||
- capability.security.doctrine-review
|
||||
- capability.iam.key-cape
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.registry.register
|
||||
specializes:
|
||||
- capability.security.iam-tooling-suite
|
||||
evidence:
|
||||
documentation:
|
||||
- tools/posture-feedback/README.md
|
||||
- tools/posture-feedback/posture_feedback.py
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Maintainer observes posture, prioritizes findings, coordinates work and verifies
|
||||
outcomes
|
||||
- Framework adopter validates and reuses selected contracts, tools and reference
|
||||
compositions
|
||||
not_recommended_for:
|
||||
- Proposal only; no policy changes or remediation execution
|
||||
known_limitations:
|
||||
- Proposal only; no policy changes or remediation execution
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Deterministic posture feedback
|
||||
|
||||
CLI evaluates evidence age and posture into owner-routed findings.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Proposal only; no policy changes or remediation execution.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes
|
||||
- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [tools/posture-feedback/README.md](../../tools/posture-feedback/README.md)
|
||||
- [tools/posture-feedback/posture_feedback.py](../../tools/posture-feedback/posture_feedback.py)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
101
registry/capabilities/capability.security.scenario-compose.md
Normal file
101
registry/capabilities/capability.security.scenario-compose.md
Normal file
|
|
@ -0,0 +1,101 @@
|
|||
---
|
||||
id: capability.security.scenario-compose
|
||||
owner: net-kingdom
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A2
|
||||
target: A2
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: CLI selects pinned providers
|
||||
and orders trust transitions. Availability describes the delivery form, not
|
||||
production acceptance. Plan only; execution.permitted is always false.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Deterministic security scenario composition
|
||||
summary: CLI selects pinned providers and orders trust transitions.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: CLI selects pinned providers and orders trust transitions
|
||||
includes:
|
||||
- CLI selects pinned providers and orders trust transitions
|
||||
excludes:
|
||||
- Plan only; execution.permitted is always false
|
||||
use_cases:
|
||||
- 'U01: Architect composes a security deployment from explicit owner contracts and
|
||||
case types'
|
||||
- 'U14: Framework adopter validates and reuses selected contracts, tools and reference
|
||||
compositions'
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A2
|
||||
current_artifacts:
|
||||
- tools/security-scenario-composer/README.md
|
||||
- tools/security-scenario-composer/security_scenario_composer.py
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.practice-canon
|
||||
- capability.security.doctrine-review
|
||||
- capability.iam.key-cape
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.registry.register
|
||||
specializes:
|
||||
- capability.security.iam-tooling-suite
|
||||
evidence:
|
||||
documentation:
|
||||
- tools/security-scenario-composer/README.md
|
||||
- tools/security-scenario-composer/security_scenario_composer.py
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Architect composes a security deployment from explicit owner contracts and case
|
||||
types
|
||||
- Framework adopter validates and reuses selected contracts, tools and reference
|
||||
compositions
|
||||
not_recommended_for:
|
||||
- Plan only; execution.permitted is always false
|
||||
known_limitations:
|
||||
- Plan only; execution.permitted is always false
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Deterministic security scenario composition
|
||||
|
||||
CLI selects pinned providers and orders trust transitions.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Plan only; execution.permitted is always false.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U01: Architect composes a security deployment from explicit owner contracts and case types
|
||||
- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [tools/security-scenario-composer/README.md](../../tools/security-scenario-composer/README.md)
|
||||
- [tools/security-scenario-composer/security_scenario_composer.py](../../tools/security-scenario-composer/security_scenario_composer.py)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
@ -1,21 +1,98 @@
|
|||
version: 1
|
||||
updated: '2026-08-23'
|
||||
updated: '2026-10-14'
|
||||
domain: helix_forge
|
||||
capabilities:
|
||||
- id: capability.security.iam-tooling-suite
|
||||
name: NetKingdom Security/IAM Tooling Suite
|
||||
summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture
|
||||
validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.
|
||||
vector: D3 / A2 / C1 / R1
|
||||
name: NetKingdom security architecture and conformance tooling
|
||||
summary: Versioned IAM, layer, tenancy and credential contracts plus validators.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: net-kingdom
|
||||
path: registry/capabilities/capability.security.iam-tooling-suite.md
|
||||
tags:
|
||||
- security
|
||||
- iam
|
||||
- kubernetes
|
||||
- conformance
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R1
|
||||
path: registry/capabilities/capability.security.iam-tooling-suite.md
|
||||
consumption_modes:
|
||||
- cli
|
||||
- local web ui
|
||||
- CLI
|
||||
- source
|
||||
- id: capability.security.scenario-compose
|
||||
name: Deterministic security scenario composition
|
||||
summary: CLI selects pinned providers and orders trust transitions.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: net-kingdom
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R0
|
||||
path: registry/capabilities/capability.security.scenario-compose.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
- id: capability.security.posture-feedback
|
||||
name: Deterministic posture feedback
|
||||
summary: CLI evaluates evidence age and posture into owner-routed findings.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: net-kingdom
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R0
|
||||
path: registry/capabilities/capability.security.posture-feedback.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
- id: capability.security.case-contracts
|
||||
name: Security case types and instance validation
|
||||
summary: Versioned types, cases and schema validation.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: net-kingdom
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R0
|
||||
path: registry/capabilities/capability.security.case-contracts.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
- id: capability.security.bootstrap-recovery
|
||||
name: Guarded bootstrap and recovery preparation
|
||||
summary: Local identity, bootstrap console, encrypted custody handoff and caller
|
||||
tools.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: net-kingdom
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R0
|
||||
path: registry/capabilities/capability.security.bootstrap-recovery.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
- id: capability.security.emission-profile
|
||||
name: Security emission cadence validation
|
||||
summary: Security profile over generic emission contracts and validator.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: net-kingdom
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R0
|
||||
path: registry/capabilities/capability.security.emission-profile.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue