diff --git a/registry/capabilities/capability.security.bootstrap-recovery.md b/registry/capabilities/capability.security.bootstrap-recovery.md new file mode 100644 index 0000000..ee6f65f --- /dev/null +++ b/registry/capabilities/capability.security.bootstrap-recovery.md @@ -0,0 +1,100 @@ +--- +id: capability.security.bootstrap-recovery +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Local identity, bootstrap console, + encrypted custody handoff and caller tools. Availability describes the delivery + form, not production acceptance. Source repairs and disposable native fixtures + do not prove estate root isolation or recovery.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Guarded bootstrap and recovery preparation +summary: Local identity, bootstrap console, encrypted custody handoff and caller tools. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Local identity, bootstrap console, encrypted custody handoff and caller + tools + includes: + - Local identity, bootstrap console, encrypted custody handoff and caller tools + excludes: + - Source repairs and disposable native fixtures do not prove estate root isolation + or recovery + use_cases: + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/security-bootstrap-console/README.md + - tools/custody-record/README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/security-bootstrap-console/README.md + - tools/custody-record/README.md +consumer_guidance: + recommended_for: + - Operator recovers identity, custody or data with independently held recovery material + not_recommended_for: + - Source repairs and disposable native fixtures do not prove estate root isolation + or recovery + known_limitations: + - Source repairs and disposable native fixtures do not prove estate root isolation + or recovery + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Guarded bootstrap and recovery preparation + +Local identity, bootstrap console, encrypted custody handoff and caller tools. + +## Reuse boundary + +Source repairs and disposable native fixtures do not prove estate root isolation or recovery. + +## Supported use cases + +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [tools/security-bootstrap-console/README.md](../../tools/security-bootstrap-console/README.md) +- [tools/custody-record/README.md](../../tools/custody-record/README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.case-contracts.md b/registry/capabilities/capability.security.case-contracts.md new file mode 100644 index 0000000..85c5898 --- /dev/null +++ b/registry/capabilities/capability.security.case-contracts.md @@ -0,0 +1,110 @@ +--- +id: capability.security.case-contracts +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Versioned types, cases and schema + validation. Availability describes the delivery form, not production acceptance. + Type acknowledgment, case acceptance, structural materialization and native + execution are distinct.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security case types and instance validation +summary: Versioned types, cases and schema validation. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Versioned types, cases and schema validation + includes: + - Versioned types, cases and schema validation + excludes: + - Type acknowledgment, case acceptance, structural materialization and native execution + are distinct + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/security-case-types/README.md + - canon/standards/security-case-types_v0.1.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/security-case-types/README.md + - canon/standards/security-case-types_v0.1.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Type acknowledgment, case acceptance, structural materialization and native execution + are distinct + known_limitations: + - Type acknowledgment, case acceptance, structural materialization and native execution + are distinct + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security case types and instance validation + +Versioned types, cases and schema validation. + +## Reuse boundary + +Type acknowledgment, case acceptance, structural materialization and native execution are distinct. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [tools/security-case-types/README.md](../../tools/security-case-types/README.md) +- [canon/standards/security-case-types_v0.1.md](../../canon/standards/security-case-types_v0.1.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.emission-profile.md b/registry/capabilities/capability.security.emission-profile.md new file mode 100644 index 0000000..2766f8c --- /dev/null +++ b/registry/capabilities/capability.security.emission-profile.md @@ -0,0 +1,97 @@ +--- +id: capability.security.emission-profile +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Security profile over generic + emission contracts and validator. Availability describes the delivery form, + not production acceptance. Profile adoption and source completeness require + owner-native evidence.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security emission cadence validation +summary: Security profile over generic emission contracts and validator. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Security profile over generic emission contracts and validator + includes: + - Security profile over generic emission contracts and validator + excludes: + - Profile adoption and source completeness require owner-native evidence + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/emission-cadence-profile/README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/emission-cadence-profile/README.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Profile adoption and source completeness require owner-native evidence + known_limitations: + - Profile adoption and source completeness require owner-native evidence + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security emission cadence validation + +Security profile over generic emission contracts and validator. + +## Reuse boundary + +Profile adoption and source completeness require owner-native evidence. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [tools/emission-cadence-profile/README.md](../../tools/emission-cadence-profile/README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.iam-tooling-suite.md b/registry/capabilities/capability.security.iam-tooling-suite.md index 2064c96..ab95d6f 100644 --- a/registry/capabilities/capability.security.iam-tooling-suite.md +++ b/registry/capabilities/capability.security.iam-tooling-suite.md @@ -1,8 +1,7 @@ --- id: capability.security.iam-tooling-suite -name: NetKingdom Security/IAM Tooling Suite -summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, - deterministic plan-only security scenario composition, and proposal-only posture feedback. +name: NetKingdom security architecture and conformance tooling +summary: Versioned IAM, layer, tenancy and credential contracts plus validators. owner: net-kingdom status: draft domain: infotech @@ -11,22 +10,26 @@ tags: - iam - kubernetes - conformance +- netkingdom +- framework-reuse maturity: discovery: current: D3 target: D5 confidence: medium - rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit - integration boundary with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, - and State Hub; canon/standards/ holds versioned IAM v0.3, playbook capability, scenario composition, - tenancy, zone, and boundary standards that provider repos implement against. + rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md + describe an explicit integration boundary with OpenBao, flex-auth, user-engine, + ops-warden, ops-bridge, info-tech-canon, and State Hub; canon/standards/ holds + versioned IAM v0.3, playbook capability, scenario composition, tenancy, zone, + and boundary standards that provider repos implement against. availability: current: A2 target: A3 confidence: medium - rationale: 'No top-level package manifest, but tools/ holds independently documented and runnable - conformance, posture, posture-feedback, scenario-composition, and guarded bootstrap tools; local-identity is separately - packaged and tested.' + rationale: 'Source interface assessed 2026-10-14: Versioned IAM, layer, tenancy + and credential contracts plus validators. Availability describes the delivery + form, not production acceptance. Mixed accepted and proposed standards; framework + integration remains incomplete.' external_evidence: completeness: level: C1 @@ -34,7 +37,8 @@ external_evidence: basis: scope_vs_intent_and_consumer_expectations satisfied_expectations: - versioned canon standards already implemented by a sibling repo (key-cape) - - documented, runnable conformance, posture, composition, and bootstrap tools under tools/ + - documented, runnable conformance, posture, composition, and bootstrap tools + under tools/ broken_expectations: [] out_of_scope_expectations: [] reliability: @@ -42,50 +46,47 @@ external_evidence: confidence: low basis: consumer_quality_signals known_reliability_risks: - - no top-level packaging; each tool under tools/ has its own runtime dependencies, no unified install - path yet + - no top-level packaging; each tool under tools/ has its own runtime dependencies, + no unified install path yet discovery: - intent: Own canonical NetKingdom security semantics and provide executable reference and conformance tooling - so provider implementations can integrate without inferred authority or hidden deployment coupling. + intent: Versioned IAM, layer, tenancy and credential contracts plus validators includes: - - canon/standards/ versioned IAM, tenancy, zone, credential, boundary, and composition standards - - IAM profile conformance checker - - playbook capability contract validator - - deterministic plan-only security scenario composer - - tenancy posture schema and validator - - deterministic proposal-only posture feedback evaluator - - security bootstrap console (local, non-secret-collecting) - - packaged local bootstrap identity CLI + - Versioned IAM, layer, tenancy and credential contracts plus validators excludes: - - concrete IAM implementations themselves (see key-cape for lightweight mode) - - live secret value handling (bootstrap console explicitly refuses live OpenBao initialization) + - Mixed accepted and proposed standards; framework integration remains incomplete assumptions: [] - use_cases: [] + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' research_memos: [] availability: current_level: A2 target_level: A3 current_artifacts: - - tools/iam-profile-conformance - - tools/playbook-capability-contract - - tools/security-scenario-composer - - tools/tenancy-posture - - tools/posture-feedback - - tools/security-bootstrap-console - - local-identity + - SCOPE.md + - SECURITY-COMPANION.md target_artifacts: [] consumption_modes: - - cli - - local web ui + - CLI + - source relations: depends_on: [] supports: [] - related_to: [] + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register evidence: documentation: - - README.md - - docs/secrets-engine-security-infrastructure-boundary.md - - tools/*/README.md + - SCOPE.md + - SECURITY-COMPANION.md tests: - tools/iam-profile-conformance (pytest fixtures) consumer_feedback: [] @@ -93,56 +94,40 @@ evidence: incidents: [] consumer_guidance: recommended_for: - - implementers needing to verify IAM/security conformance against Coulomb's canonical standards + - Architect composes a security deployment from explicit owner contracts and case + types + - Human signs in with MFA and manages account or factor recovery + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Framework adopter validates and reuses selected contracts, tools and reference + compositions not_recommended_for: - - needs for a packaged, single-install security suite (currently three separate tools) + - Mixed accepted and proposed standards; framework integration remains incomplete known_limitations: - - no unified top-level packaging across the three tools + - Mixed accepted and proposed standards; framework integration remains incomplete + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. promotion_history: [] --- -# NetKingdom Security/IAM Tooling Suite +# NetKingdom security architecture and conformance tooling -## Overview +Versioned IAM, layer, tenancy and credential contracts plus validators. -`net-kingdom` provides canonical IAM and security architecture, executable -conformance and posture checks, deterministic plan-only scenario composition, -proposal-only posture feedback, a local bootstrap identity package, and a non-secret-collecting security -bootstrap console. Provider implementations remain in sibling repositories such -as `key-cape`; the self-optimizing platform remains an intent rather than a -current delivery claim. +## Reuse boundary -## Assessment notes +Mixed accepted and proposed standards; framework integration remains incomplete. -### Discovery +## Supported use cases -SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an -explicit integration boundary with OpenBao, flex-auth, user-engine, ops-warden, -ops-bridge, info-tech-canon, and State Hub. `canon/standards/` holds the current -IAM v0.3 and related boundary, posture, zone, credential, playbook, and scenario -composition standards. +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U02: Human signs in with MFA and manages account or factor recovery +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions -### Availability +## Evidence and integration -No top-level package manifest exists. The independently runnable surfaces are -documented under `tools/`, and `local-identity` has its own package manifest and -test environment. +- [SCOPE.md](../../SCOPE.md) +- [SECURITY-COMPANION.md](../../SECURITY-COMPANION.md) -### Completeness - -First-pass honest assessment from the REUSE-WP-0017 coverage campaign -(reuse-surface). No external consumer feedback exists yet; levels reflect -scope-vs-intent documentation quality, not internal code quality. - -### Reliability - -No production consumer telemetry exists yet; reliability level is -intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. - -## Promotion checklist - -- [x] ID follows `capability..` pattern -- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` -- [x] `external_evidence` is populated separately from `maturity` -- [ ] Relations reference valid capability IDs (none yet) -- [x] Index entry added in `registry/indexes/capabilities.yaml` +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.posture-feedback.md b/registry/capabilities/capability.security.posture-feedback.md new file mode 100644 index 0000000..134d6c6 --- /dev/null +++ b/registry/capabilities/capability.security.posture-feedback.md @@ -0,0 +1,101 @@ +--- +id: capability.security.posture-feedback +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CLI evaluates evidence age and + posture into owner-routed findings. Availability describes the delivery form, + not production acceptance. Proposal only; no policy changes or remediation execution.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Deterministic posture feedback +summary: CLI evaluates evidence age and posture into owner-routed findings. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CLI evaluates evidence age and posture into owner-routed findings + includes: + - CLI evaluates evidence age and posture into owner-routed findings + excludes: + - Proposal only; no policy changes or remediation execution + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/posture-feedback/README.md + - tools/posture-feedback/posture_feedback.py + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/posture-feedback/README.md + - tools/posture-feedback/posture_feedback.py +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Proposal only; no policy changes or remediation execution + known_limitations: + - Proposal only; no policy changes or remediation execution + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Deterministic posture feedback + +CLI evaluates evidence age and posture into owner-routed findings. + +## Reuse boundary + +Proposal only; no policy changes or remediation execution. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [tools/posture-feedback/README.md](../../tools/posture-feedback/README.md) +- [tools/posture-feedback/posture_feedback.py](../../tools/posture-feedback/posture_feedback.py) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.scenario-compose.md b/registry/capabilities/capability.security.scenario-compose.md new file mode 100644 index 0000000..769cd3f --- /dev/null +++ b/registry/capabilities/capability.security.scenario-compose.md @@ -0,0 +1,101 @@ +--- +id: capability.security.scenario-compose +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CLI selects pinned providers + and orders trust transitions. Availability describes the delivery form, not + production acceptance. Plan only; execution.permitted is always false.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Deterministic security scenario composition +summary: CLI selects pinned providers and orders trust transitions. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CLI selects pinned providers and orders trust transitions + includes: + - CLI selects pinned providers and orders trust transitions + excludes: + - Plan only; execution.permitted is always false + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/security-scenario-composer/README.md + - tools/security-scenario-composer/security_scenario_composer.py + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/security-scenario-composer/README.md + - tools/security-scenario-composer/security_scenario_composer.py +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Plan only; execution.permitted is always false + known_limitations: + - Plan only; execution.permitted is always false + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Deterministic security scenario composition + +CLI selects pinned providers and orders trust transitions. + +## Reuse boundary + +Plan only; execution.permitted is always false. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [tools/security-scenario-composer/README.md](../../tools/security-scenario-composer/README.md) +- [tools/security-scenario-composer/security_scenario_composer.py](../../tools/security-scenario-composer/security_scenario_composer.py) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 3a618f7..507b2d6 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,21 +1,98 @@ version: 1 -updated: '2026-08-23' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.security.iam-tooling-suite - name: NetKingdom Security/IAM Tooling Suite - summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture - validation, deterministic plan-only security scenario composition, and proposal-only posture feedback. - vector: D3 / A2 / C1 / R1 + name: NetKingdom security architecture and conformance tooling + summary: Versioned IAM, layer, tenancy and credential contracts plus validators. domain: infotech status: draft owner: net-kingdom - path: registry/capabilities/capability.security.iam-tooling-suite.md tags: - security - iam - kubernetes - conformance + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.security.iam-tooling-suite.md consumption_modes: - - cli - - local web ui + - CLI + - source +- id: capability.security.scenario-compose + name: Deterministic security scenario composition + summary: CLI selects pinned providers and orders trust transitions. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.scenario-compose.md + consumption_modes: + - CLI + - source +- id: capability.security.posture-feedback + name: Deterministic posture feedback + summary: CLI evaluates evidence age and posture into owner-routed findings. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-feedback.md + consumption_modes: + - CLI + - source +- id: capability.security.case-contracts + name: Security case types and instance validation + summary: Versioned types, cases and schema validation. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-contracts.md + consumption_modes: + - CLI + - source +- id: capability.security.bootstrap-recovery + name: Guarded bootstrap and recovery preparation + summary: Local identity, bootstrap console, encrypted custody handoff and caller + tools. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.bootstrap-recovery.md + consumption_modes: + - CLI + - source +- id: capability.security.emission-profile + name: Security emission cadence validation + summary: Security profile over generic emission contracts and validator. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.emission-profile.md + consumption_modes: + - CLI + - source