NK-WP-0048-T04: SecurityCaseType oidc-browser-relying-party 1.0 (proposed)

Composes key-cape.oidc-client-registration; confidential/public conditions,
one justified attended step, threat model, fit table of hand-built clients,
Forgejo and public-portal examples. Validator gains when/required_when and
provider discovery. 43 tests pass. Adds T08 (identity-provisioner groups ensure).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

canon/schemas/security-case-type_v0.1.schema.json

@@ -5,38 +5,134 @@
   "description": "Structure of security-case-types/<type-id>/type.yaml (canon/standards/security-case-types_v0.1.md). Semantic rules (rollback coverage, template placeholders, secret-shaped values, acceptance by risk class) are enforced by tools/security-case-types/security_case_validator.py.",
   "type": "object",
   "additionalProperties": false,
-  "required": ["apiVersion", "kind", "spec"],
+  "required": [
+    "apiVersion",
+    "kind",
+    "spec"
+  ],
   "properties": {
-    "apiVersion": {"const": "netkingdom.io/security-case-type/v0.1"},
-    "kind": {"const": "SecurityCaseType"},
+    "apiVersion": {
+      "const": "netkingdom.io/security-case-type/v0.1"
+    },
+    "kind": {
+      "const": "SecurityCaseType"
+    },
     "spec": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "version", "status", "title", "purpose", "parameters", "composition",
-                   "materialization", "follow_through", "verification", "rollback", "acceptance"],
+      "required": [
+        "id",
+        "version",
+        "status",
+        "title",
+        "purpose",
+        "parameters",
+        "composition",
+        "materialization",
+        "follow_through",
+        "verification",
+        "rollback",
+        "acceptance"
+      ],
       "properties": {
-        "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9-]*$"},
-        "version": {"type": "string", "pattern": "^\\d+\\.\\d+$"},
-        "status": {"enum": ["draft", "proposed", "acknowledged", "implemented", "deprecated", "retired"]},
-        "title": {"type": "string", "minLength": 1},
-        "purpose": {"type": "string", "minLength": 1},
-        "parameters": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/parameter"}},
-        "composition": {"$ref": "#/$defs/composition"},
-        "materialization": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/materialization"}},
-        "follow_through": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/step"}},
-        "verification": {"type": "array", "minItems": 2, "items": {"$ref": "#/$defs/check"}},
-        "rollback": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/rollback"}},
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9-]*$"
+        },
+        "version": {
+          "type": "string",
+          "pattern": "^\\d+\\.\\d+$"
+        },
+        "status": {
+          "enum": [
+            "draft",
+            "proposed",
+            "acknowledged",
+            "implemented",
+            "deprecated",
+            "retired"
+          ]
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1
+        },
+        "purpose": {
+          "type": "string",
+          "minLength": 1
+        },
+        "parameters": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/parameter"
+          }
+        },
+        "composition": {
+          "$ref": "#/$defs/composition"
+        },
+        "materialization": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/materialization"
+          }
+        },
+        "follow_through": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/step"
+          }
+        },
+        "verification": {
+          "type": "array",
+          "minItems": 2,
+          "items": {
+            "$ref": "#/$defs/check"
+          }
+        },
+        "rollback": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/rollback"
+          }
+        },
         "acceptance": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["accepted_by", "risk_class"],
+          "required": [
+            "accepted_by",
+            "risk_class"
+          ],
           "properties": {
-            "accepted_by": {"type": "array", "minItems": 1, "uniqueItems": true,
-                            "items": {"enum": ["owner", "founder"]}},
-            "risk_class": {"enum": ["low", "medium", "high"]}
+            "accepted_by": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": {
+                "enum": [
+                  "owner",
+                  "founder"
+                ]
+              }
+            },
+            "risk_class": {
+              "enum": [
+                "low",
+                "medium",
+                "high"
+              ]
+            }
           }
         },
-        "history": {"type": "array", "items": {"type": "object"}}
+        "history": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        }
       }
     }
   },
@@ -44,83 +140,251 @@
     "parameter": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["name", "type", "case_settable", "sensitivity", "description"],
+      "required": [
+        "name",
+        "type",
+        "case_settable",
+        "sensitivity",
+        "description"
+      ],
       "properties": {
-        "name": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
-        "type": {"enum": ["string", "integer", "number", "boolean", "array", "object"]},
-        "case_settable": {"type": "boolean"},
-        "required": {"type": "boolean"},
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9_]*$"
+        },
+        "type": {
+          "enum": [
+            "string",
+            "integer",
+            "number",
+            "boolean",
+            "array",
+            "object"
+          ]
+        },
+        "case_settable": {
+          "type": "boolean"
+        },
+        "required": {
+          "type": "boolean"
+        },
         "default": {},
-        "sensitivity": {"enum": ["public", "operational", "security_sensitive", "secret_reference"]},
+        "sensitivity": {
+          "enum": [
+            "public",
+            "operational",
+            "security_sensitive",
+            "secret_reference"
+          ]
+        },
         "constraints": {
           "type": "object",
           "additionalProperties": false,
           "properties": {
-            "pattern": {"type": "string"},
-            "enum": {"type": "array"},
-            "min_items": {"type": "integer", "minimum": 0},
-            "unique": {"type": "boolean"}
+            "pattern": {
+              "type": "string"
+            },
+            "enum": {
+              "type": "array"
+            },
+            "min_items": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "unique": {
+              "type": "boolean"
+            },
+            "required_when": {
+              "type": "string"
+            }
           }
         },
-        "description": {"type": "string", "minLength": 1}
+        "description": {
+          "type": "string",
+          "minLength": 1
+        }
       }
     },
     "composition": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["authority", "initial_trust", "capabilities", "providers"],
+      "required": [
+        "authority",
+        "initial_trust",
+        "capabilities",
+        "providers"
+      ],
       "properties": {
-        "authority": {"enum": ["platform", "netkingdom", "tenant"]},
-        "initial_trust": {"type": "array", "minItems": 1, "items": {"type": "string"}},
-        "capabilities": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string"}},
-        "providers": {"type": "object", "additionalProperties": {"type": "string", "minLength": 1}},
-        "parameter_bindings": {"type": "object", "additionalProperties": {"type": "string"}}
+        "authority": {
+          "enum": [
+            "platform",
+            "netkingdom",
+            "tenant"
+          ]
+        },
+        "initial_trust": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        },
+        "capabilities": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+        "providers": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "parameter_bindings": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        }
       }
     },
     "materialization": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "kind", "template"],
+      "required": [
+        "id",
+        "kind",
+        "template"
+      ],
       "properties": {
-        "id": {"type": "string", "minLength": 1},
-        "kind": {"enum": ["openbao_policy", "openbao_role", "kv_path", "catalog_entry"]},
-        "template": {"type": "string", "minLength": 1},
-        "description": {"type": "string"}
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "kind": {
+          "enum": [
+            "openbao_policy",
+            "openbao_role",
+            "kv_path",
+            "catalog_entry"
+          ]
+        },
+        "template": {
+          "type": "string",
+          "minLength": 1
+        },
+        "description": {
+          "type": "string"
+        },
+        "when": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9_]* (==|!=) [A-Za-z0-9_.:/-]+$"
+        }
       }
     },
     "step": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "owner", "entry_point", "auth", "warden_executes"],
+      "required": [
+        "id",
+        "owner",
+        "entry_point",
+        "auth",
+        "warden_executes"
+      ],
       "properties": {
-        "id": {"type": "string", "minLength": 1},
-        "owner": {"type": "string", "minLength": 1},
-        "entry_point": {"type": "string", "minLength": 1},
-        "auth": {"type": "string", "minLength": 1},
-        "warden_executes": {"type": "boolean"},
-        "attended": {"type": "boolean"},
-        "attended_justification": {"type": "string"},
-        "description": {"type": "string"}
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "owner": {
+          "type": "string",
+          "minLength": 1
+        },
+        "entry_point": {
+          "type": "string",
+          "minLength": 1
+        },
+        "auth": {
+          "type": "string",
+          "minLength": 1
+        },
+        "warden_executes": {
+          "type": "boolean"
+        },
+        "attended": {
+          "type": "boolean"
+        },
+        "attended_justification": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "when": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9_]* (==|!=) [A-Za-z0-9_.:/-]+$"
+        }
       }
     },
     "check": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "check", "expect", "reads_secret_value"],
+      "required": [
+        "id",
+        "check",
+        "expect",
+        "reads_secret_value"
+      ],
       "properties": {
-        "id": {"type": "string", "minLength": 1},
-        "check": {"type": "string", "minLength": 1},
-        "expect": {"enum": ["allow", "present", "deny"]},
-        "reads_secret_value": {"const": false}
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "check": {
+          "type": "string",
+          "minLength": 1
+        },
+        "expect": {
+          "enum": [
+            "allow",
+            "present",
+            "deny"
+          ]
+        },
+        "reads_secret_value": {
+          "const": false
+        },
+        "when": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9_]* (==|!=) [A-Za-z0-9_.:/-]+$"
+        }
       }
     },
     "rollback": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["reverses", "action"],
+      "required": [
+        "reverses",
+        "action"
+      ],
       "properties": {
-        "reverses": {"type": "string", "minLength": 1},
-        "action": {"type": "string", "minLength": 1}
+        "reverses": {
+          "type": "string",
+          "minLength": 1
+        },
+        "action": {
+          "type": "string",
+          "minLength": 1
+        },
+        "when": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9_]* (==|!=) [A-Za-z0-9_.:/-]+$"
+        }
       }
     }
   }