3 commits

Author	SHA1	Message	Date
tegwick	074b3a047b	NK-WP-0048-T05: fold ops-mason's materialization review into oidc-browser-relying-party ... Derive custody at platform/workloads/keycape/{client_id} (secret_ref is no longer case-settable), reuse the workload-kv-read-keycape-* policy family with templated bodies, add the external-secrets-keycape-{client_id} ESO role, name the catalog entry {consuming_service}-keycape-client and collapse the duplicate KV-path rollback. Schema and validator require a body on policy/role items. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 330051@bnt-lap001 Assistant-Session: b98d4912-95a3-4619-b7fb-57aa1db7407b	2026-10-08 23:27:22 +02:00
tegwick	fa2cb57384	NK-WP-0048-T04: SecurityCaseType oidc-browser-relying-party 1.0 (proposed) ... Composes key-cape.oidc-client-registration; confidential/public conditions, one justified attended step, threat model, fit table of hand-built clients, Forgejo and public-portal examples. Validator gains when/required_when and provider discovery. 43 tests pass. Adds T08 (identity-provisioner groups ensure). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012	2026-10-08 22:45:31 +02:00
tegwick	d8cf42bab6	NK-WP-0048: canon accepted; SecurityCaseType schemas, validator and template (T01, T03) ... security-case-types_v0.1 accepted by the founder 2026-10-08. Adds JSON schemas for types and cases, tools/security-case-types/security_case_validator.py (validate-type, validate-case, render via the scenario composer, plan-only), and a runnable _template type with README sections, an example case and tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012	2026-10-08 22:29:13 +02:00