Settles two questions raised by bringing NetKingdom under Railiance
governance:
1. Separate rapp-* repos per engine (rapp-tenant-engine, rapp-user-engine),
following repository-axes.md's one-workload rule. The decisive property is
independent rollback -- a single rapp would need one rollback contract
across independently versioned services. secrets-engine is not packaged as
a rapp: it has no deployed workload.
2. CloudNative PG via rapp-postgres is the default relational platform for
production. Per-workload SQLite-on-a-PVC is dev/test only, and
rail-kubernetes wave-1 does not support the persistent-storage contract it
depends on. tenant-engine migrates; its TenantStore Protocol makes this a
backend swap behind an existing seam.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Register coulomb-social with mfaRequired: false, roll key-cape image that
honors client policy, and track NK-WP-0025 public registration orchestration.
Ratifies the tenant capability-role model (PLTF/IAM/VEN/CUS, non-exclusive,
independent of ADR-0013's grouping axis), a hybrid carrying mechanism
(tenant-engine authoritative, key-cape caches a tenant_roles claim at
issuance, flex-auth re-validates live for aal2-class decisions), and
tenant-engine as a new, separate service owning tenant existence, grouping,
capability roles, and plan/subscription assignment -- not a module inside
user-engine, whose own boundary contract already scopes it to consuming
tenant identifiers, not owning them.
canon/standards/tenant-engine-boundary-contract_v0.1.md defines that
ownership boundary before the repo exists, mirroring how
user-engine-boundary-contract_v0.1.md was sequenced.
canon/standards/iam-profile_v0.3.md (minor version per ADR-0011's own
governance -- optional claim addition, no breaking change) adds the
tenant_roles claim, folds in ADR-0013's tenant-identifier vocabulary, and
documents the live-revalidation requirement. docs/platform-identity-
security-architecture.md's Tenant Model section and SCOPE.md's canonical
spec pointer updated to match; other historical citations of v0.2 left as
version-pinned references, not bulk-updated.
Records Bernd's trial-tenant policy: trial-grouped tenants may hold any
capability role (showcase/test/explore), with safety enforced through
tenant-engine-owned resource guardrails (spend limits, entity/action
counts) rather than role gating -- guardrail design is reserved, explicitly
not specified by this change.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replaces the sandbox/customer suggested tenant identifiers in
iam-profile_v0.2.md's Tenant Claim section with an onboarding-risk/
entity-shape grouping (trial, friendly, single, small, medium, large,
enterprise, consumer, family, community, association, agentic) that stays
orthogonal to the separate, still-unratified capability-role model
(PLTF/IAM/VEN/CUS) a tenant can also hold. Role words as a grouping would
collide the moment a tenant's roles evolve -- Binky Hedgehog GmbH is CUS
now and VEN later, so tenant:customer:binky was already the wrong shape.
First application: tenant:friendly:binky
(key-cape/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md).
tenant:platform and tenant:coulomb proposed as reserved/ungrouped, flagged
for explicit confirmation. Classified as an editorial change per ADR-0011's
governance (no required-claim schema change) -- the iam-profile_v0.2.md
Tenant Claim section edit itself is tracked as a follow-up, not bundled here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Promote NK-IN-0001/0002 after scope/intent review into a single ready
workplan (LLDAP operator group, membership runbook, Authelia domain rules,
live verification). Hub workstream and tasks registered via fix-consistency.
ACTIVITY-WP-0025 residual T06: LLDAP group activity-core-operators and
Authelia domain rules for activity/temporal.coulomb.social. File-backed
work records registered in State Hub (C-32).
T2: greenfield live proof against a fresh uninitialized OpenBao 2.5.5 —
caught and fixed 'bao operator unseal -' not reading stdin (now
'bao write sys/unseal key=-'); init and reseal-replay paths proven.
T3: attended-ceremony selectable — runbook, non-secret ceremony-record
template + validator, and a lab/production deployment profile that blocks
sops-held-automation in console selection, gates, and the init script.
T4: console gate + evidence flags for auto-unseal-transit (Helm seal stanza
prepared in railiance-platform).
Also: SCOPE.md refreshed to current repo state; adhoc fix for the broken
check-secrets Make target (unescaped $).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Fill .claude/rules/stack-and-commands.md (was an empty TODO template)
- Normalize workplan frontmatter statuses to canonical vocabulary
(completed/done -> finished) per ADR-001
- Repair glued frontmatter delimiter in NK-WP-0001 (superseded_by line)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Document three init/unseal custody paths; default sops-held-automation for
fast rebuild cycles. Security bootstrap console lists models, blocks planned
attended-ceremony and auto-unseal-transit with hints, and gates init ceremony
on implemented selection. NET-WP-0020 tracks downstream SSH automation.
Add Operational SSH Path to platform architecture and move ops-warden
from out-of-scope to operational SSH dependency in responsibility-map.
Aligns with ops-warden WARDEN-WP-0006 stewardship work.
Create docs/responsibility-map.md: the single home for NetKingdom's
orchestration relationships, kept out of the orchestrated repos' intents
per ADR-0010. Records the classification criterion, the current
minimal-foundation scope, and per orchestrated repo (railiance-infra,
railiance-cluster, railiance-platform, key-cape, flex-auth) the resources
held, what the repo owns (execution), and what NetKingdom orchestrates
(meta). Lists dependencies and out-of-scope repos so the scoping decision
is explicit and revisitable.
Update ADR-0010 to point at the now-created map.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Record two foundational principles that emerged while aligning ecosystem
INTENT.md files:
1. Orchestration != dependency. NetKingdom orchestrates a repo when that
repo holds resources NetKingdom must manage (users, roles, scopes,
policies, infra resources). It depends on a repo when it merely uses it
as a tool. Defining question: does the repo hold resources NetKingdom
needs to orchestrate? (railiance-fabric = dependency;
railiance-infra/cluster/platform = orchestrated.)
2. Intent is self-coherent. A repo's INTENT.md describes its own purpose
abstractly; it must not reference NetKingdom, sister projects' intents,
or even dependencies. Relationships live in the responsibility map /
ADRs / interface contracts, not in intent.
Rejects the earlier "place in the NetKingdom landscape" block idea as a
Principle 2 violation.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- ADR-0007: refine (not overturn) the orchestration boundary with the
two-layer model — Railiance executes parametrized playbooks, NetKingdom
does meta-orchestration (scenario->playbook selection, parametrization,
responsibility map). Add the playbook/capability-contract dependency as
the prerequisite, analogous to the IAM Profile.
- INTENT.md: add "Why NetKingdom" (the kingdom metaphor: governed,
defended, living/evolving, tended by its people); Principle 7
(Meta-Orchestration over Re-Implementation); an Operating Model section
(kaizen-agent workforce for recurring duties + change/improvement); and
matching Direction-of-Evolution entries.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Make the lightweight->expanded decision explicitly capability-driven (not
scale-driven) and capture the turn-key, capability-selectable framework
ambition.
- arch doc: add capability-driven rationale to the identity-mode choice;
add a "Capability Progression (Start Small -> Enterprise)" ladder
(C0 bootstrap -> C6 self-optimizing), including the C2a/C2b 2FA split
(Authelia built-in vs privacyIDEA); answer the lightweight/expanded
open question as capability-driven
- INTENT.md: recast Progressive Expansion as capability-driven with a
no-structural-breaks guarantee; add capability-selection + turn-key
orchestration to the mission and identity
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Refine the recursive platform security architecture to make OpenBao the
canonical runtime secret authority, with SOPS/age, K8s Secrets, and the
emergency bundle reframed as bootstrap/delivery/break-glass mechanisms.
- credential-management standard v0.2: add OpenBao runtime authority
section, rotation rules, and prohibited patterns (OpenBao-as-PDP,
tenant platform-root)
- platform-identity-security-architecture: mark implemented; add
flex-auth/Topaz implications, Coulomb onboarding path, and a
production-readiness checklist
- NK-WP-0004/0005: document bootstrap-to-OpenBao handoff boundary
- NK-WP-0006/0007: status -> done with implementation reviews; add
recursive platform/tenant split and OpenBao broker/audit role for
object-storage STS vending
- NK-WP-0008: status -> done; repoint corpus to infospace-bench
- new ADR-0007 (orchestration boundary), ADR-0008 (STS vending
boundary), and the object-storage STS credential-vending architecture
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Permission enforcement on startup: enforce_permissions() checks store dir
(700), user files (600), signing key, TLS key, audit.log, revoked.json.
CLI and run_server() call it before any sensitive operation.
New modules:
security.py check_store(), enforce_permissions(), print_security_check()
audit.py log_event() — append-only TSV audit log (mode 600)
revoke.py revoke(jti), is_revoked(jti) — revocation list (mode 600)
New CLI commands:
security-check Print per-check pass/warn/fail report; exit 1 on failure
revoke-token <jti|jwt> Add JTI to revocation list; accepts raw JTI or full JWT
Serve integration:
Audit log written for auth request, token issuance, and userinfo calls
Revocation checked at /userinfo; revoked tokens return 401
Docs: security model section in LocalIdentity.md — threat model,
assumptions, non-guarantees, SELinux/AppArmor guidance, revocation usage.
138 tests passing (34 new for Stage 4).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
