# NetKingdom Security Pattern Tutorials

The tutorials are now **runbook packs** in [`runbooks/`](../../runbooks/) for the
`runbook-tutorials` engine (NK-WP-0009, NK-WP-0044). Run them through the engine's UI
or `rtut`; check them with `make runbooks-validate`. The markdown verifier is retired.

| Pack | Replaces | Status |
| --- | --- | --- |
| `runbooks/object-storage-sts/` | (new) vend temporary S3 credentials | rehearsed 2026-10-02 |
| `runbooks/ssh-certificates/` | [ssh-certificates-and-tunnels.md](ssh-certificates-and-tunnels.md) | rehearsed 2026-10-02 |
| `runbooks/openbao-operating-path/` | [openbao-operating-path.md](openbao-operating-path.md) | rehearsed 2026-10-02 |
| `runbooks/protected-system-flex-auth/` | [protected-system-flex-auth.md](protected-system-flex-auth.md) | rehearsed 2026-10-02 |

Maturity is derived by the engine from run history, not declared here. The three markdown
files are kept as superseded reference. The flex-auth one still holds check N4 (an expired
token is refused), which needs a ten-minute wait and is not in the pack.

Rules that still apply to every pack: name the owning repo for each step, include
verification and rollback, never put secrets in a pack, link owner runbooks instead of
copying manifests, and use the named `openbao-ui-railiance01` tunnel, never a public Bao
URL (`bao.coulomb.social` is retired).