apiVersion: netkingdom.io/playbook-capability/v0.1
kind: PlaybookCapabilityDeclaration
metadata:
  id: net-kingdom.local-identity
  name: NetKingdom local bootstrap identity
  owner: net-kingdom
  repo: net-kingdom
  domain: infotech
  contract_version: "0.1"
  source_links:
    - label: implementation
      path: local-identity/
    - label: workplan
      path: workplans/archived/260702-NK-WP-0002-local-identity.md
spec:
  playbook:
    path: local-identity/
    type: cli-sequence
    invocation: uv run --project local-identity local-identity init
    description: Initialize and serve the loopback-only bootstrap OIDC identity store.
  capabilities:
    - id: c0.bootstrap-identity
      tier: C0
      resource_kinds:
        - identities
        - secrets_credentials
      description: Provide a local OIDC issuer before the managed runtime identity plane exists.
  parameters:
    - name: local_identity_home
      type: string
      required: false
      default: .local/local-identity
      constraints:
        pattern: ^[^\n\r]+$
      sensitivity: operational
      tuning_authority: netkingdom_tunable
      description: LOCAL_IDENTITY_HOME used by the owning execution environment.
    - name: bootstrap_username
      type: string
      required: true
      constraints:
        pattern: ^[a-z_][a-z0-9_-]{0,31}$
      sensitivity: operational
      tuning_authority: netkingdom_tunable
      description: Bootstrap username passed to local-identity init.
    - name: bootstrap_fullname
      type: string
      required: true
      constraints:
        pattern: ^[^\n\r]{1,120}$
      sensitivity: operational
      tuning_authority: netkingdom_tunable
      description: Display name passed to local-identity init.
    - name: bootstrap_email
      type: string
      required: true
      constraints:
        pattern: ^[^@\s]+@[^@\s]+$
      sensitivity: operational
      tuning_authority: netkingdom_tunable
      description: Bootstrap email passed to local-identity init.
    - name: listen_port
      type: integer
      required: false
      default: 8443
      constraints:
        minimum: 1024
        maximum: 65535
      sensitivity: operational
      tuning_authority: netkingdom_tunable
      description: Loopback port passed to local-identity serve.
    - name: token_ttl_seconds
      type: integer
      required: false
      default: 3600
      constraints:
        minimum: 60
        maximum: 3600
      sensitivity: security_sensitive
      tuning_authority: platform_only
      description: Maximum bootstrap access-token lifetime.
  responsibilities:
    - resource_kind: identities
      owner: net-kingdom
      resources:
        - local-identity:bootstrap-store
        - local-identity:loopback-oidc-issuer
      repo_owns: Local store initialization, loopback issuer behavior, token lifecycle, and security checks.
      netkingdom_orchestrates: Select C0, provide non-secret bootstrap identity inputs, and require readiness evidence.
    - resource_kind: secrets_credentials
      owner: net-kingdom
      resources:
        - local-identity:signing-key
        - local-identity:filesystem-permissions
      repo_owns: Generate local signing material and enforce private filesystem permissions.
      netkingdom_orchestrates: Constrain the store location and retain secret values outside the scenario plan.
  trust:
    requires:
      - state: bare_host_trust
        readiness_checks: []
    satisfies:
      - state: bootstrap_identity_trust
        readiness_checks:
          - id: local-identity-permissions
            description: The local identity store and signing material have private permissions.
            evidence: local-identity security-check exits zero
          - id: local-identity-discovery
            description: The loopback issuer serves OIDC discovery at the planned issuer URL.
            evidence: discovery document is fetched from loopback and its issuer matches the planned port
  catalog:
    publish: capabilities/playbooks/net-kingdom.local-identity.yaml
    maturity: implemented-reference
    consumers:
      - netkingdom-security-scenario-composer