---
id: NK-WP-0030
type: workplan
title: "Implement deterministic security scenario composition"
domain: infotech
repo: net-kingdom
status: blocked
owner: codex
topic_slug: netkingdom
planning_priority: P1
created: "2026-08-23"
updated: "2026-08-23"
---

# NK-WP-0030 — Deterministic security scenario composition

Authorized by the operator as the first implementation increment following the
2026-08-23 scope-to-intent gap assessment. This work closes the locally owned
part of G1 without moving playbook execution into NetKingdom.

## Define the scenario composition contract

```task
id: NK-WP-0030-T01
status: done
priority: high
```

Published proposed `security-scenario-composition_v0.1` canon and its scenario
schema. It requires exact provider pins under ambiguity, explicit initial trust,
fail-closed sequencing, owner attribution, readiness obligations, and an
unconditional non-execution boundary.

## Implement the canonical composer

```task
id: NK-WP-0030-T02
status: done
priority: high
```

Implemented `tools/security-scenario-composer/`. It consumes Playbook Capability
Contract v0.1 declarations, rejects invalid or ambiguous inputs, validates
authority-bound parameter overrides, orders selected declarations by explicit
trust transitions, and emits a deterministic owner-routed JSON plan with a
content digest and `execution.permitted: false`. The older conformance-demo
selector now also refuses ambiguity and overrides targeting unselected
declarations.

## Publish a C0 reference composition

```task
id: NK-WP-0030-T03
status: done
priority: high
```

Published `capabilities/playbooks/net-kingdom.local-identity.yaml` and
`examples/security-scenarios/c0-local-identity.yaml`. The non-secret reference
selects the exact local provider, starts from explicit `bare_host_trust`, and
plans the readiness obligations for `bootstrap_identity_trust` without
executing the CLI entry point.

## Obtain lightweight-provider declarations

```task
id: NK-WP-0030-T04
status: wait
priority: high
```

Ask the KeyCape/Railiance owners to publish conformant C1 and selected C2
declarations beside their execution entry points. Do not fabricate provider
authority in NetKingdom. The complete lightweight SSO scenario remains blocked
until those declarations exist and pass the canonical composer. Routed to
`key-cape` in State Hub message `64d247e4-9170-4d18-b7ed-d8b071282104`.

## Verify the fail-closed and reference paths

```task
id: NK-WP-0030-T05
status: done
priority: medium
```

Added ten composer tests and five regression tests for the legacy declaration
validator/demo selector, including secret-reference syntax enforcement.
Exact selection, ambiguity refusal, bad pins, override boundaries, duplicate
ids, dependency ordering, unresolved trust, responsibility/readiness mapping,
and the checked-in C0 composition pass. The complete relevant repository suite
passes 70 tests; the isolated local-identity suite passes 142 tests. JSON/YAML
parsing, Python compilation, the reference CLI, and `git diff --check` also
pass.