Open security core for dev sec ops on kubernetes

Find a file

tegwick 0f5f56275c All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details docs(nk-wp-0033): record the 2026-08-27 attended session findings platform-root login is restored and the resolver holds the current bind credential, so T04's outstanding reconciliation is done. No green receipt yet — the run of record is a FAIL at resolver-lookup, and T05 stays open. Records four things the session established: - the predecessor is dead, observed twice by hand, but not by receipt; - the value is unrecoverable, because no KeePassXC database has ever existed despite platform-root-custody.md naming a safe entry, and the only copy lived in a Firefox entry overwritten during the session. T04 replaced the credential with no step to update operator custody — the root cause of the whole session; - the reconciliation script had never completed a run (`4a38511`); - verify-t06.sh reported success at bootstrap against a resolver that was misconfigured and a reconciliation path that could not execute. That blind spot is open and is the finding worth acting on. Also corrects the record: the stale bind credential was real but did not cause the lookup failure. The HTTP 400 was our own request builder. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166		2026-08-27 22:20:48 +02:00
.claude	docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2)	2026-07-08 16:41:16 +02:00
.forgejo/workflows	Add Forgejo CI smoke workflow (enablement template)	2026-07-08 12:37:33 +02:00
.githooks	feat(creds): implement NK-WP-0004 Credential Management Foundation	2026-03-20 23:39:35 +00:00
canon	feat(posture): add deterministic feedback proposals	2026-08-23 13:16:34 +02:00
capabilities/playbooks	feat(orchestration): compose security scenarios	2026-08-23 12:40:52 +02:00
docs	docs(nk-wp-0033): record the 2026-08-27 attended session findings	2026-08-27 22:20:48 +02:00
examples	feat(orchestration): compose KeyCape C1 and C2b	2026-08-23 13:24:55 +02:00
history	feat(privacyidea): add guarded resolver reconciliation helper	2026-08-23 14:43:39 +02:00
identity-provisioner	Track and harden NK-WP-0025 residuals	2026-08-14 19:35:46 +02:00
keys	feat(creds): implement NK-WP-0004 Credential Management Foundation	2026-03-20 23:39:35 +00:00
local-identity	Local Identity OICD bootstrap	2026-05-02 16:58:44 +02:00
registry	feat(posture): add deterministic feedback proposals	2026-08-23 13:16:34 +02:00
sso-mfa	fix(privacyidea): repair the resolver reconciliation script (NK-WP-0033)	2026-08-27 22:20:03 +02:00
tests	NK-WP-0026 finished: user-engine caller identity verified live against railiance01	2026-08-19 22:01:12 +02:00
tools	feat(orchestration): compose KeyCape C1 and C2b	2026-08-23 13:24:55 +02:00
wiki	Add CLAUDE.md, wiki protoplans, and NK-WP-0001 workplan	2026-02-28 17:21:51 +01:00
workplans	docs(nk-wp-0033): record the 2026-08-27 attended session findings	2026-08-27 22:20:48 +02:00
.custodian-brief.md	chore(consistency): sync task status from DB [auto]	2026-08-25 20:15:52 +02:00
.gitignore	docs(canon): reconcile workload and tenant grouping semantics	2026-08-22 14:53:31 +02:00
.repo-classification.yaml	Human-review .repo-classification.yaml (CUST-WP-0050 follow-up)	2026-06-22 17:56:17 +02:00
.sops.yaml	feat(creds): implement NK-WP-0004 Credential Management Foundation	2026-03-20 23:39:35 +00:00
AGENTS.md	docs(agents): repoint remote State Hub URL to the in-cluster address	2026-08-25 00:21:25 +02:00
CLAUDE.md	Add credential routing instructions for all agent runtimes	2026-06-18 22:48:38 +02:00
CONFIG.md	feat(sso-mfa): T05 SSO stack pivot — Keycloak → Authelia + LLDAP + KeyCape (NK-WP-0001-T05)	2026-03-19 08:31:51 +00:00
DECISIONS.md	Decision for KeyCape Implementation Language Go	2026-03-26 09:21:17 +01:00
INTENT.md	Add meta-orchestration layer to ADR-0007; deepen NetKingdom INTENT	2026-05-21 01:00:39 +02:00
LICENSE	Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout)	2026-07-29 23:43:45 +02:00
Makefile	feat(orchestration): compose KeyCape C1 and C2b	2026-08-23 13:24:55 +02:00
README.md	feat(posture): add deterministic feedback proposals	2026-08-23 13:16:34 +02:00
SCOPE.md	feat(orchestration): compose KeyCape C1 and C2b	2026-08-23 13:24:55 +02:00
WORK-RECORDS.md	chore(consistency): record resolver follow-up status	2026-08-23 14:45:44 +02:00

README.md

NetKingdom

NetKingdom is the canonical security architecture, integration boundary, and bootstrap/reference implementation for NetKingdom environments. It defines identity, tenancy, credential, workload-zone, and security-composition contracts while leaving provider and Railiance execution in their owning repositories.

The dynamic, self-optimizing security platform is the long-term direction in INTENT.md, not a claim about current delivery.

Orientation

SCOPE.md — what this repo owns, current state, and when it is relevant
Security scenario composition — deterministic, plan-only capability and trust composition
Posture feedback — deterministic, proposal-only posture and evidence remediation findings

Security Infrastructure Documents

secrets-engine security infrastructure boundary defines how secrets-engine participates in the NetKingdom security infrastructure and how it interacts with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.