Open security core for dev sec ops on kubernetes
tegwick
2aaf46ce95
Conformance sweep across the §4 catalog found two defects in this standard. §11 required every catalogued repository to declare its layer in INTENT.md, which OpenBao cannot do — the estate catalogues it but does not author it. That is the §9.1 defect applied to conformance rather than capability: a rule assigning an obligation the holder cannot discharge. For components the estate does not author, the catalog row is the declaration. §11 also did not say what a declaration is. A layer stated about a repository by another repository is not one. The nine repositories carrying gate-house's layering review note appear to declare a layer, but the words are gate-house's and sit above a line admitting the body is unadapted — assertion, not assent, which is the pattern this estate rejects. §14 now records the honest count: seven of fifteen estate-authored repositories have declared in their own voice. Adoption is not claimed on the basis of notes gate-house wrote into other repositories. Amended in place rather than versioned: v0.4 is proposed and unassented. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2564823@bnt-lap001 Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9 |
||
|---|---|---|
| .claude | ||
| .forgejo/workflows | ||
| .githooks | ||
| canon | ||
| capabilities/playbooks | ||
| docs | ||
| examples | ||
| history | ||
| identity-provisioner | ||
| keys | ||
| local-identity | ||
| registry | ||
| sso-mfa | ||
| tests | ||
| tools | ||
| wiki | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| .sops.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| CONFIG.md | ||
| DECISIONS.md | ||
| INTENT.md | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
NetKingdom
NetKingdom is the canonical security architecture, integration boundary, and bootstrap/reference implementation for NetKingdom environments. It defines identity, tenancy, credential, workload-zone, and security-composition contracts while leaving provider and Railiance execution in their owning repositories.
The dynamic, self-optimizing security platform is the long-term direction in INTENT.md, not a claim about current delivery.
Orientation
- SCOPE.md — what this repo owns, current state, and when it is relevant
- Security layer model — how the security estate is layered (Taxonomy / Tooling / Engines / Staff) and what each layer may own
- Security scenario composition — deterministic, plan-only capability and trust composition
- Posture feedback — deterministic, proposal-only posture and evidence remediation findings
Security Infrastructure Documents
- secrets-engine security infrastructure boundary defines how secrets-engine participates in the NetKingdom security infrastructure and how it interacts with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.