coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Open security core for dev sec ops on kubernetes
1058 commits 2 branches 0 tags 5.5 MiB
Find a file
tegwick 5466c831cd
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
NK-WP-0040-T02: railiance-infra names the S1 converge wrapper as emitter (babae80) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
2026-10-28 09:58:04 +01:00
.claude docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2) 2026-07-08 16:41:16 +02:00
.forgejo/workflows Surface redacted directory bind failures before native onboarding 2026-09-14 04:46:29 +02:00
.githooks feat(creds): implement NK-WP-0004 Credential Management Foundation 2026-03-20 23:39:35 +00:00
.repo-manager Security Layer Model v0.5 — four reviews, nine changes 2026-08-29 02:54:25 +02:00
canon Close SI-X4: OpenBao platform-admin binds aal2 (founder-applied, RPF-WP-0065-T04) 2026-10-27 23:23:06 +01:00
capabilities/playbooks NK-WP-0048-T09: keycape-client entry point and declaration 2026-10-08 23:03:00 +02:00
docs Workplan triage: NK-WP-0048/0050 blocked, NK-WP-0011 backlog, NK-WP-0053 pulled forward 2026-10-28 09:15:06 +01:00
examples Prepare empty custody baseline and record owner delivery handoff 2026-10-03 19:53:32 +02:00
generated/coordination-frame Adopt shared hourly coordination frame and prepare guarded runtime patches 2026-10-15 20:45:06 +02:00
history NK-WP-0054: record the founder's state-hub attribution decisions 2026-10-25 00:08:31 +02:00
identity-provisioner feat(identity): add PostgreSQL provenance and verify sealed SOPS custody 2026-10-17 01:36:38 +02:00
intakes build: adopt staged records and retain pending owner handoff evidence 2026-10-19 13:32:59 +02:00
keys feat(creds): implement NK-WP-0004 Credential Management Foundation 2026-03-20 23:39:35 +00:00
local-identity Report bootstrap audit failures and track cadence adoption work 2026-10-03 22:42:57 +02:00
projects/nk-rehearsal Add nk-rehearsal project for the NK-WP-0044-T05 pack rehearsal 2026-10-02 22:31:20 +02:00
registry docs(recovery): accept retained token material and audit continuity 2026-10-16 21:14:23 +02:00
runbooks Follow the access-engine CLI rename: ./cmd/flex-auth -> ./cmd/access-engine 2026-10-10 15:28:05 +02:00
security-case-type-revisions NK-WP-0048-T34: integrate the corrected F3 owner configuration inverse text into 1.3 2026-10-23 07:08:41 +02:00
security-case-types NK-WP-0048: run keycape check-config before any registry patch 2026-10-10 15:28:05 +02:00
security-cases NK-WP-0048: oidc-browser-relying-party 1.1; re-pin the Forgejo case 2026-10-10 13:25:54 +02:00
sso-mfa NK-WP-0048-T12: register-client restarts the issuer and waits for readiness after a changed registry 2026-10-23 07:06:48 +02:00
tests NK-WP-0055-T13: kingpath-offsite --verify restores and checks the break-glass copy 2026-10-27 23:47:21 +01:00
tools NK-WP-0040-T02 / NK-WP-0054-T04: integrate railiance-platform answers (bd8ca57) 2026-10-28 09:54:14 +01:00
wiki Add CLAUDE.md, wiki protoplans, and NK-WP-0001 workplan 2026-02-28 17:21:51 +01:00
workplans NK-WP-0040-T02: railiance-infra names the S1 converge wrapper as emitter (babae80) 2026-10-28 09:58:04 +01:00
.generated-work-records.json build: adopt staged records and retain pending owner handoff evidence 2026-10-19 13:32:59 +02:00
.generated-work-records.mk build: derive coordination receiver from staged owner sources 2026-10-19 13:44:36 +02:00
.gitignore build: keep generated orientation brief local and untracked 2026-10-19 13:50:40 +02:00
.repo-classification.yaml Human-review .repo-classification.yaml (CUST-WP-0050 follow-up) 2026-06-22 17:56:17 +02:00
.sops.yaml fix(security): constrain SOPS writes and custody argument handoff 2026-10-13 21:03:24 +02:00
AGENTS.md NK-WP-0054: security review; standard draft-3 as a SecurityCanon profile; agent security quickstart 2026-10-24 23:12:37 +02:00
CLAUDE.md NK-WP-0054: security review; standard draft-3 as a SecurityCanon profile; agent security quickstart 2026-10-24 23:12:37 +02:00
CONFIG.md Adopt shared hourly coordination frame and prepare guarded runtime patches 2026-10-15 20:45:06 +02:00
DECISIONS.md Decision for KeyCape Implementation Language Go 2026-03-26 09:21:17 +01:00
INTENT.md Declare net-kingdom's own layer and record positions on the v0.8 hold and §11 amendments. 2026-09-21 12:36:10 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-29 23:43:45 +02:00
Makefile NK-WP-0054: security review; standard draft-3 as a SecurityCanon profile; agent security quickstart 2026-10-24 23:12:37 +02:00
README.md Accept security layer v0.8 from confirmed native review 2026-10-11 01:53:56 +02:00
SCOPE.md build: keep generated orientation brief local and untracked 2026-10-19 13:50:40 +02:00
SECURITY-COMPANION.md Accept security layer v0.8 from confirmed native review 2026-10-11 01:53:56 +02:00
WORK-RECORDS.md NK-WP-0011: set status blocked (sync had reverted backlog to active) 2026-10-28 09:24:17 +01:00

README.md

NetKingdom

NetKingdom is the canonical security architecture, integration boundary, and bootstrap/reference implementation for NetKingdom environments. It defines identity, tenancy, credential, workload-zone, and security-composition contracts while leaving provider and Railiance execution in their owning repositories.

The dynamic, self-optimizing security platform is the long-term direction in INTENT.md, not a claim about current delivery.

Orientation

  • SCOPE.md — what this repo owns, current state, and when it is relevant
  • SECURITY-COMPANION.md — start here. The working form of the security layer model: what to declare, what binds you, what you may never claim about evidence, and the two things the estate cannot do yet
  • Security layer model — the statute the companion serves (accepted 2026-08-29): how the security estate is layered (Taxonomy / Tooling / Engines / Staff) and what each layer may own
  • Security scenario composition — deterministic, plan-only capability and trust composition
  • Posture feedback — deterministic, proposal-only posture and evidence remediation findings
  • Emission cadence security profile — NetKingdom obligations over the InfoTechCanon declaration contract; proposed pending owner-instance migration

Security Infrastructure Documents

  • secrets-engine security infrastructure boundary defines how secrets-engine participates in the NetKingdom security infrastructure and how it interacts with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, State Hub, and agents.