tegwick
9e041e3662
Answers zone-engine ZONE-WP-0001-T01. Decision 5.6 — enforcement stance is a sibling standard, not an axis. The six ladders are monotone and the whole current/target/guard machinery depends on it; enforcement stance is not (ADR-0006 is the finding that the top rung is wrong for the SSH lane). And this framework is descriptive: an accurately declared exempt would be conformant and exempt. Membership is declared, stance belongs to the control owner. Zone membership rides tenancy.yaml under a reserved zones: key so the estate keeps one declaration surface; the schema permits it, unconstrained. Decisions 8.4.1/8.4.2 — 'substrate location is not evidence' stated once instead of three repo-local slogans, and the reef/P/V gap recorded as this document's defect rather than zone-engine's scope. NK-WP-0027 takes it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
427 lines
8.6 KiB
JSON
427 lines
8.6 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://policy.coulomb.social/schemas/tenancy-posture/v0.1",
|
|
"title": "NetKingdom tenancy posture declaration v0.1",
|
|
"type": "object",
|
|
"required": [
|
|
"schema_version",
|
|
"framework"
|
|
],
|
|
"properties": {
|
|
"schema_version": {
|
|
"const": "0.1"
|
|
},
|
|
"framework": {
|
|
"const": "netkingdom-tenancy-posture"
|
|
},
|
|
"service": {
|
|
"$ref": "#/$defs/serviceName"
|
|
},
|
|
"role": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tenancy": {
|
|
"$ref": "#/$defs/tenancy"
|
|
},
|
|
"provider": {
|
|
"$ref": "#/$defs/provider"
|
|
},
|
|
"zones": {
|
|
"description": "Reserved for security-zone membership (tenancy-posture_v0.1 Decision 5.6). Its internal shape is defined by the NetKingdom security-zone standard drafted by zone-engine, not by this schema, and is deliberately unconstrained here until that standard lands. Present so a conformant combined declaration is not rejected by this validator."
|
|
},
|
|
"evidence": {
|
|
"$ref": "#/$defs/evidence"
|
|
},
|
|
"notes": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"services": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/service"
|
|
}
|
|
}
|
|
},
|
|
"oneOf": [
|
|
{
|
|
"required": [
|
|
"service",
|
|
"role",
|
|
"tenancy"
|
|
],
|
|
"not": {
|
|
"required": [
|
|
"services"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"required": [
|
|
"services"
|
|
],
|
|
"not": {
|
|
"anyOf": [
|
|
{
|
|
"required": [
|
|
"service"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"role"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"tenancy"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"provider"
|
|
]
|
|
},
|
|
{
|
|
"required": [
|
|
"evidence"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"additionalProperties": false,
|
|
"$defs": {
|
|
"serviceName": {
|
|
"type": "string",
|
|
"pattern": "^[a-z0-9][a-z0-9._-]*$"
|
|
},
|
|
"axisName": {
|
|
"enum": [
|
|
"I",
|
|
"A",
|
|
"E",
|
|
"P",
|
|
"R",
|
|
"V"
|
|
]
|
|
},
|
|
"level": {
|
|
"oneOf": [
|
|
{
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 4
|
|
},
|
|
{
|
|
"const": "n/a"
|
|
}
|
|
]
|
|
},
|
|
"axisVector": {
|
|
"type": "object",
|
|
"required": [
|
|
"I",
|
|
"A",
|
|
"E",
|
|
"P",
|
|
"R",
|
|
"V"
|
|
],
|
|
"properties": {
|
|
"I": {
|
|
"oneOf": [
|
|
{
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 3
|
|
},
|
|
{
|
|
"const": "n/a"
|
|
}
|
|
]
|
|
},
|
|
"A": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"E": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"P": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"R": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"V": {
|
|
"$ref": "#/$defs/level"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"partialAxisVector": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"properties": {
|
|
"I": {
|
|
"oneOf": [
|
|
{
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 3
|
|
},
|
|
{
|
|
"const": "n/a"
|
|
}
|
|
]
|
|
},
|
|
"A": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"E": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"P": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"R": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"V": {
|
|
"$ref": "#/$defs/level"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"stringMap": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"stringList": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"paths": {
|
|
"type": "object",
|
|
"propertyNames": {
|
|
"$ref": "#/$defs/axisName"
|
|
},
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"additionalProperties": {
|
|
"$ref": "#/$defs/level"
|
|
}
|
|
}
|
|
},
|
|
"placementException": {
|
|
"type": "object",
|
|
"required": [
|
|
"tenants",
|
|
"P",
|
|
"reason"
|
|
],
|
|
"properties": {
|
|
"tenants": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"P": {
|
|
"type": "integer",
|
|
"minimum": 0,
|
|
"maximum": 4
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tier_ref": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"tenancy": {
|
|
"type": "object",
|
|
"required": [
|
|
"current",
|
|
"target",
|
|
"reviewed",
|
|
"review_due",
|
|
"service_class"
|
|
],
|
|
"properties": {
|
|
"current": {
|
|
"$ref": "#/$defs/axisVector"
|
|
},
|
|
"implemented": {
|
|
"$ref": "#/$defs/partialAxisVector"
|
|
},
|
|
"target": {
|
|
"$ref": "#/$defs/axisVector"
|
|
},
|
|
"reviewed": {
|
|
"type": "string",
|
|
"format": "date"
|
|
},
|
|
"review_due": {
|
|
"type": "string",
|
|
"format": "date"
|
|
},
|
|
"service_class": {
|
|
"enum": [
|
|
"latency-critical",
|
|
"interactive",
|
|
"batch"
|
|
]
|
|
},
|
|
"permanent": {
|
|
"type": "array",
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"$ref": "#/$defs/axisName"
|
|
}
|
|
},
|
|
"reason": {
|
|
"$ref": "#/$defs/stringMap"
|
|
},
|
|
"gap": {
|
|
"$ref": "#/$defs/stringMap"
|
|
},
|
|
"paths": {
|
|
"$ref": "#/$defs/paths"
|
|
},
|
|
"placement_exceptions": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/placementException"
|
|
}
|
|
},
|
|
"secondary_stores": {
|
|
"$ref": "#/$defs/stringList"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"providerAxis": {
|
|
"type": "object",
|
|
"required": [
|
|
"available",
|
|
"maximum"
|
|
],
|
|
"properties": {
|
|
"available": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"maximum": {
|
|
"$ref": "#/$defs/level"
|
|
},
|
|
"conditions": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"evidence": {
|
|
"$ref": "#/$defs/stringList"
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"provider": {
|
|
"type": "object",
|
|
"required": [
|
|
"axes"
|
|
],
|
|
"properties": {
|
|
"capability": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"profile": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"axes": {
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"properties": {
|
|
"I": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"A": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"E": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"P": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"R": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
},
|
|
"V": {
|
|
"$ref": "#/$defs/providerAxis"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"evidence": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"oneOf": [
|
|
{
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
{
|
|
"$ref": "#/$defs/stringList"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"service": {
|
|
"type": "object",
|
|
"required": [
|
|
"service",
|
|
"role",
|
|
"tenancy"
|
|
],
|
|
"properties": {
|
|
"service": {
|
|
"$ref": "#/$defs/serviceName"
|
|
},
|
|
"role": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tenancy": {
|
|
"$ref": "#/$defs/tenancy"
|
|
},
|
|
"provider": {
|
|
"$ref": "#/$defs/provider"
|
|
},
|
|
"evidence": {
|
|
"$ref": "#/$defs/evidence"
|
|
},
|
|
"notes": {
|
|
"$ref": "#/$defs/stringList"
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|