NetKingdom Ecosystem Status
Living status for the NetKingdom identity and security platform and its
sister repositories. Updated from repo workplans, State Hub, and the
reuse.coulomb.social federated capability
registry.
Last updated: 2026-07-08
At a Glance
| Area |
Status |
| NetKingdom core |
Delivered — IAM Profile v0.2, bootstrap/custody arc, security console, boundary contracts |
| Lightweight identity |
Stable — key-cape v0.1 complete; Authelia + LLDAP + privacyIDEA stack live |
| Authorization |
Baseline complete — flex-auth PDP shipped; production policy.enabled still off pending ecosystem flip |
| Operational access |
Production-verified — ops-warden SSH cert lane live on Railiance OpenBao |
| User domain |
Planning arc complete — user-engine WP-0001–0019 finished; live stack wiring not yet evidenced |
| Deployment substrate |
S2 stable (single-node k3s), S3 emerging (OpenBao + CNPG live), S5 first app operational |
| Capability discovery |
Federation live — 61 capabilities across 62 workstation repos via reuse-surface |
| Active NetKingdom backlog |
NK-WP-0009 (security tutorials), NK-WP-0011 (enterprise SAML federation) |
Bottom line: The security spine is bootstrappable, standards are canonical,
and the lightweight identity + SSH access lanes are production-proven. The next
meaningful expansions are enterprise federation (expanded-mode Keycloak),
operator tutorials, flex-auth live enforcement, and user-engine production
integration.
NetKingdom (this repo)
Role: Platform domain for identity and security — owns normative contracts,
bootstrap tooling, and meta-orchestration responsibility over the security
landscape. See SCOPE.md, INTENT.md, and docs/responsibility-map.md.
Maturity (reuse federation)
| Capability |
ID |
Vector |
Status |
| NetKingdom Security/IAM Tooling Suite |
capability.security.iam-tooling-suite |
D3 / A2 / C1 / R1 |
draft |
Source: reuse.coulomb.social/v1/federated — net-kingdom index at registry/indexes/capabilities.yaml.
Delivered workplans
| ID |
Title |
Notes |
| NK-WP-0001 |
SSO & MFA Platform (Keycloak + privacyIDEA) |
Archived — expanded-mode baseline |
| NK-WP-0002 |
Local Identity (bootstrap OIDC) |
Finished |
| NK-WP-0003 |
KeyCape + privacyIDEA cluster deployment |
Completed |
| NK-WP-0004 |
Credential Management Foundation |
Done |
| NK-WP-0005 |
Agent-Driven Credential Bootstrap |
Done |
| NK-WP-0006 |
Recursive platform identity architecture |
Finished |
| NK-WP-0007 |
Object Storage STS credential vending |
Finished |
| NK-WP-0008 |
IT Security Architecture Patterns (infospace) |
Done |
| NK-WP-0010 |
Genesis Security Pattern Completion |
Finished |
| NK-WP-0012 |
NetKingdom IAM Profile Specification |
Finished — canon/standards/iam-profile_v0.2.md |
| NK-WP-0013 |
Playbook Capability Contract |
Finished — canon/standards/playbook-capability-contract_v0.1.md |
| NK-WP-0014 |
User Engine boundary contracts |
Finished — canon/standards/user-engine-boundary-contract_v0.1.md |
| NET-WP-0015 |
King Credential & OpenBao identity bootstrap |
Finished |
| NET-WP-0016 |
Guided Security Bootstrap Experience |
Finished |
| NET-WP-0017 |
IT Security Readiness for User Onboarding |
Finished |
| NET-WP-0018 |
Bootstrap Automation & Rebuild Readiness |
Finished |
| NET-WP-0019 |
User lifecycle dry-run polish |
Finished |
| NET-WP-0020 |
OpenBao unseal custody models & SSH automation |
Finished — greenfield init/unseal proof 2026-07-02 |
User-engine implementation workplans NK-WP-0015–0019 (isolated MVP through
conformance) are archived here but executed in user-engine.
Backlog
| ID |
Title |
Status |
Depends on |
| NK-WP-0009 |
NetKingdom Security Pattern Tutorials |
backlog |
NK-WP-0008 (done) |
| NK-WP-0011 |
Enterprise Federation & SAML (expanded-mode Keycloak) |
backlog |
NK-WP-0003, 0004, 0006 |
Runnable artifacts
| Artifact |
Path |
Purpose |
| IAM Profile conformance checker |
tools/iam-profile-conformance/ |
Verify OIDC/PKCE claim shapes against v0.2 |
| Playbook capability contract validator |
tools/playbook-capability-contract/ |
Validate scenario playbooks against v0.1 contract |
| Security bootstrap console |
tools/security-bootstrap-console/ |
Custody gates, roster, evidence validators (non-secret) |
| Bootstrap agent |
sso-mfa/bootstrap/creds-bootstrap-agent.sh |
Unattended credential + OpenBao init/unseal (Phase 7b) |
| OpenBao init/unseal script |
sso-mfa/bootstrap/openbao-init-unseal.sh |
Greenfield-proven custody-gated init/unseal |
Key standards (canonical)
canon/standards/iam-profile_v0.2.md — OIDC/PKCE contract all apps targetcanon/standards/playbook-capability-contract_v0.1.md — meta-orchestration interfacecanon/standards/user-engine-boundary-contract_v0.1.md — user-domain integrationcanon/standards/credential-management_v0.2.md — credential lifecycle modeldocs/platform-identity-security-architecture.md — capability ladder C0–C6
Capability Ladder Position
NetKingdom's architecture progresses by capability tier, not user count
(docs/platform-identity-security-architecture.md):
C0 Bootstrap local identity ✅ NK-WP-0002
C1 Lightweight SSO (KeyCape) ✅ NK-WP-0003, key-cape v0.1
C2 MFA / 2FA ✅ privacyIDEA in KeyCape stack
C3 Runtime secrets (OpenBao) ✅ NET-WP-0015–0020, railiance-platform
C4 Fine-grained authorization 🟡 flex-auth baseline done; live enforcement pending
C5 User-domain service 🟡 user-engine WP arc done; production wiring pending
C6 Enterprise federation (SAML) ⏸ NK-WP-0011 backlog
Sister Repositories
Identity & security runtime
key-cape
|
|
| Purpose |
Lightweight IAM implementation of the NetKingdom IAM Profile (Authelia + LLDAP + privacyIDEA). |
| Maturity |
capability.iam.key-cape — D4 / A2 / C2 / R1 (draft) |
| Workplans |
KEY-WP-0001–0003 all finished |
| NetKingdom relation |
Primary lightweight implementer of iam-profile_v0.2.md; applications integrate against the profile, not KeyCape internals. |
| Status |
Stable v0.1 — container image, acceptance suite, bootstrap console OIDC/MFA verification client shipped. |
flex-auth
|
|
| Purpose |
Policy-as-code authorization registry and PDP — turns verified IAM claims into allow/deny decisions. |
| Maturity |
capability.authorization.policy-evaluate — D4 / A2 / C2 / R1 (draft) |
| Workplans |
FLEX-WP-0001–0007 all finished |
| NetKingdom relation |
Consumes NetKingdom IAM Profile claims; sits between identity and protected systems. First consumer: ops-warden SSH signing gate. |
| Status |
Go service with POST /v1/check live; production deployment smoke verified 2026-06-29. policy.enabled deliberately off — gate verified but not live-enforced. |
user-engine
|
|
| Purpose |
Headless user-domain service — accounts, memberships, profiles, projections; not an IdP or PDP. |
| Maturity |
capability.identity.user-engine — D4 / A1 / C2 / R0 (draft) |
| Workplans |
USER-WP-0001–0019 all finished (Jun 2026) |
| NetKingdom relation |
Governed by user-engine-boundary-contract_v0.1.md (NK-WP-0014). Consumes IAM claims; defers authZ to flex-auth. |
| Status |
Full planning arc through Postgres durable store + conformance; production integration with live key-cape/flex-auth not yet evidenced. |
ops-warden
|
|
| Purpose |
Operational access steward — short-lived SSH certs for adm/agt/atm; routes all other credential needs via warden route. |
| Maturity |
capability.security.ssh-certificate-issuance — D4 / A3 / C3 / R2 (draft) |
| Workplans |
Through WARDEN-WP-0024 finished (Jul 2026) |
| NetKingdom relation |
Operational face of the NetKingdom security model; maintains routing catalog aligned to NK canon. NetKingdom depends on it for the SSH lane but does not orchestrate its resources. |
| Status |
Mission-complete for SSH lane. Production signing verified on https://bao.coulomb.social. warden access front door, audit trail, experiential memory shipped. |
ops-bridge
|
|
| Purpose |
SSH reverse tunnel lifecycle manager — keeps remote agents connected to local State Hub. |
| Maturity |
capability.ops.tunnel-bridge — D3 / A2 / C2 / R1 (draft) |
| Workplans |
BRIDGE-WP-0001–0005, OPS-WP-0001–0002 all finished |
| NetKingdom relation |
Tunnel transport layer; consumes ops-warden certs via cert_command. |
| Status |
v0.1 core complete (~80%). cert_command live cutover on agt-state-hub-bridge pilot pending — readiness gate shipped by ops-warden (WP-0016). |
Standards & canon
info-tech-canon
|
|
| Purpose |
Markdown-first InfoTechCanon — evolving standards corpus (kernel, 11 domain models, CARING access-governance). |
| Maturity |
capability.infotech.canon-service — D2 / A2 / C1 / R0 (draft) |
| Workplans |
ITC-WP-0001–0012 all finished |
| NetKingdom relation |
Upstream semantic foundation for security posture canon (ops-warden WP-0015 landing), platform architecture patterns, user-engine evaluation pack. |
| Status |
Seed kernel complete; next target: Kernel RC1. |
identity-canon
|
|
| Purpose |
Implementation-neutral vocabulary for identity concepts across IAM, directory, federation, authorization. |
| Workplans |
IDENTITY-WP-0001–0003 all finished |
| NetKingdom relation |
Feeds terminology discipline for user-engine and broader IAM vocabulary. Complements net-kingdom normative contracts. |
| Status |
Active research scaffold; next pass: source-note backfill and model revision. |
Deployment substrate (Railiance OAS)
railiance-cluster (S2)
|
|
| Purpose |
Cluster runtime — k3s, Helm, ingress, cert-manager, operators on COULOMBCORE. |
| Maturity |
capability.railiance.cluster-bootstrap — D3 / A2 / C1 / R0 (draft) |
| Workplans |
RAIL-BS-WP-0002–0006, RAILIANCE-WP-0012–0014 finished; RAIL-BS-WP-0008/0009 finished Jul 2026 |
| NetKingdom relation |
Runtime substrate for SSO/MFA namespaces, CNPG operator, all security services. |
| Status |
Single-node production stable. Backlog: RAIL-BS-WP-0007 ThreePhoenix HA cluster. |
railiance-platform (S3)
|
|
| Purpose |
Platform services — PostgreSQL (CNPG), Valkey, OpenBao, object storage, identity integration point. |
| Maturity |
capability.railiance.platform-services — D3 / A2 / C1 / R0 (draft) |
| Workplans |
RAILIANCE-WP-0005–0011 all finished |
| NetKingdom relation |
Hosts OpenBao (runtime secret authority), credential broker, identity services integration surface. |
| Status |
CNPG operator deployed; OpenBao platform secrets service live; warden-sign broker routing live 2026-07-01. |
railiance-apps (S5)
|
|
| Purpose |
Workloads & experience endpoints — application Helm releases, deployment guardrails. |
| Workplans |
RAIL-AP-WP-0001 through RAILIANCE-WP-0011 all finished |
| NetKingdom relation |
Consumes platform identity integrations at S5 deployment layer. |
| Status |
First app (vergabe-teilnahme) operational; Gitea/registry extracted to railiance-forge. No active workplans. |
Reuse & discovery
reuse-surface
|
|
| Purpose |
Federated capability registry — discover, compare, validate, promote capabilities by D/A/C/R maturity vector. |
| Maturity |
capability.registry.register D3/A4/C2/R3; capability.registry.validate D4/A3/C3/R3 |
| Workplans |
REUSE-WP-0017–0019 finished (Jul 2026) |
| NetKingdom relation |
Discovery layer for the ecosystem; net-kingdom registers capability.security.iam-tooling-suite. |
| Status |
62/62 workstation repos established; production hub at https://reuse.coulomb.social (61 federated capabilities as of 2026-07-08). |
open-reuse
|
|
| Purpose |
Managed continuity for valuable OSS integrations — structured update loops for proven integrations. |
| Workplans |
OPEN-WP-0001–0004 all finished |
| NetKingdom relation |
Adjacent reuse layer; complements reuse-surface's capability maturity registry. |
| Status |
Foundation complete; CLI validator (open-reuse validate) shipped. |
Integration Flow
Bootstrap plane (net-kingdom)
local-identity / creds-bootstrap-agent / security-bootstrap-console
│
▼
Platform control plane
key-cape (lightweight) ──or── Keycloak (expanded, NK-WP-0011 backlog)
│ verified IAM Profile claims
▼
flex-auth (authorization PDP)
│ allow/deny decisions
▼
protected systems (ops-warden SSH, Markitect, apps, …)
Parallel lanes:
user-engine ← IAM claims (boundary contract NK-WP-0014)
OpenBao ← runtime secrets (railiance-platform, NET-WP-0020 custody models)
ops-warden ← SSH certs + credential routing front door
ops-bridge ← reverse tunnels (cert_command consumer)
Credential routing canon: agents call warden route find before requesting
secrets — ops-warden issues SSH certs only; all other credentials route to
owning subsystems (OpenBao, key-cape, flex-auth). See
~/ops-warden/wiki/CredentialRouting.md.
Cross-Ecosystem Gaps
| Gap |
Primary owners |
Impact |
flex-auth policy.enabled off in production |
flex-auth, ops-warden |
SSH signing gate verified but not live-enforced |
ops-bridge cert_command live cutover |
ops-bridge |
Short-lived cert tunnels not yet production-default |
| NK-WP-0009 security pattern tutorials |
net-kingdom |
Operator/agent onboarding material missing |
| NK-WP-0011 SAML / enterprise federation |
net-kingdom |
Expanded-mode Keycloak identity broker not started |
| Workload Security Posture canon landing |
net-kingdom, info-tech-canon |
ops-warden drafted M0–M3 model; owner-driven landing pending |
| user-engine production integration |
user-engine, key-cape, flex-auth |
WP arc complete; live stack wiring not evidenced |
| railiance-cluster ThreePhoenix HA |
railiance-cluster |
Single-node stable; multi-node HA in backlog |
| info-tech-canon Kernel RC1 |
info-tech-canon |
Seed kernel complete; schema consolidation remaining |
| Unified tool packaging |
net-kingdom |
Three conformance tools lack single install path (reuse notes) |
Recent Milestones
| Date |
Event |
| 2026-07-08 |
NK-WP-0009 and NK-WP-0011 moved to backlog; reuse federation index refreshed (61 capabilities) |
| 2026-07-08 |
reuse-surface REUSE-WP-0019 — Forgejo webhook automation + reuse telemetry |
| 2026-07-02 |
NET-WP-0020 — OpenBao greenfield init/unseal proof; bao write sys/unseal key=- fix |
| 2026-07-01 |
ops-warden warden-sign broker routing live on railiance-platform |
| 2026-06-29 |
flex-auth FLEX-WP-0007 — production policy-gate smoke verified |
| 2026-06-18 |
ops-warden production SSH signing verified on Railiance OpenBao |
| 2026-06 |
user-engine USER-WP-0016–0019 — Postgres store + conformance; key-cape KEY-WP-0003 bootstrap console client |
| 2026-05 |
NK-WP-0012 IAM Profile v0.2 canonical; NK-WP-0014 user-engine boundary contract |
State Hub
- API:
http://127.0.0.1:8000 (local) / http://127.0.0.1:18000 (tunnel)
- Topic: infotech (
cee7bedf-2b48-46ef-8601-006474f2ad7a)
- NetKingdom workplans in hub: NK-WP-0009 and NK-WP-0011 registered as
backlog; finished plans indexed under net-kingdom-* slugs
Sync after workplan changes:
statehub fix-consistency --repo net-kingdom
How to Refresh This Document
- Scan
workplans/ and workplans/archived/ for status changes.
- Query State Hub:
curl -s "http://127.0.0.1:8000/workplans/?repo=net-kingdom".
- Pull reuse federation:
curl -s "https://reuse.coulomb.social/v1/federated".
- Check sister-repo
SCOPE.md and registry/indexes/capabilities.yaml.
- Update the Last updated date and relevant tables.
Related orientation files: SCOPE.md (scope boundary), .custodian-brief.md
(auto-generated), docs/responsibility-map.md (orchestration relationships).
tegwick
75cfaed593