tegwick
b7749277fd
Review against security-canon (Mode of Authority, SEC-DSM 1.0.0) showed the draft restated canon rules and invented a parallel taxonomy. Draft-3 imports principal_type and MODE @ SCOPE grants, treats break-glass as an activation, cites SEC-DSM per rule, states the estate identities in canon terms and adds SI-15 (accountable automation: prepare, admit, execute, verify, retain). Founder decisions and rule ids are kept. For agents: tools/security-tools.json and make security-tools list each security tool, the question it answers and whether an agent may run it; a test keeps the index complete. AGENTS.md and CLAUDE.md carry the same quickstart block. Validator migration to grants is T03b. Review record in history/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2.5 KiB
NetKingdom — Claude Code Instructions
@SCOPE.md @.claude/rules/repo-identity.md @.claude/rules/session-protocol.md @.claude/rules/first-session.md @.claude/rules/workplan-convention.md @.claude/rules/stack-and-commands.md @.claude/rules/architecture.md @.claude/rules/repo-boundary.md @.claude/rules/credential-routing.md @.claude/rules/agents.md
NetKingdom situational knowledge pilot
For security-related work, read the shared Emergent Security orientation and the task's card in that package. From this repository root, validate and read:
PYTHONPATH=../emergent-security/src python3 -m emergent_security.knowledge --repositories .. show start --audience generic
Use the matching provider audience when known and retrieve the relevant card.
Record package version, digest and source status; reload after resume/compaction
or a repository switch. A withheld card requires source review; an offline
snapshot is orientation only. If the sibling checkout is absent, use the trusted
installed emergent-knowledge package or an explicitly reviewed exported bundle;
do not silently download or execute a replacement.
This pilot adds situational knowledge, not authority, live readiness or a change
to this repository's owner contracts. Work: emergent-security/EMERGENT-WP-0002.
Security quickstart for agents (Claude Code, Codex, Grok)
- Find the tool:
make security-toolslists every security tool, the question it answers, how to run it and whether an agent may run it (tools/security-tools.jsonis the machine-readable form). Tool availability is not permission. - Know the rules:
SECURITY-COMPANION.mdsection 7 ("If you are an agent"). - Credentials:
warden route find "<need>" --json. Never ask for, print or store a secret value. - Accounts and accountable automation:
canon/standards/service-identity-privilege_v0.1.md, rules SI-14 (agents) and SI-15 (prepare, admit, execute, verify, retain). - Your effective authority is everything your tools can reach (SEC-DSM DSM-AGENT-008). Live changes, private keys and production credentials belong to the person: prepare and test on synthetic fixtures, and give them the exact command to run.
- Leave a trail: commits get assistant trailers from the hook; log State Hub progress with your agent name and session.