tegwick
33ebda59d4
Canon section 3 defines warden_executes narrowly and adds per-step lane, value_handling and ready_check; catalog entries need a templated body. The type gets lanes, generated-in-custody minting, a Ready gate before bind-env, memberships only from the accepted case, mfa-pinned and secret-delivered checks, and the R4-prime catalog body. 110 tests pass. Memo r3 supersedes r2 and validates on both sides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012 |
||
|---|---|---|
| .. | ||
| examples | ||
| tests | ||
| README.md | ||
| type.yaml | ||
SecurityCaseType template
Copy _template/ to security-case-types/<type-id>/ and rewrite every
section. Canon: canon/standards/security-case-types_v0.1.md. A type is
acknowledged through informed-decision only when this README, type.yaml, the
example cases and the tests are complete and green.
Purpose
Which recurring use case the type serves, and the hand-built instances it
replaces or adopts (reference instances). For the template: a loopback bootstrap
identity for one operator, composed from net-kingdom.local-identity.
Threat model
What the type protects, from whom, and how. Name the assets (credentials, sessions, signing keys), the actors (anonymous, low-assurance operator, tenant, compromised workload) and what each step does to prevent misuse. For the template: the store is loopback-only and private to its owner; the signing key is referenced from custody, never written into a case.
Alternatives considered
The other shapes this pattern could have taken and why they were not chosen. This is the part an informed-decision is mostly about.
Attended steps
Every step marked attended: true, why it cannot run unattended, and how
ops-warden groups such steps into as few attended sessions as possible.
Known limits
What the type does not cover, and when a request should become a new type or a new major version instead of a case.
Verification and rollback
How the checks in type.yaml prove a case is live without reading any value,
and how rollback restores the state from before the case.