dc8da422f8
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
99 lines
3.3 KiB
Markdown
99 lines
3.3 KiB
Markdown
---
|
|
id: NK-WP-0030
|
|
type: workplan
|
|
title: "Implement deterministic security scenario composition"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
planning_priority: P1
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
state_hub_workstream_id: "8a884593-b7f9-508a-9e15-bfd901463ac1"
|
|
---
|
|
|
|
# NK-WP-0030 — Deterministic security scenario composition
|
|
|
|
Authorized by the operator as the first implementation increment following the
|
|
2026-08-23 scope-to-intent gap assessment. This work closes the locally owned
|
|
part of G1 without moving playbook execution into NetKingdom.
|
|
|
|
## Define the scenario composition contract
|
|
|
|
```task
|
|
id: NK-WP-0030-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c071698f-6a5a-5845-9f22-042d100f3958"
|
|
```
|
|
|
|
Published proposed `security-scenario-composition_v0.1` canon and its scenario
|
|
schema. It requires exact provider pins under ambiguity, explicit initial trust,
|
|
fail-closed sequencing, owner attribution, readiness obligations, and an
|
|
unconditional non-execution boundary.
|
|
|
|
## Implement the canonical composer
|
|
|
|
```task
|
|
id: NK-WP-0030-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "0372da5c-83ee-5e03-bb45-5cae81e5330b"
|
|
```
|
|
|
|
Implemented `tools/security-scenario-composer/`. It consumes Playbook Capability
|
|
Contract v0.1 declarations, rejects invalid or ambiguous inputs, validates
|
|
authority-bound parameter overrides, orders selected declarations by explicit
|
|
trust transitions, and emits a deterministic owner-routed JSON plan with a
|
|
content digest and `execution.permitted: false`. The older conformance-demo
|
|
selector now also refuses ambiguity and overrides targeting unselected
|
|
declarations.
|
|
|
|
## Publish a C0 reference composition
|
|
|
|
```task
|
|
id: NK-WP-0030-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "99392b0f-c0a4-5abd-afdb-ef15c964ae1f"
|
|
```
|
|
|
|
Published `capabilities/playbooks/net-kingdom.local-identity.yaml` and
|
|
`examples/security-scenarios/c0-local-identity.yaml`. The non-secret reference
|
|
selects the exact local provider, starts from explicit `bare_host_trust`, and
|
|
plans the readiness obligations for `bootstrap_identity_trust` without
|
|
executing the CLI entry point.
|
|
|
|
## Obtain lightweight-provider declarations
|
|
|
|
```task
|
|
id: NK-WP-0030-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "41fd145d-7a37-5c65-ae72-142ac6d49144"
|
|
```
|
|
|
|
Ask the KeyCape/Railiance owners to publish conformant C1 and selected C2
|
|
declarations beside their execution entry points. Do not fabricate provider
|
|
authority in NetKingdom. The complete lightweight SSO scenario remains blocked
|
|
until those declarations exist and pass the canonical composer. Routed to
|
|
`key-cape` in State Hub message `64d247e4-9170-4d18-b7ed-d8b071282104`.
|
|
|
|
## Verify the fail-closed and reference paths
|
|
|
|
```task
|
|
id: NK-WP-0030-T05
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "7db26092-35c4-52c6-9a3e-3f24bc3e26c7"
|
|
```
|
|
|
|
Added ten composer tests and five regression tests for the legacy declaration
|
|
validator/demo selector, including secret-reference syntax enforcement.
|
|
Exact selection, ambiguity refusal, bad pins, override boundaries, duplicate
|
|
ids, dependency ordering, unresolved trust, responsibility/readiness mapping,
|
|
and the checked-in C0 composition pass. The complete relevant repository suite
|
|
passes 70 tests; the isolated local-identity suite passes 142 tests. JSON/YAML
|
|
parsing, Python compilation, the reference CLI, and `git diff --check` also
|
|
pass.
|