net-kingdom/workplans/NK-WP-0030-deterministic-security-scenario-composition.md

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	created	updated
NK-WP-0030	workplan	Implement deterministic security scenario composition	infotech	net-kingdom	blocked	codex	netkingdom	P1	2026-08-23	2026-08-23

NK-WP-0030 — Deterministic security scenario composition

Authorized by the operator as the first implementation increment following the 2026-08-23 scope-to-intent gap assessment. This work closes the locally owned part of G1 without moving playbook execution into NetKingdom.

Define the scenario composition contract

id: NK-WP-0030-T01
status: done
priority: high

Published proposed security-scenario-composition_v0.1 canon and its scenario schema. It requires exact provider pins under ambiguity, explicit initial trust, fail-closed sequencing, owner attribution, readiness obligations, and an unconditional non-execution boundary.

Implement the canonical composer

id: NK-WP-0030-T02
status: done
priority: high

Implemented tools/security-scenario-composer/. It consumes Playbook Capability Contract v0.1 declarations, rejects invalid or ambiguous inputs, validates authority-bound parameter overrides, orders selected declarations by explicit trust transitions, and emits a deterministic owner-routed JSON plan with a content digest and execution.permitted: false. The older conformance-demo selector now also refuses ambiguity and overrides targeting unselected declarations.

Publish a C0 reference composition

id: NK-WP-0030-T03
status: done
priority: high

Published capabilities/playbooks/net-kingdom.local-identity.yaml and examples/security-scenarios/c0-local-identity.yaml. The non-secret reference selects the exact local provider, starts from explicit bare_host_trust, and plans the readiness obligations for bootstrap_identity_trust without executing the CLI entry point.

Obtain lightweight-provider declarations

id: NK-WP-0030-T04
status: wait
priority: high

Ask the KeyCape/Railiance owners to publish conformant C1 and selected C2 declarations beside their execution entry points. Do not fabricate provider authority in NetKingdom. The complete lightweight SSO scenario remains blocked until those declarations exist and pass the canonical composer. Routed to key-cape in State Hub message 64d247e4-9170-4d18-b7ed-d8b071282104.

Verify the fail-closed and reference paths

id: NK-WP-0030-T05
status: done
priority: medium

Added ten composer tests and five regression tests for the legacy declaration validator/demo selector, including secret-reference syntax enforcement. Exact selection, ambiguity refusal, bad pins, override boundaries, duplicate ids, dependency ordering, unresolved trust, responsibility/readiness mapping, and the checked-in C0 composition pass. The complete relevant repository suite passes 70 tests; the isolated local-identity suite passes 142 tests. JSON/YAML parsing, Python compilation, the reference CLI, and git diff --check also pass.