tegwick
074b3a047b
Derive custody at platform/workloads/keycape/{client_id} (secret_ref is no
longer case-settable), reuse the workload-kv-read-keycape-* policy family with
templated bodies, add the external-secrets-keycape-{client_id} ESO role, name
the catalog entry {consuming_service}-keycape-client and collapse the duplicate
KV-path rollback. Schema and validator require a body on policy/role items.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 330051@bnt-lap001
Assistant-Session: b98d4912-95a3-4619-b7fb-57aa1db7407b
|
||
|---|---|---|
| .. | ||
| tests | ||
| README.md | ||
| security_case_validator.py | ||
security-case-types tools
Validator and renderer for SecurityCaseTypes and SecurityCases
(canon/standards/security-case-types_v0.1.md, schemas
canon/schemas/security-case-type_v0.1.schema.json and
security-case_v0.1.schema.json).
# a type directory: type.yaml, README.md sections, tests, example cases
python3 tools/security-case-types/security_case_validator.py validate-type security-case-types/<type-id>
# a case against its type (security-case-types/<type-id>/type.yaml)
python3 tools/security-case-types/security_case_validator.py validate-case <case.yaml> --types security-case-types
# render a case into the composer's plan plus materialization, follow-through,
# verification and rollback; execution is never permitted
python3 tools/security-case-types/security_case_validator.py render <case.yaml> \
--types security-case-types capabilities/playbooks/*.yaml
Only implemented types accept cases. --allow-unimplemented exists for a type's
own example cases while the type is being written and acknowledged.
The validator refuses, among other things: missing sections, unknown or unpinned capabilities, attended steps without justification, steps or materialized items without a rollback, verification without a negative check or that reads a value, templates with unknown parameters, credential-shaped values anywhere, secret parameters that are not custody references, and high-risk types without founder acceptance.
To start a type: copy security-case-types/_template/, rename the directory to
the type id, and rewrite every section. The template's tests travel with it:
rename tests/test_type.py to tests/test_<type_id>_contract.py so module names stay unique.
Tests: python3 -m pytest tools/security-case-types/tests security-case-types/*/tests.