net-kingdom/STATUS.md

# NetKingdom Ecosystem Status

> Living status for the NetKingdom identity and security platform and its
> sister repositories. Updated from repo workplans, State Hub, and the
> [reuse.coulomb.social](https://reuse.coulomb.social) federated capability
> registry.
>
> **Last updated:** 2026-07-08

---

## At a Glance

| Area | Status |
|------|--------|
| **NetKingdom core** | Delivered — IAM Profile v0.2, bootstrap/custody arc, security console, boundary contracts |
| **Lightweight identity** | Stable — key-cape v0.1 complete; Authelia + LLDAP + privacyIDEA stack live |
| **Authorization** | Baseline complete — flex-auth PDP shipped; production `policy.enabled` still off pending ecosystem flip |
| **Operational access** | Production-verified — ops-warden SSH cert lane live on Railiance OpenBao |
| **User domain** | Planning arc complete — user-engine WP-0001–0019 finished; live stack wiring not yet evidenced |
| **Deployment substrate** | S2 stable (single-node k3s), S3 emerging (OpenBao + CNPG live), S5 first app operational |
| **Capability discovery** | Federation live — 61 capabilities across 62 workstation repos via reuse-surface |
| **Active NetKingdom backlog** | NK-WP-0009 (security tutorials), NK-WP-0011 (enterprise SAML federation) |

**Bottom line:** The security spine is bootstrappable, standards are canonical,
and the lightweight identity + SSH access lanes are production-proven. The next
meaningful expansions are enterprise federation (expanded-mode Keycloak),
operator tutorials, flex-auth live enforcement, and user-engine production
integration.

---

## NetKingdom (this repo)

**Role:** Platform domain for identity and security — owns normative contracts,
bootstrap tooling, and meta-orchestration responsibility over the security
landscape. See `SCOPE.md`, `INTENT.md`, and `docs/responsibility-map.md`.

### Maturity (reuse federation)

| Capability | ID | Vector | Status |
|------------|-----|--------|--------|
| NetKingdom Security/IAM Tooling Suite | `capability.security.iam-tooling-suite` | D3 / A2 / C1 / R1 | draft |

Source: [reuse.coulomb.social/v1/federated](https://reuse.coulomb.social/v1/federated) — net-kingdom index at `registry/indexes/capabilities.yaml`.

### Delivered workplans

| ID | Title | Notes |
|----|-------|-------|
| NK-WP-0001 | SSO & MFA Platform (Keycloak + privacyIDEA) | Archived — expanded-mode baseline |
| NK-WP-0002 | Local Identity (bootstrap OIDC) | Finished |
| NK-WP-0003 | KeyCape + privacyIDEA cluster deployment | Completed |
| NK-WP-0004 | Credential Management Foundation | Done |
| NK-WP-0005 | Agent-Driven Credential Bootstrap | Done |
| NK-WP-0006 | Recursive platform identity architecture | Finished |
| NK-WP-0007 | Object Storage STS credential vending | Finished |
| NK-WP-0008 | IT Security Architecture Patterns (infospace) | Done |
| NK-WP-0010 | Genesis Security Pattern Completion | Finished |
| NK-WP-0012 | NetKingdom IAM Profile Specification | Finished — `canon/standards/iam-profile_v0.2.md` |
| NK-WP-0013 | Playbook Capability Contract | Finished — `canon/standards/playbook-capability-contract_v0.1.md` |
| NK-WP-0014 | User Engine boundary contracts | Finished — `canon/standards/user-engine-boundary-contract_v0.1.md` |
| NET-WP-0015 | King Credential & OpenBao identity bootstrap | Finished |
| NET-WP-0016 | Guided Security Bootstrap Experience | Finished |
| NET-WP-0017 | IT Security Readiness for User Onboarding | Finished |
| NET-WP-0018 | Bootstrap Automation & Rebuild Readiness | Finished |
| NET-WP-0019 | User lifecycle dry-run polish | Finished |
| NET-WP-0020 | OpenBao unseal custody models & SSH automation | Finished — greenfield init/unseal proof 2026-07-02 |

User-engine implementation workplans NK-WP-0015–0019 (isolated MVP through
conformance) are archived here but executed in `user-engine`.

### Backlog

| ID | Title | Status | Depends on |
|----|-------|--------|------------|
| NK-WP-0009 | NetKingdom Security Pattern Tutorials | backlog | NK-WP-0008 (done) |
| NK-WP-0011 | Enterprise Federation & SAML (expanded-mode Keycloak) | backlog | NK-WP-0003, 0004, 0006 |

### Runnable artifacts

| Artifact | Path | Purpose |
|----------|------|---------|
| IAM Profile conformance checker | `tools/iam-profile-conformance/` | Verify OIDC/PKCE claim shapes against v0.2 |
| Playbook capability contract validator | `tools/playbook-capability-contract/` | Validate scenario playbooks against v0.1 contract |
| Security bootstrap console | `tools/security-bootstrap-console/` | Custody gates, roster, evidence validators (non-secret) |
| Bootstrap agent | `sso-mfa/bootstrap/creds-bootstrap-agent.sh` | Unattended credential + OpenBao init/unseal (Phase 7b) |
| OpenBao init/unseal script | `sso-mfa/bootstrap/openbao-init-unseal.sh` | Greenfield-proven custody-gated init/unseal |

### Key standards (canonical)

- `canon/standards/iam-profile_v0.2.md` — OIDC/PKCE contract all apps target
- `canon/standards/playbook-capability-contract_v0.1.md` — meta-orchestration interface
- `canon/standards/user-engine-boundary-contract_v0.1.md` — user-domain integration
- `canon/standards/credential-management_v0.2.md` — credential lifecycle model
- `docs/platform-identity-security-architecture.md` — capability ladder C0–C6

---

## Capability Ladder Position

NetKingdom's architecture progresses by capability tier, not user count
(`docs/platform-identity-security-architecture.md`):

```text
C0 Bootstrap local identity     ✅ NK-WP-0002
C1 Lightweight SSO (KeyCape)    ✅ NK-WP-0003, key-cape v0.1
C2 MFA / 2FA                    ✅ privacyIDEA in KeyCape stack
C3 Runtime secrets (OpenBao)    ✅ NET-WP-0015–0020, railiance-platform
C4 Fine-grained authorization   🟡 flex-auth baseline done; live enforcement pending
C5 User-domain service          🟡 user-engine WP arc done; production wiring pending
C6 Enterprise federation (SAML) ⏸ NK-WP-0011 backlog
```

---

## Sister Repositories

### Identity & security runtime

#### key-cape

| | |
|---|---|
| **Purpose** | Lightweight IAM implementation of the NetKingdom IAM Profile (Authelia + LLDAP + privacyIDEA). |
| **Maturity** | `capability.iam.key-cape` — **D4 / A2 / C2 / R1** (draft) |
| **Workplans** | KEY-WP-0001–0003 all finished |
| **NetKingdom relation** | Primary lightweight implementer of `iam-profile_v0.2.md`; applications integrate against the profile, not KeyCape internals. |
| **Status** | Stable v0.1 — container image, acceptance suite, bootstrap console OIDC/MFA verification client shipped. |

#### flex-auth

| | |
|---|---|
| **Purpose** | Policy-as-code authorization registry and PDP — turns verified IAM claims into allow/deny decisions. |
| **Maturity** | `capability.authorization.policy-evaluate` — **D4 / A2 / C2 / R1** (draft) |
| **Workplans** | FLEX-WP-0001–0007 all finished |
| **NetKingdom relation** | Consumes NetKingdom IAM Profile claims; sits between identity and protected systems. First consumer: ops-warden SSH signing gate. |
| **Status** | Go service with `POST /v1/check` live; production deployment smoke verified 2026-06-29. **`policy.enabled` deliberately off** — gate verified but not live-enforced. |

#### user-engine

| | |
|---|---|
| **Purpose** | Headless user-domain service — accounts, memberships, profiles, projections; not an IdP or PDP. |
| **Maturity** | `capability.identity.user-engine` — **D4 / A1 / C2 / R0** (draft) |
| **Workplans** | USER-WP-0001–0019 all finished (Jun 2026) |
| **NetKingdom relation** | Governed by `user-engine-boundary-contract_v0.1.md` (NK-WP-0014). Consumes IAM claims; defers authZ to flex-auth. |
| **Status** | Full planning arc through Postgres durable store + conformance; **production integration with live key-cape/flex-auth not yet evidenced**. |

#### ops-warden

| | |
|---|---|
| **Purpose** | Operational access steward — short-lived SSH certs for `adm`/`agt`/`atm`; routes all other credential needs via `warden route`. |
| **Maturity** | `capability.security.ssh-certificate-issuance` — **D4 / A3 / C3 / R2** (draft) |
| **Workplans** | Through WARDEN-WP-0024 finished (Jul 2026) |
| **NetKingdom relation** | Operational face of the NetKingdom security model; maintains routing catalog aligned to NK canon. NetKingdom depends on it for the SSH lane but does not orchestrate its resources. |
| **Status** | Mission-complete for SSH lane. Production signing verified on `https://bao.coulomb.social`. `warden access` front door, audit trail, experiential memory shipped. |

#### ops-bridge

| | |
|---|---|
| **Purpose** | SSH reverse tunnel lifecycle manager — keeps remote agents connected to local State Hub. |
| **Maturity** | `capability.ops.tunnel-bridge` — **D3 / A2 / C2 / R1** (draft) |
| **Workplans** | BRIDGE-WP-0001–0005, OPS-WP-0001–0002 all finished |
| **NetKingdom relation** | Tunnel transport layer; consumes ops-warden certs via `cert_command`. |
| **Status** | v0.1 core complete (~80%). **`cert_command` live cutover on `agt-state-hub-bridge` pilot pending** — readiness gate shipped by ops-warden (WP-0016). |

### Standards & canon

#### info-tech-canon

| | |
|---|---|
| **Purpose** | Markdown-first InfoTechCanon — evolving standards corpus (kernel, 11 domain models, CARING access-governance). |
| **Maturity** | `capability.infotech.canon-service` — **D2 / A2 / C1 / R0** (draft) |
| **Workplans** | ITC-WP-0001–0012 all finished |
| **NetKingdom relation** | Upstream semantic foundation for security posture canon (ops-warden WP-0015 landing), platform architecture patterns, user-engine evaluation pack. |
| **Status** | Seed kernel complete; **next target: Kernel RC1**. |

#### identity-canon

| | |
|---|---|
| **Purpose** | Implementation-neutral vocabulary for identity concepts across IAM, directory, federation, authorization. |
| **Workplans** | IDENTITY-WP-0001–0003 all finished |
| **NetKingdom relation** | Feeds terminology discipline for user-engine and broader IAM vocabulary. Complements net-kingdom normative contracts. |
| **Status** | Active research scaffold; next pass: source-note backfill and model revision. |

### Deployment substrate (Railiance OAS)

#### railiance-cluster (S2)

| | |
|---|---|
| **Purpose** | Cluster runtime — k3s, Helm, ingress, cert-manager, operators on COULOMBCORE. |
| **Maturity** | `capability.railiance.cluster-bootstrap` — **D3 / A2 / C1 / R0** (draft) |
| **Workplans** | RAIL-BS-WP-0002–0006, RAILIANCE-WP-0012–0014 finished; RAIL-BS-WP-0008/0009 finished Jul 2026 |
| **NetKingdom relation** | Runtime substrate for SSO/MFA namespaces, CNPG operator, all security services. |
| **Status** | Single-node production stable. **Backlog:** RAIL-BS-WP-0007 ThreePhoenix HA cluster. |

#### railiance-platform (S3)

| | |
|---|---|
| **Purpose** | Platform services — PostgreSQL (CNPG), Valkey, OpenBao, object storage, identity integration point. |
| **Maturity** | `capability.railiance.platform-services` — **D3 / A2 / C1 / R0** (draft) |
| **Workplans** | RAILIANCE-WP-0005–0011 all finished |
| **NetKingdom relation** | Hosts OpenBao (runtime secret authority), credential broker, identity services integration surface. |
| **Status** | CNPG operator deployed; OpenBao platform secrets service live; `warden-sign` broker routing live 2026-07-01. |

#### railiance-apps (S5)

| | |
|---|---|
| **Purpose** | Workloads & experience endpoints — application Helm releases, deployment guardrails. |
| **Workplans** | RAIL-AP-WP-0001 through RAILIANCE-WP-0011 all finished |
| **NetKingdom relation** | Consumes platform identity integrations at S5 deployment layer. |
| **Status** | First app (`vergabe-teilnahme`) operational; Gitea/registry extracted to `railiance-forge`. No active workplans. |

### Reuse & discovery

#### reuse-surface

| | |
|---|---|
| **Purpose** | Federated capability registry — discover, compare, validate, promote capabilities by D/A/C/R maturity vector. |
| **Maturity** | `capability.registry.register` D3/A4/C2/R3; `capability.registry.validate` D4/A3/C3/R3 |
| **Workplans** | REUSE-WP-0017–0019 finished (Jul 2026) |
| **NetKingdom relation** | Discovery layer for the ecosystem; net-kingdom registers `capability.security.iam-tooling-suite`. |
| **Status** | **62/62 workstation repos established**; production hub at `https://reuse.coulomb.social` (61 federated capabilities as of 2026-07-08). |

#### open-reuse

| | |
|---|---|
| **Purpose** | Managed continuity for valuable OSS integrations — structured update loops for proven integrations. |
| **Workplans** | OPEN-WP-0001–0004 all finished |
| **NetKingdom relation** | Adjacent reuse layer; complements reuse-surface's capability maturity registry. |
| **Status** | Foundation complete; CLI validator (`open-reuse validate`) shipped. |

---

## Integration Flow

```text
Bootstrap plane (net-kingdom)
  local-identity / creds-bootstrap-agent / security-bootstrap-console
        │
        ▼
Platform control plane
  key-cape (lightweight) ──or── Keycloak (expanded, NK-WP-0011 backlog)
        │ verified IAM Profile claims
        ▼
  flex-auth (authorization PDP)
        │ allow/deny decisions
        ▼
  protected systems (ops-warden SSH, Markitect, apps, …)

Parallel lanes:
  user-engine ← IAM claims (boundary contract NK-WP-0014)
  OpenBao ← runtime secrets (railiance-platform, NET-WP-0020 custody models)
  ops-warden ← SSH certs + credential routing front door
  ops-bridge ← reverse tunnels (cert_command consumer)
```

Credential routing canon: agents call `warden route find` before requesting
secrets — ops-warden issues SSH certs only; all other credentials route to
owning subsystems (OpenBao, key-cape, flex-auth). See
`~/ops-warden/wiki/CredentialRouting.md`.

---

## Cross-Ecosystem Gaps

| Gap | Primary owners | Impact |
|-----|----------------|--------|
| flex-auth `policy.enabled` off in production | flex-auth, ops-warden | SSH signing gate verified but not live-enforced |
| ops-bridge `cert_command` live cutover | ops-bridge | Short-lived cert tunnels not yet production-default |
| NK-WP-0009 security pattern tutorials | net-kingdom | Operator/agent onboarding material missing |
| NK-WP-0011 SAML / enterprise federation | net-kingdom | Expanded-mode Keycloak identity broker not started |
| Workload Security Posture canon landing | net-kingdom, info-tech-canon | ops-warden drafted M0–M3 model; owner-driven landing pending |
| user-engine production integration | user-engine, key-cape, flex-auth | WP arc complete; live stack wiring not evidenced |
| railiance-cluster ThreePhoenix HA | railiance-cluster | Single-node stable; multi-node HA in backlog |
| info-tech-canon Kernel RC1 | info-tech-canon | Seed kernel complete; schema consolidation remaining |
| Unified tool packaging | net-kingdom | Three conformance tools lack single install path (reuse notes) |

---

## Recent Milestones

| Date | Event |
|------|-------|
| 2026-07-08 | NK-WP-0009 and NK-WP-0011 moved to backlog; reuse federation index refreshed (61 capabilities) |
| 2026-07-08 | reuse-surface REUSE-WP-0019 — Forgejo webhook automation + reuse telemetry |
| 2026-07-02 | NET-WP-0020 — OpenBao greenfield init/unseal proof; `bao write sys/unseal key=-` fix |
| 2026-07-01 | ops-warden `warden-sign` broker routing live on railiance-platform |
| 2026-06-29 | flex-auth FLEX-WP-0007 — production policy-gate smoke verified |
| 2026-06-18 | ops-warden production SSH signing verified on Railiance OpenBao |
| 2026-06 | user-engine USER-WP-0016–0019 — Postgres store + conformance; key-cape KEY-WP-0003 bootstrap console client |
| 2026-05 | NK-WP-0012 IAM Profile v0.2 canonical; NK-WP-0014 user-engine boundary contract |

---

## State Hub

- **API:** `http://127.0.0.1:8000` (local) / `http://127.0.0.1:18000` (tunnel)
- **Topic:** infotech (`cee7bedf-2b48-46ef-8601-006474f2ad7a`)
- **NetKingdom workplans in hub:** NK-WP-0009 and NK-WP-0011 registered as `backlog`; finished plans indexed under `net-kingdom-*` slugs

Sync after workplan changes:

```bash
statehub fix-consistency --repo net-kingdom
```

---

## How to Refresh This Document

1. Scan `workplans/` and `workplans/archived/` for status changes.
2. Query State Hub: `curl -s "http://127.0.0.1:8000/workplans/?repo=net-kingdom"`.
3. Pull reuse federation: `curl -s "https://reuse.coulomb.social/v1/federated"`.
4. Check sister-repo `SCOPE.md` and `registry/indexes/capabilities.yaml`.
5. Update the **Last updated** date and relevant tables.

Related orientation files: `SCOPE.md` (scope boundary), `.custodian-brief.md`
(auto-generated), `docs/responsibility-map.md` (orchestration relationships).