coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/tools/security-case-types/README.md
tegwick fa2cb57384
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
NK-WP-0048-T04: SecurityCaseType oidc-browser-relying-party 1.0 (proposed) 
Composes key-cape.oidc-client-registration; confidential/public conditions,
one justified attended step, threat model, fit table of hand-built clients,
Forgejo and public-portal examples. Validator gains when/required_when and
provider discovery. 43 tests pass. Adds T08 (identity-provisioner groups ensure).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
2026-10-08 22:45:31 +02:00

1.8 KiB
Raw Blame History

security-case-types tools

Validator and renderer for SecurityCaseTypes and SecurityCases (canon/standards/security-case-types_v0.1.md, schemas canon/schemas/security-case-type_v0.1.schema.json and security-case_v0.1.schema.json).

# a type directory: type.yaml, README.md sections, tests, example cases
python3 tools/security-case-types/security_case_validator.py validate-type security-case-types/<type-id>

# a case against its type (security-case-types/<type-id>/type.yaml)
python3 tools/security-case-types/security_case_validator.py validate-case <case.yaml> --types security-case-types

# render a case into the composer's plan plus materialization, follow-through,
# verification and rollback; execution is never permitted
python3 tools/security-case-types/security_case_validator.py render <case.yaml> \
  --types security-case-types capabilities/playbooks/*.yaml

Only implemented types accept cases. --allow-unimplemented exists for a type's own example cases while the type is being written and acknowledged.

The validator refuses, among other things: missing sections, unknown or unpinned capabilities, attended steps without justification, steps or materialized items without a rollback, verification without a negative check or that reads a value, templates with unknown parameters, credential-shaped values anywhere, secret parameters that are not custody references, and high-risk types without founder acceptance.

To start a type: copy security-case-types/_template/, rename the directory to the type id, and rewrite every section. The template's tests travel with it: rename tests/test_type.py to tests/test_<type_id>_contract.py so module names stay unique.

Tests: python3 -m pytest tools/security-case-types/tests security-case-types/*/tests.