From 2246656f43fa5eae3ae917f63ea1dfa3f53f4a00 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 14 Oct 2026 06:40:50 +0200 Subject: [PATCH] docs(reuse): establish reviewed NetKingdom security capabilities Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684 --- .../capability.ops.tunnel-bridge.md | 91 ++++++++----------- registry/indexes/capabilities.yaml | 17 ++-- 2 files changed, 50 insertions(+), 58 deletions(-) diff --git a/registry/capabilities/capability.ops.tunnel-bridge.md b/registry/capabilities/capability.ops.tunnel-bridge.md index 19f0a29..b4457be 100644 --- a/registry/capabilities/capability.ops.tunnel-bridge.md +++ b/registry/capabilities/capability.ops.tunnel-bridge.md @@ -1,8 +1,7 @@ --- id: capability.ops.tunnel-bridge -name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge) -summary: CLI that manages named SSH reverse tunnels keeping remote execution environments connected to - the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events. +name: SSH tunnel lifecycle +summary: Named tunnels, reconnect, health and TTL-aware cert_command. owner: ops-bridge status: draft domain: infotech @@ -11,20 +10,24 @@ tags: - tunnel - ops - connectivity +- security +- netkingdom +- framework-reuse maturity: discovery: current: D3 target: D5 confidence: medium - rationale: README.txt documents named tunnels, auto-reconnect with exponential backoff, HTTP health - checks, and structured JSON audit events per tunnel; this is also the tool underlying reuse-surface's - own `/bridge` skill. + rationale: README.txt documents named tunnels, auto-reconnect with exponential + backoff, HTTP health checks, and structured JSON audit events per tunnel; this + is also the tool underlying reuse-surface's own `/bridge` skill. availability: current: A2 target: A3 confidence: medium - rationale: Ships a `bridge` CLI, installable via pyproject; already actively used to keep remote Claude - Code sessions (COULOMBCORE, Railiance nodes) connected to the State Hub MCP. + rationale: 'Source interface assessed 2026-10-14: Named tunnels, reconnect, health + and TTL-aware cert_command. Availability describes the delivery form, not production + acceptance. Private transport does not authenticate applications or decide access.' external_evidence: completeness: level: C2 @@ -41,36 +44,36 @@ external_evidence: confidence: low basis: consumer_quality_signals known_reliability_risks: - - operational tool with real production usage but no independent load/failure testing recorded in - this sweep + - operational tool with real production usage but no independent load/failure + testing recorded in this sweep discovery: - intent: Keep remote execution environments' MCP connectivity to the local State Hub alive and observable - via managed, auto-reconnecting SSH reverse tunnels. + intent: Named tunnels, reconnect, health and TTL-aware cert_command includes: - - named SSH reverse tunnel lifecycle management - - auto-reconnect with exponential backoff - - HTTP health checks - - structured audit event logging + - Named tunnels, reconnect, health and TTL-aware cert_command excludes: - - the State Hub or MCP servers themselves (bridge only manages connectivity) + - Private transport does not authenticate applications or decide access assumptions: [] - use_cases: [] + use_cases: + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' research_memos: [] availability: current_level: A2 target_level: A3 current_artifacts: - - '`bridge` CLI' + - SCOPE.md target_artifacts: [] consumption_modes: - - cli + - CLI + - source relations: depends_on: [] supports: [] - related_to: [] + related_to: + - capability.security.iam-tooling-suite evidence: documentation: - - README.txt + - SCOPE.md tests: - tests/ consumer_feedback: [] @@ -78,45 +81,31 @@ evidence: incidents: [] consumer_guidance: recommended_for: - - any workstation/remote-machine pair needing durable SSH-tunneled MCP or service connectivity + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity not_recommended_for: - - needs for tunnel types other than SSH reverse port-forwards + - Private transport does not authenticate applications or decide access known_limitations: - - no independent load/failure testing recorded beyond production usage observations + - Private transport does not authenticate applications or decide access + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. promotion_history: [] --- -# SSH Reverse Tunnel Lifecycle Manager (ops-bridge) +# SSH tunnel lifecycle -## Overview +Named tunnels, reconnect, health and TTL-aware cert_command. -`ops-bridge` is an SSH reverse tunnel lifecycle manager: a `bridge` CLI that keeps remote execution environments (COULOMBCORE, Railiance nodes) connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit logging per tunnel. +## Reuse boundary -## Assessment notes +Private transport does not authenticate applications or decide access. -### Discovery +## Supported use cases -README.txt documents named tunnels, auto-reconnect with exponential backoff, HTTP health checks, and structured JSON audit events per tunnel; this is also the tool underlying reuse-surface's own `/bridge` skill. +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity -### Availability +## Evidence and integration -Ships a `bridge` CLI, installable via pyproject; already actively used to keep remote Claude Code sessions (COULOMBCORE, Railiance nodes) connected to the State Hub MCP. +- [SCOPE.md](../../SCOPE.md) -### Completeness - -First-pass honest assessment from the REUSE-WP-0017 coverage campaign -(reuse-surface). No external consumer feedback exists yet; levels reflect -scope-vs-intent documentation quality, not internal code quality. - -### Reliability - -No production consumer telemetry exists yet; reliability level is -intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. - -## Promotion checklist - -- [x] ID follows `capability..` pattern -- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` -- [x] `external_evidence` is populated separately from `maturity` -- [ ] Relations reference valid capability IDs (none yet) -- [x] Index entry added in `registry/indexes/capabilities.yaml` +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index a67521a..b15d1ac 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,20 +1,23 @@ version: 1 -updated: '2026-07-06' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.ops.tunnel-bridge - name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge) - summary: CLI that manages named SSH reverse tunnels keeping remote execution environments connected - to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events. - vector: D3 / A2 / C2 / R1 + name: SSH tunnel lifecycle + summary: Named tunnels, reconnect, health and TTL-aware cert_command. domain: infotech status: draft owner: ops-bridge - path: registry/capabilities/capability.ops.tunnel-bridge.md tags: - ssh - tunnel - ops - connectivity + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.ops.tunnel-bridge.md consumption_modes: - - cli + - CLI + - source