coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ops-mason/registry/capabilities/capability.security.structure-construction.md
tegwick 100558696f Record bernd.worsch-3 and the group-ensure route. 
The hub-writer group exists and its member has no second factor yet. Service-access groups are created by identity-provisioner POST /v1/groups/ensure; that pointer is now on the ops-mason reuse-surface capability.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
2026-10-14 19:05:33 +02:00

4.7 KiB
Raw Blame History

id owner status domain maturity external_evidence name summary tags discovery availability relations evidence consumer_guidance
capability.security.structure-construction ops-mason draft infotech
discovery availability
current target confidence rationale
D3 D5 medium Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim.
current target confidence rationale
A2 A2 medium Source interface assessed 2026-10-14: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply. Availability describes the delivery form, not production acceptance. Founder plan gate is an explicit exception; not full PDP conformance.
completeness reliability
level confidence basis
C1 low Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review.
level confidence basis
R0 low No longitudinal consumer reliability measurement established by this review.
Reviewed security structure construction Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.
security
netkingdom
framework-reuse
intent includes excludes use_cases
Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply
Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply
Founder plan gate is an explicit exception; not full PDP conformance
Creating LLDAP groups or enrolling MFA. Service-access groups are identity-provisioner POST /v1/groups/ensure. Second-factor enrollment is user-engine / privacyIDEA.
U01: Architect composes a security deployment from explicit owner contracts and case types
U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
current_level target_level current_artifacts consumption_modes
A2 A2
SCOPE.md
docs/construction-plan-format.md
docs/directory-group-binding.md
CLI
source
related_to
capability.security.credential-lifecycle
capability.security.iam-tooling-suite
capability.railiance.platform-services
capability.identity.user-engine
documentation
SCOPE.md
docs/construction-plan-format.md
docs/directory-group-binding.md
recommended_for not_recommended_for known_limitations
Architect composes a security deployment from explicit owner contracts and case types
Operator provisions and delivers a scoped workload credential through the approved owner lane
Operator or automation obtains a bounded SSH certificate and maintains private connectivity
Founder plan gate is an explicit exception; not full PDP conformance
Founder plan gate is an explicit exception; not full PDP conformance
Directory groups are not created here. See docs/directory-group-binding.md.
2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.

Reviewed security structure construction

Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.

Reuse boundary

Founder plan gate is an explicit exception; not full PDP conformance.

Supported use cases

  • U01: Architect composes a security deployment from explicit owner contracts and case types
  • U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
  • U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity

Evidence and integration

Service-access groups

ops-mason names the group in the plan. net-kingdom identity-provisioner creates it with POST /v1/groups/ensure inside the provisioner pod. user-engine does not write LLDAP groups; it is the account and MFA journey, including TOTP enrollment at https://pink-account.coulomb.social/. The call does not enroll a factor and does not attach OpenBao policies. Reserved prefixes tenant, netkingdom-, net-kingdom- and lldap_ are refused. Details: docs/directory-group-binding.md.

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.