docs(reuse): establish reviewed NetKingdom security capabilities
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
parent
6d2f1be969
commit
11b2a9d7bc
4 changed files with 331 additions and 91 deletions
104
registry/capabilities/capability.security.access-routing.md
Normal file
104
registry/capabilities/capability.security.access-routing.md
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
---
|
||||
id: capability.security.access-routing
|
||||
owner: ops-warden
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A3
|
||||
target: A3
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: warden route and access catalog;
|
||||
exact lane conduit and secret-exec routing. Availability describes the delivery
|
||||
form, not production acceptance. Routing grants no authority; interim delegates
|
||||
and attended high-risk lanes persist.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Credential routing and contained access
|
||||
summary: warden route and access catalog; exact lane conduit and secret-exec routing.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: warden route and access catalog; exact lane conduit and secret-exec routing
|
||||
includes:
|
||||
- warden route and access catalog; exact lane conduit and secret-exec routing
|
||||
excludes:
|
||||
- Routing grants no authority; interim delegates and attended high-risk lanes persist
|
||||
use_cases:
|
||||
- 'U04: Protected operation obtains and consumes exact human approval before its
|
||||
side effect'
|
||||
- 'U05: Operator provisions and delivers a scoped workload credential through the
|
||||
approved owner lane'
|
||||
- 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity'
|
||||
availability:
|
||||
current_level: A3
|
||||
target_level: A3
|
||||
current_artifacts:
|
||||
- SCOPE.md
|
||||
- wiki/CredentialRouting.md
|
||||
consumption_modes:
|
||||
- library
|
||||
- CLI
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.credential-lifecycle
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.ops.tunnel-bridge
|
||||
- capability.security.structure-construction
|
||||
evidence:
|
||||
documentation:
|
||||
- SCOPE.md
|
||||
- wiki/CredentialRouting.md
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Protected operation obtains and consumes exact human approval before its side
|
||||
effect
|
||||
- Operator provisions and delivers a scoped workload credential through the approved
|
||||
owner lane
|
||||
- Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity
|
||||
not_recommended_for:
|
||||
- Routing grants no authority; interim delegates and attended high-risk lanes persist
|
||||
known_limitations:
|
||||
- Routing grants no authority; interim delegates and attended high-risk lanes persist
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Credential routing and contained access
|
||||
|
||||
warden route and access catalog; exact lane conduit and secret-exec routing.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Routing grants no authority; interim delegates and attended high-risk lanes persist.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U04: Protected operation obtains and consumes exact human approval before its side effect
|
||||
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
|
||||
- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [SCOPE.md](../../SCOPE.md)
|
||||
- [wiki/CredentialRouting.md](../../wiki/CredentialRouting.md)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
104
registry/capabilities/capability.security.case-follow-through.md
Normal file
104
registry/capabilities/capability.security.case-follow-through.md
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
---
|
||||
id: capability.security.case-follow-through
|
||||
owner: ops-warden
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A2
|
||||
target: A2
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: KnownSecurityCase route, plan
|
||||
and operational receipts. Availability describes the delivery form, not production
|
||||
acceptance. Execution requires accepted structure and exact owner contracts;
|
||||
case closure is not automatic.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Security case operational follow-through
|
||||
summary: KnownSecurityCase route, plan and operational receipts.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: KnownSecurityCase route, plan and operational receipts
|
||||
includes:
|
||||
- KnownSecurityCase route, plan and operational receipts
|
||||
excludes:
|
||||
- Execution requires accepted structure and exact owner contracts; case closure
|
||||
is not automatic
|
||||
use_cases:
|
||||
- 'U01: Architect composes a security deployment from explicit owner contracts and
|
||||
case types'
|
||||
- 'U05: Operator provisions and delivers a scoped workload credential through the
|
||||
approved owner lane'
|
||||
- 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity'
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A2
|
||||
current_artifacts:
|
||||
- workplans/WARDEN-WP-0044-security-case-follow-through.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.credential-lifecycle
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.ops.tunnel-bridge
|
||||
- capability.security.structure-construction
|
||||
evidence:
|
||||
documentation:
|
||||
- workplans/WARDEN-WP-0044-security-case-follow-through.md
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Architect composes a security deployment from explicit owner contracts and case
|
||||
types
|
||||
- Operator provisions and delivers a scoped workload credential through the approved
|
||||
owner lane
|
||||
- Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity
|
||||
not_recommended_for:
|
||||
- Execution requires accepted structure and exact owner contracts; case closure
|
||||
is not automatic
|
||||
known_limitations:
|
||||
- Execution requires accepted structure and exact owner contracts; case closure
|
||||
is not automatic
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Security case operational follow-through
|
||||
|
||||
KnownSecurityCase route, plan and operational receipts.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Execution requires accepted structure and exact owner contracts; case closure is not automatic.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U01: Architect composes a security deployment from explicit owner contracts and case types
|
||||
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
|
||||
- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [workplans/WARDEN-WP-0044-security-case-follow-through.md](../../workplans/WARDEN-WP-0044-security-case-follow-through.md)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
@ -1,39 +1,38 @@
|
|||
---
|
||||
id: capability.security.ssh-certificate-issuance
|
||||
name: SSH Certificate Issuance
|
||||
summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward operational access routing across NetKingdom security lanes.
|
||||
name: Decision-bound SSH certificates
|
||||
summary: warden sign with local and OpenBao backends and adm/agt/atm actors.
|
||||
owner: ops-warden
|
||||
status: draft
|
||||
domain: helix_forge
|
||||
tags:
|
||||
- ssh
|
||||
- certificate
|
||||
- ca
|
||||
- ops-warden
|
||||
- openbao
|
||||
- security
|
||||
|
||||
- ssh
|
||||
- certificate
|
||||
- ca
|
||||
- ops-warden
|
||||
- openbao
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
maturity:
|
||||
discovery:
|
||||
current: D4
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: >
|
||||
SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command
|
||||
contract are documented; production OpenBao integration is documented but
|
||||
engine deployment lives in railiance-platform. A machine-readable routing
|
||||
catalog (registry/routing/catalog.yaml) and wiki/AccessRouting.md make the
|
||||
"issue SSH, route the rest" boundary discoverable.
|
||||
rationale: 'SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command
|
||||
contract are documented; production OpenBao integration is documented but engine
|
||||
deployment lives in railiance-platform. A machine-readable routing catalog (registry/routing/catalog.yaml)
|
||||
and wiki/AccessRouting.md make the "issue SSH, route the rest" boundary discoverable.
|
||||
|
||||
'
|
||||
availability:
|
||||
current: A3
|
||||
target: A5
|
||||
confidence: medium
|
||||
rationale: >
|
||||
Installable `warden` CLI and `ops-ssh-wrapper` entry points; ops-bridge and
|
||||
other callers integrate via cert_command without backend-specific branching.
|
||||
A `warden route` lookup over the pointer catalog (WARDEN-WP-0011) will move
|
||||
routing discovery from wiki prose to a structured surface for agents (A3 -> A4).
|
||||
|
||||
rationale: 'Source interface assessed 2026-10-14: warden sign with local and OpenBao
|
||||
backends and adm/agt/atm actors. Availability describes the delivery form, not
|
||||
production acceptance. Direct Tooling contact is a declared gap; certificate
|
||||
reachability is not target authorization.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C3
|
||||
|
|
@ -41,97 +40,99 @@ external_evidence:
|
|||
confidence: medium
|
||||
basis: scope_vs_intent_and_consumer_expectations
|
||||
satisfied_expectations:
|
||||
- local and OpenBao/Vault-compatible signing backends
|
||||
- TTL policy enforcement per actor type
|
||||
- principals inventory and cert-side scorecard
|
||||
- signatures audit log and stale-cert cleanup
|
||||
- cert_command stdout contract for ops-bridge
|
||||
- local and OpenBao/Vault-compatible signing backends
|
||||
- TTL policy enforcement per actor type
|
||||
- principals inventory and cert-side scorecard
|
||||
- signatures audit log and stale-cert cleanup
|
||||
- cert_command stdout contract for ops-bridge
|
||||
broken_expectations:
|
||||
- host-side principal deployment not owned here
|
||||
- OpenBao SSH engine mount not deployed from this repo
|
||||
- host-side principal deployment not owned here
|
||||
- OpenBao SSH engine mount not deployed from this repo
|
||||
out_of_scope_expectations:
|
||||
- long-lived API key custody
|
||||
- tunnel lifecycle management
|
||||
- Vault/OpenBao cluster operations
|
||||
- long-lived API key custody
|
||||
- tunnel lifecycle management
|
||||
- Vault/OpenBao cluster operations
|
||||
reliability:
|
||||
level: R2
|
||||
name: Tolerable
|
||||
confidence: medium
|
||||
basis: consumer_quality_signals
|
||||
known_reliability_risks:
|
||||
- production signing depends on OpenBao availability and token policy
|
||||
- local backend requires protected CA key handling by operators
|
||||
|
||||
- production signing depends on OpenBao availability and token policy
|
||||
- local backend requires protected CA key handling by operators
|
||||
discovery:
|
||||
intent: >
|
||||
Give the ops fleet short-lived SSH credentials for humans, agents, and
|
||||
automations without static keys, through a single cert_command surface that
|
||||
callers can rely on regardless of CA backend; route non-SSH credential needs
|
||||
to the correct NetKingdom subsystems (OpenBao, flex-auth, key-cape).
|
||||
intent: warden sign with local and OpenBao backends and adm/agt/atm actors
|
||||
includes:
|
||||
- certificate signing for adm, agt, and atm actors
|
||||
- actor principals inventory and TTL policy
|
||||
- cert_command interface (`warden sign`)
|
||||
- cert-side compliance scorecard and signatures log
|
||||
- ops-ssh-wrapper for automatic cert acquisition
|
||||
- NetKingdom credential routing and alignment documentation
|
||||
- machine-readable routing pointer catalog (registry/routing/catalog.yaml)
|
||||
- warden sign with local and OpenBao backends and adm/agt/atm actors
|
||||
excludes:
|
||||
- tunnel lifecycle
|
||||
- host /etc/ssh/auth_principals deployment
|
||||
- OpenBao or Vault cluster setup
|
||||
- long-lived secret storage
|
||||
- Direct Tooling contact is a declared gap; certificate reachability is not target
|
||||
authorization
|
||||
assumptions:
|
||||
- callers supply actor public keys; humans self-issue admin keys
|
||||
- production platform uses OpenBao with Vault-compatible SSH engine API
|
||||
- callers supply actor public keys; humans self-issue admin keys
|
||||
- production platform uses OpenBao with Vault-compatible SSH engine API
|
||||
use_cases:
|
||||
- ops-bridge tunnel cert_command
|
||||
- Inter-Hub bootstrap short-lived agent access
|
||||
- ops-bridge tunnel cert_command
|
||||
- Inter-Hub bootstrap short-lived agent access
|
||||
- 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity'
|
||||
research_memos:
|
||||
- ops-warden/SCOPE.md
|
||||
- ops-warden/wiki/CertCommandInterface.md
|
||||
- ops-warden/wiki/OpsWardenConfig.md
|
||||
- ops-warden/wiki/AccessRouting.md
|
||||
|
||||
- ops-warden/SCOPE.md
|
||||
- ops-warden/wiki/CertCommandInterface.md
|
||||
- ops-warden/wiki/OpsWardenConfig.md
|
||||
- ops-warden/wiki/AccessRouting.md
|
||||
availability:
|
||||
current_level: A3
|
||||
target_level: A5
|
||||
current_artifacts:
|
||||
- ops-warden/src/warden/
|
||||
- ops-warden/wiki/CertCommandInterface.md
|
||||
- ops-warden/wiki/OpsWardenConfig.md
|
||||
- SCOPE.md
|
||||
- README.md
|
||||
target_artifacts:
|
||||
- packaged ops-warden release with documented OpenBao role bootstrap
|
||||
- "`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)"
|
||||
- packaged ops-warden release with documented OpenBao role bootstrap
|
||||
- '`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)'
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- cert_command subprocess
|
||||
|
||||
- library
|
||||
- CLI
|
||||
relations:
|
||||
depends_on: []
|
||||
supports: []
|
||||
related_to: []
|
||||
|
||||
related_to:
|
||||
- capability.security.credential-lifecycle
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.ops.tunnel-bridge
|
||||
- capability.security.structure-construction
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- issuing short-lived SSH certs for ops-bridge tunnels
|
||||
- agent or automation access with TTL-bound principals
|
||||
- checking cert-side compliance before rotation windows
|
||||
- orienting dev workers on which NetKingdom subsystem owns each credential type
|
||||
- Operator or automation obtains a bounded SSH certificate and maintains private
|
||||
connectivity
|
||||
not_recommended_for:
|
||||
- storing OpenRouter or Inter-Hub API keys
|
||||
- replacing OpenBao deployment or host SSH hardening playbooks
|
||||
- static-key-only legacy access (use ops-bridge static key mode instead)
|
||||
- Direct Tooling contact is a declared gap; certificate reachability is not target
|
||||
authorization
|
||||
known_limitations:
|
||||
- "VaultCA backend config key remains backend: vault for API compatibility"
|
||||
- host-side scorecard checks live in railiance-infra
|
||||
- Direct Tooling contact is a declared gap; certificate reachability is not target
|
||||
authorization
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
evidence:
|
||||
documentation:
|
||||
- SCOPE.md
|
||||
- README.md
|
||||
---
|
||||
|
||||
# SSH Certificate Issuance
|
||||
# Decision-bound SSH certificates
|
||||
|
||||
ops-warden is the custodian-domain SSH CA tool. It signs short-lived certificates,
|
||||
maintains the actor inventory, and exposes `warden sign` as the cert_command
|
||||
contract for ops-bridge and other callers.
|
||||
warden sign with local and OpenBao backends and adm/agt/atm actors.
|
||||
|
||||
Production environments point the vault-compatible backend at OpenBao; labs use
|
||||
the local ssh-keygen CA backend without platform dependencies.
|
||||
## Reuse boundary
|
||||
|
||||
Direct Tooling contact is a declared gap; certificate reachability is not target authorization.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [SCOPE.md](../../SCOPE.md)
|
||||
- [README.md](../../README.md)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
|
|||
|
|
@ -1,16 +1,13 @@
|
|||
version: 1
|
||||
updated: '2026-06-17'
|
||||
updated: '2026-10-14'
|
||||
domain: helix_forge
|
||||
capabilities:
|
||||
- id: capability.security.ssh-certificate-issuance
|
||||
name: SSH Certificate Issuance
|
||||
summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors
|
||||
through a stable cert_command CLI interface; steward NetKingdom operational access routing.
|
||||
vector: D4 / A3 / C3 / R2
|
||||
name: Decision-bound SSH certificates
|
||||
summary: warden sign with local and OpenBao backends and adm/agt/atm actors.
|
||||
domain: helix_forge
|
||||
status: draft
|
||||
owner: ops-warden
|
||||
path: registry/capabilities/capability.security.ssh-certificate-issuance.md
|
||||
tags:
|
||||
- ssh
|
||||
- certificate
|
||||
|
|
@ -18,6 +15,40 @@ capabilities:
|
|||
- ops-warden
|
||||
- openbao
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D4 / A3 / C3 / R2
|
||||
path: registry/capabilities/capability.security.ssh-certificate-issuance.md
|
||||
consumption_modes:
|
||||
- library
|
||||
- CLI
|
||||
- id: capability.security.access-routing
|
||||
name: Credential routing and contained access
|
||||
summary: warden route and access catalog; exact lane conduit and secret-exec routing.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: ops-warden
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A3 / C1 / R0
|
||||
path: registry/capabilities/capability.security.access-routing.md
|
||||
consumption_modes:
|
||||
- library
|
||||
- CLI
|
||||
- id: capability.security.case-follow-through
|
||||
name: Security case operational follow-through
|
||||
summary: KnownSecurityCase route, plan and operational receipts.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: ops-warden
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R0
|
||||
path: registry/capabilities/capability.security.case-follow-through.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- cert_command subprocess
|
||||
- source
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue