From 11b2a9d7bc97f5fe8606927c17fe8acc59b79cd0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 14 Oct 2026 06:41:08 +0200 Subject: [PATCH] docs(reuse): establish reviewed NetKingdom security capabilities Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684 --- .../capability.security.access-routing.md | 104 +++++++++++ ...capability.security.case-follow-through.md | 104 +++++++++++ ...ility.security.ssh-certificate-issuance.md | 169 +++++++++--------- registry/indexes/capabilities.yaml | 45 ++++- 4 files changed, 331 insertions(+), 91 deletions(-) create mode 100644 registry/capabilities/capability.security.access-routing.md create mode 100644 registry/capabilities/capability.security.case-follow-through.md diff --git a/registry/capabilities/capability.security.access-routing.md b/registry/capabilities/capability.security.access-routing.md new file mode 100644 index 0000000..dbab2a0 --- /dev/null +++ b/registry/capabilities/capability.security.access-routing.md @@ -0,0 +1,104 @@ +--- +id: capability.security.access-routing +owner: ops-warden +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A3 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: warden route and access catalog; + exact lane conduit and secret-exec routing. Availability describes the delivery + form, not production acceptance. Routing grants no authority; interim delegates + and attended high-risk lanes persist.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Credential routing and contained access +summary: warden route and access catalog; exact lane conduit and secret-exec routing. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: warden route and access catalog; exact lane conduit and secret-exec routing + includes: + - warden route and access catalog; exact lane conduit and secret-exec routing + excludes: + - Routing grants no authority; interim delegates and attended high-risk lanes persist + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A3 + target_level: A3 + current_artifacts: + - SCOPE.md + - wiki/CredentialRouting.md + consumption_modes: + - library + - CLI +relations: + related_to: + - capability.security.credential-lifecycle + - capability.authorization.policy-evaluate + - capability.ops.tunnel-bridge + - capability.security.structure-construction +evidence: + documentation: + - SCOPE.md + - wiki/CredentialRouting.md +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Routing grants no authority; interim delegates and attended high-risk lanes persist + known_limitations: + - Routing grants no authority; interim delegates and attended high-risk lanes persist + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Credential routing and contained access + +warden route and access catalog; exact lane conduit and secret-exec routing. + +## Reuse boundary + +Routing grants no authority; interim delegates and attended high-risk lanes persist. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [wiki/CredentialRouting.md](../../wiki/CredentialRouting.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.case-follow-through.md b/registry/capabilities/capability.security.case-follow-through.md new file mode 100644 index 0000000..1268c23 --- /dev/null +++ b/registry/capabilities/capability.security.case-follow-through.md @@ -0,0 +1,104 @@ +--- +id: capability.security.case-follow-through +owner: ops-warden +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: KnownSecurityCase route, plan + and operational receipts. Availability describes the delivery form, not production + acceptance. Execution requires accepted structure and exact owner contracts; + case closure is not automatic.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security case operational follow-through +summary: KnownSecurityCase route, plan and operational receipts. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: KnownSecurityCase route, plan and operational receipts + includes: + - KnownSecurityCase route, plan and operational receipts + excludes: + - Execution requires accepted structure and exact owner contracts; case closure + is not automatic + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - workplans/WARDEN-WP-0044-security-case-follow-through.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.credential-lifecycle + - capability.authorization.policy-evaluate + - capability.ops.tunnel-bridge + - capability.security.structure-construction +evidence: + documentation: + - workplans/WARDEN-WP-0044-security-case-follow-through.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Execution requires accepted structure and exact owner contracts; case closure + is not automatic + known_limitations: + - Execution requires accepted structure and exact owner contracts; case closure + is not automatic + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security case operational follow-through + +KnownSecurityCase route, plan and operational receipts. + +## Reuse boundary + +Execution requires accepted structure and exact owner contracts; case closure is not automatic. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [workplans/WARDEN-WP-0044-security-case-follow-through.md](../../workplans/WARDEN-WP-0044-security-case-follow-through.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/capabilities/capability.security.ssh-certificate-issuance.md b/registry/capabilities/capability.security.ssh-certificate-issuance.md index d62d348..91e05c8 100644 --- a/registry/capabilities/capability.security.ssh-certificate-issuance.md +++ b/registry/capabilities/capability.security.ssh-certificate-issuance.md @@ -1,39 +1,38 @@ --- id: capability.security.ssh-certificate-issuance -name: SSH Certificate Issuance -summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward operational access routing across NetKingdom security lanes. +name: Decision-bound SSH certificates +summary: warden sign with local and OpenBao backends and adm/agt/atm actors. owner: ops-warden status: draft domain: helix_forge tags: - - ssh - - certificate - - ca - - ops-warden - - openbao - - security - +- ssh +- certificate +- ca +- ops-warden +- openbao +- security +- netkingdom +- framework-reuse maturity: discovery: current: D4 target: D5 confidence: medium - rationale: > - SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command - contract are documented; production OpenBao integration is documented but - engine deployment lives in railiance-platform. A machine-readable routing - catalog (registry/routing/catalog.yaml) and wiki/AccessRouting.md make the - "issue SSH, route the rest" boundary discoverable. + rationale: 'SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command + contract are documented; production OpenBao integration is documented but engine + deployment lives in railiance-platform. A machine-readable routing catalog (registry/routing/catalog.yaml) + and wiki/AccessRouting.md make the "issue SSH, route the rest" boundary discoverable. + + ' availability: current: A3 target: A5 confidence: medium - rationale: > - Installable `warden` CLI and `ops-ssh-wrapper` entry points; ops-bridge and - other callers integrate via cert_command without backend-specific branching. - A `warden route` lookup over the pointer catalog (WARDEN-WP-0011) will move - routing discovery from wiki prose to a structured surface for agents (A3 -> A4). - + rationale: 'Source interface assessed 2026-10-14: warden sign with local and OpenBao + backends and adm/agt/atm actors. Availability describes the delivery form, not + production acceptance. Direct Tooling contact is a declared gap; certificate + reachability is not target authorization.' external_evidence: completeness: level: C3 @@ -41,97 +40,99 @@ external_evidence: confidence: medium basis: scope_vs_intent_and_consumer_expectations satisfied_expectations: - - local and OpenBao/Vault-compatible signing backends - - TTL policy enforcement per actor type - - principals inventory and cert-side scorecard - - signatures audit log and stale-cert cleanup - - cert_command stdout contract for ops-bridge + - local and OpenBao/Vault-compatible signing backends + - TTL policy enforcement per actor type + - principals inventory and cert-side scorecard + - signatures audit log and stale-cert cleanup + - cert_command stdout contract for ops-bridge broken_expectations: - - host-side principal deployment not owned here - - OpenBao SSH engine mount not deployed from this repo + - host-side principal deployment not owned here + - OpenBao SSH engine mount not deployed from this repo out_of_scope_expectations: - - long-lived API key custody - - tunnel lifecycle management - - Vault/OpenBao cluster operations + - long-lived API key custody + - tunnel lifecycle management + - Vault/OpenBao cluster operations reliability: level: R2 name: Tolerable confidence: medium basis: consumer_quality_signals known_reliability_risks: - - production signing depends on OpenBao availability and token policy - - local backend requires protected CA key handling by operators - + - production signing depends on OpenBao availability and token policy + - local backend requires protected CA key handling by operators discovery: - intent: > - Give the ops fleet short-lived SSH credentials for humans, agents, and - automations without static keys, through a single cert_command surface that - callers can rely on regardless of CA backend; route non-SSH credential needs - to the correct NetKingdom subsystems (OpenBao, flex-auth, key-cape). + intent: warden sign with local and OpenBao backends and adm/agt/atm actors includes: - - certificate signing for adm, agt, and atm actors - - actor principals inventory and TTL policy - - cert_command interface (`warden sign`) - - cert-side compliance scorecard and signatures log - - ops-ssh-wrapper for automatic cert acquisition - - NetKingdom credential routing and alignment documentation - - machine-readable routing pointer catalog (registry/routing/catalog.yaml) + - warden sign with local and OpenBao backends and adm/agt/atm actors excludes: - - tunnel lifecycle - - host /etc/ssh/auth_principals deployment - - OpenBao or Vault cluster setup - - long-lived secret storage + - Direct Tooling contact is a declared gap; certificate reachability is not target + authorization assumptions: - - callers supply actor public keys; humans self-issue admin keys - - production platform uses OpenBao with Vault-compatible SSH engine API + - callers supply actor public keys; humans self-issue admin keys + - production platform uses OpenBao with Vault-compatible SSH engine API use_cases: - - ops-bridge tunnel cert_command - - Inter-Hub bootstrap short-lived agent access + - ops-bridge tunnel cert_command + - Inter-Hub bootstrap short-lived agent access + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' research_memos: - - ops-warden/SCOPE.md - - ops-warden/wiki/CertCommandInterface.md - - ops-warden/wiki/OpsWardenConfig.md - - ops-warden/wiki/AccessRouting.md - + - ops-warden/SCOPE.md + - ops-warden/wiki/CertCommandInterface.md + - ops-warden/wiki/OpsWardenConfig.md + - ops-warden/wiki/AccessRouting.md availability: current_level: A3 target_level: A5 current_artifacts: - - ops-warden/src/warden/ - - ops-warden/wiki/CertCommandInterface.md - - ops-warden/wiki/OpsWardenConfig.md + - SCOPE.md + - README.md target_artifacts: - - packaged ops-warden release with documented OpenBao role bootstrap - - "`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)" + - packaged ops-warden release with documented OpenBao role bootstrap + - '`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)' consumption_modes: - - CLI - - cert_command subprocess - + - library + - CLI relations: depends_on: [] supports: [] - related_to: [] - + related_to: + - capability.security.credential-lifecycle + - capability.authorization.policy-evaluate + - capability.ops.tunnel-bridge + - capability.security.structure-construction consumer_guidance: recommended_for: - - issuing short-lived SSH certs for ops-bridge tunnels - - agent or automation access with TTL-bound principals - - checking cert-side compliance before rotation windows - - orienting dev workers on which NetKingdom subsystem owns each credential type + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity not_recommended_for: - - storing OpenRouter or Inter-Hub API keys - - replacing OpenBao deployment or host SSH hardening playbooks - - static-key-only legacy access (use ops-bridge static key mode instead) + - Direct Tooling contact is a declared gap; certificate reachability is not target + authorization known_limitations: - - "VaultCA backend config key remains backend: vault for API compatibility" - - host-side scorecard checks live in railiance-infra + - Direct Tooling contact is a declared gap; certificate reachability is not target + authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +evidence: + documentation: + - SCOPE.md + - README.md --- -# SSH Certificate Issuance +# Decision-bound SSH certificates -ops-warden is the custodian-domain SSH CA tool. It signs short-lived certificates, -maintains the actor inventory, and exposes `warden sign` as the cert_command -contract for ops-bridge and other callers. +warden sign with local and OpenBao backends and adm/agt/atm actors. -Production environments point the vault-compatible backend at OpenBao; labs use -the local ssh-keygen CA backend without platform dependencies. \ No newline at end of file +## Reuse boundary + +Direct Tooling contact is a declared gap; certificate reachability is not target authorization. + +## Supported use cases + +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 218a9ab..7f4d649 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,16 +1,13 @@ version: 1 -updated: '2026-06-17' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.security.ssh-certificate-issuance - name: SSH Certificate Issuance - summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors - through a stable cert_command CLI interface; steward NetKingdom operational access routing. - vector: D4 / A3 / C3 / R2 + name: Decision-bound SSH certificates + summary: warden sign with local and OpenBao backends and adm/agt/atm actors. domain: helix_forge status: draft owner: ops-warden - path: registry/capabilities/capability.security.ssh-certificate-issuance.md tags: - ssh - certificate @@ -18,6 +15,40 @@ capabilities: - ops-warden - openbao - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R2 + path: registry/capabilities/capability.security.ssh-certificate-issuance.md + consumption_modes: + - library + - CLI +- id: capability.security.access-routing + name: Credential routing and contained access + summary: warden route and access catalog; exact lane conduit and secret-exec routing. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.security.access-routing.md + consumption_modes: + - library + - CLI +- id: capability.security.case-follow-through + name: Security case operational follow-through + summary: KnownSecurityCase route, plan and operational receipts. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-follow-through.md consumption_modes: - CLI - - cert_command subprocess \ No newline at end of file + - source