# NetKingdom Workload Security Posture — machine-readable descriptors
# WARDEN-WP-0015 T2. Authoritative prose: wiki/WorkloadSecurityPosture.md (pending
# promotion to net-kingdom + info-tech-canon canon).
#
# Rules:
#   - No secret material in this file, ever (it is git-tracked and agent-visible).
#   - DataClassification names are REUSED from the info-tech-canon Data Model.
#   - This is a descriptor/data layer; runtime enforcement is flex-auth's.
version: 1

# --- Axis A — environment posture (how the secret store is secured) ----------
env_postures:
  - id: dev
    rank: 0
    backend: mock-or-contract-double
    real_values: forbidden          # synthetic only
    unseal: n/a
    real_user_data: never
    audit: optional
  - id: test
    rank: 1
    backend: openbao-dev-single-unseal
    real_values: generated-reuse-allowed
    unseal: single-key-or-auto
    real_user_data: never
    audit: "on"
  - id: prod
    rank: 2
    backend: openbao-sealed-shamir
    real_values: generated-fresh-no-reuse
    unseal: shamir-3-of-5-break-glass
    real_user_data: allowed
    audit: full-tamper-evident

# --- Axis B — workload maturity (how trusted a workload is) -------------------
maturity_levels:
  - id: M0
    rank: 0
    phase: experimental-poc
    max_dataclass: synthetic
    promotion_gate: []
  - id: M1
    rank: 1
    phase: alpha-early-access
    max_dataclass: internal
    promotion_gate: [friendly-customer-scope, basic-slo, data-handling-note]
  - id: M2
    rank: 2
    phase: beta-ga
    max_dataclass: confidential
    promotion_gate: [security-review, slo-history, on-call, incident-runbooks]
  - id: M3
    rank: 3
    phase: critical-regulated
    max_dataclass: restricted
    promotion_gate: [pen-test, shamir-3-of-5-custody, human-in-loop-ops, compliance-audit]

# --- Data-class floor — minimum maturity to handle each DataClassification ----
# required_maturity(dataclass). DataClassification names reused from info-tech-canon.
dataclass_floor:
  synthetic: M0
  internal: M1
  confidential: M2
  restricted: M3

# --- Secret-flow lattice (informational; enforced by T3 checker + flex-auth) --
# deliver(secret -> workload) permitted iff:
#   workload.env_posture == prod
#   and rank(workload.maturity) >= rank(secret.required_maturity)
#   and rank(workload.maturity) >= rank(dataclass_floor[dataclass(secret)])
lattice:
  requires_env_posture: prod
  rule: no-write-down

# --- Axis C — organization lifecycle posture (WARDEN-WP-0029 T02) --------------
# Third axis: fleet lifecycle, distinct from env (dev/test/prod) and maturity
# (M0–M3). Answers how aggressive policy relaxations may be for founder-scale
# operation. Graduate when any trigger fires; do not overload env/maturity.
organization_posture:
  id: build
  summary: >
    One founder-operator, pre-revenue, velocity prioritized. Pragmatic
    provisioning is acceptable where audit and custody invariants hold
    (values only in OpenBao/process env; metadata-only trails).
  relaxations:
    - workstation_oidc_acceptable
    - per_repo_deploy_keys
    - flex_auth_advisory_default
    - localhost_founder_desk_os_session_trust
  graduation_triggers:
    - first_customer_data
    - first_non_founder_operator
    - production_tier