feat: publish reviewed architecture and ADR batch

Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
2026-08-31 21:34:23 +02:00 · 2026-08-31 21:34:23 +02:00 · 93608c1f17
commit 93608c1f17
parent 023badb512
120 changed files with 17791 additions and 727 deletions
--- a/build/standards/iam-profile/v0.3/index.html
+++ b/build/standards/iam-profile/v0.3/index.html
@ -1,7 +1,7 @@
 <!doctype html>
 <html lang="en"><meta charset="utf-8">
-<meta name="policy-source-revision" content="ccc2618daee997bb4bd4249613d7c4c7344845cf">
-<meta name="policy-source-digest" content="6287be08e35ddefc8e93d3b127cd8a1be27dc311b014becdbcfb78c4164faa0a">
+<meta name="policy-source-revision" content="d4e57e63126d2cca1d381c025170e4b1f678c3f3">
+<meta name="policy-source-digest" content="6c47b596ea145fa197c9665081c84902482d90f5bb94d185c1223af65279be1d">
 <title>NetKingdom IAM Profile v0.3</title>
 <style>
 :root{
@ -191,7 +191,7 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}

 </style>
-<div class="wrap"><header><div class="eyebrow"><span>netkingdom-iam-profile-v0.3</span> <span class="stat">accepted</span> <span>net-kingdom</span> <span>reviewed 2026-07-23</span><span>generated from canonical source — do not edit</span></div><h1>NetKingdom IAM Profile v0.3</h1><p class="sub">Source: <code>net-kingdom · canon/standards/iam-profile_v0.3.md · ccc2618daee997bb4bd4249613d7c4c7344845cf</code></p><p class="sub">Review due: 2027-01-23</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#purpose"><span class="n">·</span>Purpose</a></li><li><a href="#ownership"><span class="n">·</span>Ownership</a></li><li><a href="#design-principles"><span class="n">·</span>Design Principles</a></li><li><a href="#discovery-contract"><span class="n">·</span>Discovery Contract</a></li><li><a href="#required-flows"><span class="n">·</span>Required Flows</a></li><li><a href="#core-claims"><span class="n">·</span>Core Claims</a></li><li><a href="#tenant-claim"><span class="n">·</span>Tenant Claim</a></li><li><a href="#tenant-roles"><span class="n">·</span>Tenant Roles</a></li><li><a href="#assurance-evidence"><span class="n">·</span>Assurance Evidence</a></li><li><a href="#identity-to-authorization-contract"><span class="n">·</span>Identity To Authorization Contract</a></li><li><a href="#token-lifecycle"><span class="n">·</span>Token Lifecycle</a></li><li><a href="#local-development-profile"><span class="n">·</span>Local Development Profile</a></li><li><a href="#emergency-and-break-glass-access"><span class="n">·</span>Emergency And Break-Glass Access</a></li><li><a href="#conformance"><span class="n">·</span>Conformance</a></li><li><a href="#validation-checklist"><span class="n">·</span>Validation Checklist</a></li></ol></nav><main><div class="rule-quote"><p>Minor version. Per ADR-0011's versioning rule, this adds an optional claim and clarifies non-normative guidance — no required claim, validation rule, or previously-issued token is invalidated. Existing v0.2 implementations remain conformant; <code>tenant_roles</code> and the revised Tenant Claim guidance are additive.</p></div>
+<div class="wrap"><header><div class="eyebrow"><span>netkingdom-iam-profile-v0.3</span> <span class="stat">accepted · accepted-1</span> <span>net-kingdom</span> <span>reviewed 2026-08-22</span><span>generated from canonical source — do not edit</span></div><h1>NetKingdom IAM Profile v0.3</h1><p class="sub">Source: <code>net-kingdom · canon/standards/iam-profile_v0.3.md · d4e57e63126d2cca1d381c025170e4b1f678c3f3</code></p><p class="sub">Review due: 2027-02-22</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#purpose"><span class="n">·</span>Purpose</a></li><li><a href="#ownership"><span class="n">·</span>Ownership</a></li><li><a href="#design-principles"><span class="n">·</span>Design Principles</a></li><li><a href="#discovery-contract"><span class="n">·</span>Discovery Contract</a></li><li><a href="#required-flows"><span class="n">·</span>Required Flows</a></li><li><a href="#core-claims"><span class="n">·</span>Core Claims</a></li><li><a href="#tenant-claim"><span class="n">·</span>Tenant Claim</a></li><li><a href="#tenant-roles"><span class="n">·</span>Tenant Roles</a></li><li><a href="#assurance-evidence"><span class="n">·</span>Assurance Evidence</a></li><li><a href="#identity-to-authorization-contract"><span class="n">·</span>Identity To Authorization Contract</a></li><li><a href="#token-lifecycle"><span class="n">·</span>Token Lifecycle</a></li><li><a href="#local-development-profile"><span class="n">·</span>Local Development Profile</a></li><li><a href="#emergency-and-break-glass-access"><span class="n">·</span>Emergency And Break-Glass Access</a></li><li><a href="#conformance"><span class="n">·</span>Conformance</a></li><li><a href="#validation-checklist"><span class="n">·</span>Validation Checklist</a></li></ol></nav><main><div class="rule-quote"><p>Minor version. Per ADR-0011's versioning rule, this adds an optional claim and clarifies non-normative guidance — no required claim, validation rule, or previously-issued token is invalidated. Existing v0.2 implementations remain conformant; <code>tenant_roles</code> and the revised Tenant Claim guidance are additive.</p></div>
 <section id="purpose"><h2>Purpose</h2>
 <p>The NetKingdom IAM Profile is the provider-neutral OIDC contract that identity implementations issue and applications consume.</p>
 <p>It defines:</p>
@ -248,7 +248,7 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
 </section>
 <section id="tenant-claim"><h2>Tenant Claim</h2>
 <p><code>tenant</code> is required for every token accepted by profile consumers.</p>
-<p>Tenant identifiers follow <code>tenant:&lt;grouping&gt;:&lt;name&gt;</code>, where <code>&lt;grouping&gt;</code> is one of the taxonomy ratified by ADR-0013:</p>
+<p>Tenant identifiers follow <code>tenant:&lt;grouping&gt;:&lt;name&gt;</code>, where <code>&lt;grouping&gt;</code> is one of the taxonomy ratified by ADR-0013 at identifier creation:</p>
 <pre>trial        - test/trial/showcase tenants only
 friendly     - known, easily reached, tolerant of experimentation/instability
 single       - one-person business entities (freelance consultants)
@ -263,7 +263,7 @@ association  - a legal association of people
 agentic      - financially enabled AI entities</pre>
 <p><code>tenant:platform</code> and <code>tenant:coulomb</code> remain <strong>reserved, ungrouped</strong> identifiers outside this taxonomy: <code>tenant:platform</code> is the platform control-plane tenant, not a business entity being onboarded; <code>tenant:coulomb</code> is the first internal/reference tenant established by ADR-0006, predating this taxonomy. Tenant administration for <code>tenant:coulomb</code> or any grouped tenant must never imply platform-root authority.</p>
 <p>Subjects may have access to multiple tenants, but a token used for a request MUST identify the tenant context for that request. If a client needs to switch tenant context, it obtains a new token or uses an approved token-exchange flow that records the target tenant.</p>
-<p>The grouping segment is <strong>onboarding-risk / entity-shape</strong> classification only. It does not gate which capability roles (below) a tenant may hold — see Tenant Roles.</p>
+<p>The grouping segment is an immutable record of the tenant's <strong>onboarding-time</strong> onboarding-risk / entity-shape classification. It remains vocabulary-valid but becomes historical if the tenant's classification later changes. The authoritative current grouping is the <code>grouping</code> field held by <code>tenant-engine</code>; consumers MUST NOT split <code>tenant</code> and treat its middle segment as current policy input. Changing current grouping never renames the tenant. Neither the historical segment nor current grouping gates which capability roles (below) a tenant may hold — see Tenant Roles.</p>
 </section>
 <section id="tenant-roles"><h2>Tenant Roles</h2>
 <p>Tenant <strong>capability roles</strong> are a separate fact from the grouping above and from the subject-level <code>roles</code> claim: <code>PLTF</code>, <code>IAM</code>, <code>VEN</code>, <code>CUS</code> (ratified by ADR-0014), non-exclusive — a tenant may hold several simultaneously, and holding one does not require or restrict any grouping.</p>
@ -316,4 +316,4 @@ agentic      - financially enabled AI entities</pre>
 <section id="validation-checklist"><h2>Validation Checklist</h2>
 <p>A service or implementation is profile-ready when:</p>
 <ul><li>it reads OIDC discovery rather than hardcoding endpoints;</li><li>it validates issuer, audience, expiry, <code>nbf</code>, algorithm, and signature;</li><li>it refreshes JWKS on unknown <code>kid</code>;</li><li>it supports Authorization Code + PKCE for human login;</li><li>it supports service-account or workload identity tokens;</li><li>it emits <code>tenant</code>, <code>principal_type</code>, <code>groups</code>, <code>roles</code>, <code>scope</code>/<code>scp</code>, and <code>assurance</code>;</li><li>it uses the ADR-0013 grouping vocabulary for new tenant identifiers;</li><li>if it consumes <code>tenant_roles</code>, it treats the claim as a cache and re-validates live against <code>tenant-engine</code> before any <code>aal2</code>-class decision;</li><li>it maps provider-native claims into the canonical core claims;</li><li>it rejects local-development issuers in production;</li><li>it logs emergency access with a durable audit trail;</li><li>flex-auth receives identity facts from the profile, not from provider-specific sessions.</li></ul>
-</section><footer><span>netkingdom-iam-profile-v0.3 ·  · accepted</span><span>net-kingdom · canon/standards/iam-profile_v0.3.md · ccc2618daee997bb4bd4249613d7c4c7344845cf</span></footer></main></div></div></html>
+</section><footer><span>netkingdom-iam-profile-v0.3 · accepted-1 · accepted</span><span>net-kingdom · canon/standards/iam-profile_v0.3.md · d4e57e63126d2cca1d381c025170e4b1f678c3f3</span></footer></main></div></div></html>