coulomb/policy-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: publish Risk Nexus findings and methods
All checks were successful
Build and publish policy-nexus image / build-and-push (push) Successful in 1m10s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
This commit is contained in:
tegwick 2026-09-01 01:56:46 +02:00
parent 4c8a7b9666
commit c1b60f322e
70 changed files with 3888 additions and 198 deletions
Download patch file Download diff file Expand all files Collapse all files

6
build/adr/netkingdom-security-orchestration-boundary/v1/index.html
View file

@ -1,6 +1,6 @@
<!doctype html>
<html lang="en"><meta charset="utf-8">
<meta name="policy-source-revision" content="d4e57e63126d2cca1d381c025170e4b1f678c3f3">
<meta name="policy-source-revision" content="9781102e2971d762ae42fdd5085a6647afd1cd66">
<meta name="policy-source-digest" content="b4fcff8448f07aca1fcb6908618bdb19f6c0e7dce25d4c5c8b85eec2f175233b">
<title>Security Orchestration Boundary</title>
<style>
@ -191,7 +191,7 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
</style>
<div class="wrap"><header><div class="eyebrow"><span>NK-ADR-0007</span> <span class="stat">accepted · 1</span> <span>net-kingdom</span> <span>reviewed 2026-08-22</span><span>generated from canonical source — do not edit</span></div><h1>Security Orchestration Boundary</h1><p class="sub">Source: <code>net-kingdom · docs/adr/ADR-0007-security-orchestration-boundary.md · d4e57e63126d2cca1d381c025170e4b1f678c3f3</code></p><p class="sub">Review due: 2027-02-22</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#context"><span class="n">·</span>Context</a></li><li><a href="#decision"><span class="n">·</span>Decision</a></li><li><a href="#consequences"><span class="n">·</span>Consequences</a></li><li><a href="#future-repo-trigger"><span class="n">·</span>Future Repo Trigger</a></li><li><a href="#alternatives-considered"><span class="n">·</span>Alternatives Considered</a></li><li><a href="#refinement-2026-05-21-meta-orchestration-layer"><span class="n">·</span>Refinement (2026-05-21): Meta-Orchestration Layer</a></li></ol></nav><main><p><strong>Status:</strong> Accepted <strong>Date:</strong> 2026-05-18 <strong>Refined:</strong> 2026-05-21 (meta-orchestration layer — see below) <strong>Deciders:</strong> Bernd Worsch, Codex</p>
<div class="wrap"><header><div class="eyebrow"><span>NK-ADR-0007</span> <span class="stat">accepted · 1</span> <span>net-kingdom</span> <span>reviewed 2026-08-22</span><span>generated from canonical source — do not edit</span></div><h1>Security Orchestration Boundary</h1><p class="sub">Source: <code>net-kingdom · docs/adr/ADR-0007-security-orchestration-boundary.md · 9781102e2971d762ae42fdd5085a6647afd1cd66</code></p><p class="sub">Review due: 2027-02-22</p></header><div class="layout"><nav class="rail" aria-label="Sections"><ol><li><a href="#context"><span class="n">·</span>Context</a></li><li><a href="#decision"><span class="n">·</span>Decision</a></li><li><a href="#consequences"><span class="n">·</span>Consequences</a></li><li><a href="#future-repo-trigger"><span class="n">·</span>Future Repo Trigger</a></li><li><a href="#alternatives-considered"><span class="n">·</span>Alternatives Considered</a></li><li><a href="#refinement-2026-05-21-meta-orchestration-layer"><span class="n">·</span>Refinement (2026-05-21): Meta-Orchestration Layer</a></li></ol></nav><main><p><strong>Status:</strong> Accepted <strong>Date:</strong> 2026-05-18 <strong>Refined:</strong> 2026-05-21 (meta-orchestration layer — see below) <strong>Deciders:</strong> Bernd Worsch, Codex</p>
<section id="context"><h2>Context</h2>
<p>The recursive platform security architecture needs careful sequencing: host trust, cluster trust, bootstrap secrets, runtime secret authority, runtime identity, runtime authorization, tenant onboarding, and readiness verification.</p>
<p>That sequencing crosses NetKingdom and Railiance ownership boundaries. NetKingdom owns the canonical security architecture, IAM Profile, credential/bootstrap standards, and authorization semantics. Railiance owns deployment layering for infrastructure, clusters, platform services, and applications. OpenBao adds an important runtime-secret authority to the platform control plane, but it does not change those ownership boundaries.</p>
@ -227,4 +227,4 @@ a:focus-visible,.rail a:focus-visible{outline:2px solid var(--brass);outline-off
<p>For NetKingdom to select and parametrize reliably, <strong>Railiance playbooks must publish a declared interface</strong>: the capability each playbook provisions, its parameters (with defaults and constraints), and the responsibility it claims. This catalog is the orchestration-layer analog of the IAM Profile. Without it, meta-orchestration composes against implicit behavior and breaks when a playbook changes. Establishing this contract is the prerequisite for any concrete meta-orchestration work.</p>
<h3>Effect on the Future Repo Trigger</h3>
<p>Meta-orchestration logic now has a clear home (NetKingdom) regardless of whether a dedicated <strong>execution</strong>-orchestration repo is later created under the Future Repo Trigger above. A future repo, if created, would host reusable execution sequencing — not the scenario-composition and responsibility-mapping role, which remains NetKingdom's.</p>
</section><footer><span>NK-ADR-0007 · 1 · accepted</span><span>net-kingdom · docs/adr/ADR-0007-security-orchestration-boundary.md · d4e57e63126d2cca1d381c025170e4b1f678c3f3</span></footer></main></div></div></html>
</section><footer><span>NK-ADR-0007 · 1 · accepted</span><span>net-kingdom · docs/adr/ADR-0007-security-orchestration-boundary.md · 9781102e2971d762ae42fdd5085a6647afd1cd66</span></footer></main></div></div></html>