feat(RMASTER-WP-0026): declare Taxonomy layer and consume NetKingdom §20
Add layer.yaml, RMASTER-ADR-0009, the consumption contract, and a tracked non-answer for the five §20.3 questions. Split admission, exposure, and authorization without renaming schema fields. Finish the workplan. Assistant: grok Assistant-Session: 01a04c9f-cd6b-7741-bce0-f1d9d1b3c3bc
This commit is contained in:
codex
parent
2ec0b93333
commit
a0c35b7438
13 changed files with 373 additions and 43 deletions
11
INTENT.md
11
INTENT.md
|
|
@ -92,9 +92,10 @@ and operated as a managed service, it is a workload like any other and is
|
|||
packaged, executed, and bound through `rapp-*`, `rail-*`, and `reef-*`.
|
||||
|
||||
NetKingdom Security Layer Model v0.7 §20 restates these definitions; it does
|
||||
not author them. Changes to that boundary require this repository's assent
|
||||
for the axis definitions and `glas-harness`'s assent for the session and
|
||||
tool-policy seam.
|
||||
not author them. This repository's assent is
|
||||
[`docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`](docs/adr/ADR-0009-netkingdom-security-layer-interaction.md).
|
||||
Changes to that boundary require this repository's assent for the axis
|
||||
definitions and `glas-harness`'s assent for the session and tool-policy seam.
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -174,6 +175,10 @@ the other side's assent. They are not implied by this file.
|
|||
|
||||
Admission (whether a binding may run in production) and exposure (who may
|
||||
reach a listener) remain Railiance axes. They are not authorization decisions.
|
||||
The consumption contract is
|
||||
[`docs/netkingdom-security-consumption-contract.md`](docs/netkingdom-security-consumption-contract.md).
|
||||
The five unsettled axis-to-layer questions are tracked, not answered, in
|
||||
[`docs/netkingdom-axis-layer-open-questions.md`](docs/netkingdom-axis-layer-open-questions.md).
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -24,6 +24,8 @@ recorded before they are spread across implementation repos.
|
|||
- [docs/rail-composition-contract.md](docs/rail-composition-contract.md)
|
||||
- [docs/reef-production-readiness-contract.md](docs/reef-production-readiness-contract.md)
|
||||
- [docs/exposure-posture-contract.md](docs/exposure-posture-contract.md)
|
||||
- [docs/netkingdom-security-consumption-contract.md](docs/netkingdom-security-consumption-contract.md)
|
||||
- [docs/netkingdom-axis-layer-open-questions.md](docs/netkingdom-axis-layer-open-questions.md)
|
||||
- [docs/qonto-knative-runtime-contract.md](docs/qonto-knative-runtime-contract.md)
|
||||
- [docs/adr/ADR-0001-repository-prefix-architecture.md](docs/adr/ADR-0001-repository-prefix-architecture.md)
|
||||
- [docs/adr/ADR-0002-rail-kubernetes-wave-1-boundary.md](docs/adr/ADR-0002-rail-kubernetes-wave-1-boundary.md)
|
||||
|
|
@ -33,6 +35,8 @@ recorded before they are spread across implementation repos.
|
|||
- [docs/adr/ADR-0006-reef-production-admission.md](docs/adr/ADR-0006-reef-production-admission.md)
|
||||
- [docs/adr/ADR-0007-rapp-declaration-contract.md](docs/adr/ADR-0007-rapp-declaration-contract.md)
|
||||
- [docs/adr/ADR-0008-private-by-default-exposure.md](docs/adr/ADR-0008-private-by-default-exposure.md)
|
||||
- [docs/adr/ADR-0009-netkingdom-security-layer-interaction.md](docs/adr/ADR-0009-netkingdom-security-layer-interaction.md)
|
||||
- [layer.yaml](layer.yaml)
|
||||
|
||||
## Current Explorations
|
||||
|
||||
|
|
|
|||
68
SCOPE.md
68
SCOPE.md
|
|
@ -23,16 +23,17 @@ running deployable under rapp coverage (`ADR-0007`); human acts, credentials,
|
|||
broker actions, and non-deployable infrastructure resources remain outside
|
||||
that meaning.
|
||||
|
||||
This repository now **declares** itself Taxonomy of Railiance workload
|
||||
operations in `INTENT.md` frontmatter (`layer: Taxonomy`, NetKingdom
|
||||
security-layer-model v0.7). It is not a row in the NetKingdom §4 catalog.
|
||||
The machine-readable `layer.yaml` form, a total non-Tooling-client account,
|
||||
and a framework consumption contract for §20.2 are not yet evidenced here.
|
||||
This repository **declares** itself Taxonomy of Railiance workload
|
||||
operations in `INTENT.md` frontmatter and `layer.yaml` (`layer: Taxonomy`,
|
||||
NetKingdom security-layer-model v0.7). It is not a row in the NetKingdom
|
||||
§4 catalog. It is not PEP-shaped. Assent to statute §20 is
|
||||
`docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`.
|
||||
|
||||
The current implementation includes:
|
||||
|
||||
- eight accepted framework ADRs covering repository families, rail composition,
|
||||
production admission, the rapp declaration contract, and exposure posture;
|
||||
- nine accepted framework ADRs covering repository families, rail composition,
|
||||
production admission, the rapp declaration contract, exposure posture, and
|
||||
the NetKingdom security-layer interaction boundary;
|
||||
- framework contracts and migration guidance under `docs/`;
|
||||
- JSON Schemas for rail, rapp, and reef declarations plus a family-declaration
|
||||
validator and fixtures;
|
||||
|
|
@ -86,7 +87,8 @@ not own every implementation implied by them.
|
|||
- PEP stance maps and unreachable-engine behaviour of implementation
|
||||
repositories; this repo is not PEP-shaped
|
||||
- A guessed mapping of rail, rapp, reef, or ownership onto Taxonomy,
|
||||
Tooling, Engine, or Staff — statute §20.3 is unsettled
|
||||
Tooling, Engine, or Staff — statute §20.3 is tracked unanswered in
|
||||
`docs/netkingdom-axis-layer-open-questions.md`
|
||||
- Automatic containment or production observation; both are estate-wide
|
||||
zeros, not this repository's gaps to close
|
||||
|
||||
|
|
@ -107,9 +109,9 @@ not own every implementation implied by them.
|
|||
|
||||
The policy publication corpus from this repo is `docs/adr/*.md`. Workplans,
|
||||
evidence, runbooks, schemas, and general documentation are not policy merely
|
||||
because they are useful. `policy-nexus` currently discovers all eight ADRs, but
|
||||
they remain `metadata-pending` until source lifecycle metadata and explicit
|
||||
publication addressing are completed.
|
||||
because they are useful. `policy-nexus` currently discovers the earlier eight
|
||||
ADRs as `metadata-pending`; ADR-0009 is an additional source record awaiting
|
||||
the same publication addressing.
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -146,20 +148,23 @@ publication addressing are completed.
|
|||
- Status: maintained and evolving
|
||||
- Architecture baseline: four repository axes are materialized and governed by
|
||||
accepted ADRs and contracts
|
||||
- Layer declaration: `INTENT.md` frontmatter declares `layer: Taxonomy`
|
||||
against security-layer-model v0.7; `layer.yaml` and a conformance check are
|
||||
not yet present
|
||||
- Security consumption: ADR-0001 through ADR-0008 do not yet encode the
|
||||
§20.2 rules (one PDP, approvals as claims, credentials after a decision,
|
||||
evidence bound, PEP-shape of implementation runtimes)
|
||||
- Admission (ADR-0006) and exposure (ADR-0008) are live Railiance axes and
|
||||
are not yet demarcated in-repo from authorization decisions
|
||||
- Layer declaration: `INTENT.md` frontmatter and `layer.yaml` declare
|
||||
`layer: Taxonomy` against security-layer-model v0.7; no Tooling contacts;
|
||||
State Hub listed as a non-Tooling client; not PEP-shaped
|
||||
- Security consumption: ADR-0009 and
|
||||
`docs/netkingdom-security-consumption-contract.md` encode the §20.2 rules
|
||||
(one PDP, approvals as claims, credentials after a decision, evidence
|
||||
bound, PEP-shape of implementation runtimes)
|
||||
- Admission (ADR-0006), exposure (ADR-0008), and authorization
|
||||
(`access-engine` via ADR-0009) are demarcated in-repo
|
||||
- Axis-to-layer mapping: five statute §20.3 questions are tracked unanswered
|
||||
in `docs/netkingdom-axis-layer-open-questions.md`; next review 2026-11-29
|
||||
- Validation: rail/rapp/reef schemas and declaration checks are implemented
|
||||
- Active cross-repo work: OpenBao migration closeout remains partially blocked;
|
||||
public-listener retraction is in progress while destructive source cleanup
|
||||
retains separate approval and disaster-recovery gates
|
||||
- Publication: ADR discovery exists in `policy-nexus`; publication metadata and
|
||||
stable addressing remain an open alignment gap
|
||||
stable addressing remain an open alignment gap, now including ADR-0009
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -208,9 +213,13 @@ Intentional deviations and omissions:
|
|||
- Start with: `README.md`, `INTENT.md`, `SCOPE.md`
|
||||
- Architecture entry points: `docs/repository-axes.md`,
|
||||
`docs/reef-substrate-model.md`, `docs/adr/`
|
||||
- NetKingdom interaction: `layer.yaml`,
|
||||
`docs/netkingdom-security-consumption-contract.md`,
|
||||
`docs/netkingdom-axis-layer-open-questions.md`,
|
||||
`docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`
|
||||
- NetKingdom alignment review:
|
||||
`history/260829-demand-netkingdom-security-layer-alignment.md`
|
||||
- Machine-readable contracts: `schemas/`,
|
||||
- Machine-readable contracts: `schemas/`, `layer.yaml`,
|
||||
`tools/validate-family-declarations.py`
|
||||
- Active and historical coordination: `workplans/`, `WORK-RECORDS.md`
|
||||
|
||||
|
|
@ -243,12 +252,11 @@ keywords: [schema, validation, declaration, rail, rapp, reef]
|
|||
|
||||
## Gap to Intent
|
||||
|
||||
The remaining alignment work is to complete downstream ADR publication, cleanly
|
||||
archive completed work without breaking State Hub conventions, retain a
|
||||
repeatable canon-consumer review packet as the architecture evolves, and close
|
||||
the NetKingdom security-layer gap recorded in
|
||||
`history/260829-demand-netkingdom-security-layer-alignment.md` and tracked by
|
||||
`RMASTER-WP-0026`: a machine-readable layer declaration, a §20.2 consumption
|
||||
contract, a vocabulary split between admission/exposure and authorization, and
|
||||
assented answers to the five unsettled axis-to-layer questions. Do not invent
|
||||
the mapping, host a PDP, or take PEP shape in this repository.
|
||||
The remaining alignment work is to complete downstream ADR publication
|
||||
(including ADR-0009), cleanly archive completed work without breaking State
|
||||
Hub conventions, and retain a repeatable canon-consumer review packet as the
|
||||
architecture evolves. The NetKingdom security-layer declaration, §20 assent,
|
||||
consumption contract, and admission/exposure/authorization split are now
|
||||
evidenced. The five axis-to-layer questions remain tracked unanswered until
|
||||
their named reviewers assent; they are not a silent deficit of this
|
||||
repository. Do not invent the mapping, host a PDP, or take PEP shape here.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ title: "Reef Production Admission"
|
|||
status: accepted
|
||||
revision: "accepted-1"
|
||||
owner: railiance-master
|
||||
last_reviewed: "2026-08-15"
|
||||
last_reviewed: "2026-08-29"
|
||||
review_interval: 6m
|
||||
---
|
||||
|
||||
|
|
@ -36,6 +36,11 @@ Who may reach a listener is a different axis:
|
|||
admission does not imply a public surface. A public surface requires
|
||||
this admission **and** an exposure grant.
|
||||
|
||||
Neither admission nor exposure is an authorization decision. Whether an
|
||||
actor may perform an action on a resource is `access-engine`
|
||||
([`ADR-0009`](ADR-0009-netkingdom-security-layer-interaction.md)).
|
||||
`production-approved` MUST NOT be read as permission to act.
|
||||
|
||||
## Consequences
|
||||
|
||||
- `hosts_rail` and `binds_rapp` no longer imply deployability.
|
||||
|
|
@ -44,3 +49,4 @@ this admission **and** an exposure grant.
|
|||
- Repeated evidence collection should become functional automation.
|
||||
- `production-approved` is not permission to publish a listener. See
|
||||
ADR-0008.
|
||||
- `production-approved` is not an authorization decision. See ADR-0009.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ title: "Private-by-default Exposure"
|
|||
status: accepted
|
||||
revision: "accepted-1"
|
||||
owner: railiance-master
|
||||
last_reviewed: "2026-08-15"
|
||||
last_reviewed: "2026-08-29"
|
||||
review_interval: 6m
|
||||
---
|
||||
|
||||
|
|
@ -89,6 +89,9 @@ The detailed per-family reading lives in
|
|||
|
||||
- ADR-0006 still answers "may this binding run in production?" This ADR
|
||||
answers "who may reach the listener?" Do not merge the axes.
|
||||
- Neither question is an authorization decision. Whether an actor may
|
||||
perform an action is `access-engine` ([`ADR-0009`](ADR-0009-netkingdom-security-layer-interaction.md)).
|
||||
`exposure: public` MUST NOT be read as permission to act.
|
||||
- The three readiness enums stay distinct on purpose.
|
||||
- Family schemas grow an additive `exposure` field. Rapp
|
||||
`data_classification: public` is a different field and must not be
|
||||
|
|
|
|||
83
docs/adr/ADR-0009-netkingdom-security-layer-interaction.md
Normal file
83
docs/adr/ADR-0009-netkingdom-security-layer-interaction.md
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
---
|
||||
id: RMASTER-ADR-0009
|
||||
title: "NetKingdom Security-Layer Interaction Boundary"
|
||||
status: accepted
|
||||
revision: "accepted-1"
|
||||
owner: railiance-master
|
||||
last_reviewed: "2026-08-29"
|
||||
review_interval: 6m
|
||||
---
|
||||
|
||||
# ADR-0009: NetKingdom Security-Layer Interaction Boundary
|
||||
|
||||
Date: 2026-08-29
|
||||
Status: Accepted
|
||||
|
||||
## Context
|
||||
|
||||
NetKingdom Security Layer Model v0.7 is accepted. Section 20 restates
|
||||
Railiance workload-operation definitions owned by this repository and
|
||||
states consumption rules every Railiance consumer of NetKingdom security
|
||||
owes. Companion v0.2 §9 is the operative form of the same boundary.
|
||||
|
||||
This repository had declared the four axes and the workload coverage rule
|
||||
in its own voice, but had no machine-readable layer declaration, no
|
||||
recorded assent to §20, and no framework contract that bound rails, rapps,
|
||||
and reefs to those consumption rules. Admission (ADR-0006) and exposure
|
||||
(ADR-0008) were live and were not demarcated from authorization.
|
||||
|
||||
Statute §20.4: an interaction boundary between two frameworks is owned by
|
||||
neither alone. Changes to §20 require this repository's assent for the
|
||||
axis definitions and `glas-harness` assent for the session and tool-policy
|
||||
seam.
|
||||
|
||||
Ratified 2026-08-29 under `RMASTER-WP-0026`.
|
||||
|
||||
## Decision
|
||||
|
||||
1. **This repository is Taxonomy of Railiance workload operations.** The
|
||||
machine-readable declaration is [`layer.yaml`](../../layer.yaml). It is
|
||||
not a NetKingdom §4 catalog row. It is not PEP-shaped. It holds no
|
||||
Tooling-layer client.
|
||||
|
||||
2. **Statute §20.1 restates our definitions and does not author them.**
|
||||
Workload, the four axes, and the rule that `rein-*` is not a fifth axis
|
||||
remain this repository's. NetKingdom may cite them; it may not redefine
|
||||
them without our assent.
|
||||
|
||||
3. **Statute §20.2 is the consumption constitution** for every Railiance
|
||||
consumer of NetKingdom security. The detailed contract is
|
||||
[`docs/netkingdom-security-consumption-contract.md`](../netkingdom-security-consumption-contract.md).
|
||||
|
||||
4. **Statute §20.3 remains unset.** This repository will not imply a
|
||||
mapping of rails, rapps, reefs, or ownership onto Taxonomy, Tooling,
|
||||
Engine, or Staff. The five questions are tracked, unanswered, in
|
||||
[`docs/netkingdom-axis-layer-open-questions.md`](../netkingdom-axis-layer-open-questions.md).
|
||||
|
||||
5. **Admission, exposure, and authorization stay three questions.**
|
||||
ADR-0006 answers whether a binding may run in production. ADR-0008
|
||||
answers who may reach a listener we control. `access-engine` answers
|
||||
whether an actor may perform an action. `production-approved` and
|
||||
`exposure: public` are not authorization decisions.
|
||||
|
||||
6. **Changes to this boundary** require this repository's assent for the
|
||||
axis definitions. Changes that touch the glas-harness seam require
|
||||
`glas-harness` assent as well.
|
||||
|
||||
## Consequences
|
||||
|
||||
- Rails, rapps, and reefs consume `access-engine`, `approval-engine`,
|
||||
`secrets-engine`, and `audit-core`. They do not grow local substitutes.
|
||||
- This repository does not host a PDP, an approval store, a credential
|
||||
plane, an evidence archive, or an actuation surface.
|
||||
- PEP stance maps belong in the repositories that cause protected side
|
||||
effects, inventoried in statute §13.1, not here.
|
||||
- Observation-in-production and automatic containment remain estate-wide
|
||||
zeros. Framework plans must not assume they exist.
|
||||
- `gate-house` can cite this ADR as this repository's own-voice
|
||||
declaration and §20 assent, rather than a review note about us.
|
||||
|
||||
## Notes
|
||||
|
||||
This ADR does not amend ADR-0001 through ADR-0008. It adds the security
|
||||
consumption axis those records did not have to name.
|
||||
|
|
@ -119,6 +119,7 @@ Published on policy.coulomb.social from this repo:
|
|||
| `RMASTER-ADR-0006` | accepted | Reef production admission |
|
||||
| `RMASTER-ADR-0007` | accepted | Rapp declaration contract |
|
||||
| `RMASTER-ADR-0008` | accepted | Private-by-default exposure |
|
||||
| `RMASTER-ADR-0009` | accepted | NetKingdom security-layer interaction |
|
||||
|
||||
Also published from `railiance-platform`: `RPLAT-ADR-0001` (S3 platform
|
||||
services), `RPLAT-ADR-0002` (placement rule), `RPLAT-ADR-0003`
|
||||
|
|
|
|||
|
|
@ -15,6 +15,8 @@ those fields here except to name the objects the validator checks.
|
|||
Admission (ADR-0006) answers "may this binding run in production?"
|
||||
Exposure answers "who may reach the listener?" A
|
||||
`production-approved` binding is still private until a grant exists.
|
||||
Neither is an authorization decision. Whether an actor may perform an
|
||||
action is `access-engine` (ADR-0009).
|
||||
|
||||
## Vocabulary
|
||||
|
||||
|
|
|
|||
50
docs/netkingdom-axis-layer-open-questions.md
Normal file
50
docs/netkingdom-axis-layer-open-questions.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
# Unsettled axis-to-layer questions (statute §20.3)
|
||||
|
||||
Date: 2026-08-29
|
||||
Status: tracked non-answer under ADR-0009 / RMASTER-WP-0026-T05
|
||||
Next review: 2026-11-29
|
||||
|
||||
## Purpose
|
||||
|
||||
Statute §20.3 names five questions about how Railiance axes meet the
|
||||
NetKingdom security-layer model and **deliberately does not answer them**.
|
||||
Guessing a mapping would be worse than admitting the gap.
|
||||
|
||||
This record keeps each question visible, owned, and unanswered. It is not
|
||||
an ADR. A mapping ADR is forbidden until the named reviewers have assented.
|
||||
|
||||
On disagreement the statute governs:
|
||||
`net-kingdom/canon/standards/security-layer-model_v0.7.md` §20.3.
|
||||
|
||||
## Standing non-answer
|
||||
|
||||
For every row below: **unset**. Do not infer an answer from current
|
||||
practice, from a repo prefix, from a Fabric graph edge, or from a
|
||||
declaration field. Implementation repos must not ship a local mapping.
|
||||
|
||||
## The five questions
|
||||
|
||||
| # | Question | Why it is open | Propose | Must review before any ADR | Next review |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| 1 | Identity form of a `rapp-*` as a request-claim resource | A rapp is the most likely *resource* a decision is about, but nothing states its identity form in a claim | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 |
|
||||
| 2 | Whether a `rail-*` contract can carry PEP obligations | PEP shape is most likely to live on a rail, but statute §6.4 attaches to repositories and a rail is a contract | `railiance-master` | `gate-house`; any `rail-*` that is actually PEP-shaped | 2026-11-29 |
|
||||
| 3 | Composition of a `reef-*` with a security zone | A reef answers where a workload is bound; a zone answers which scrutiny it has qualified for. Adjacent is not equal. `zone-engine` already records this as a canon composition problem | `railiance-master` | `zone-engine`, `gate-house` | 2026-11-29 |
|
||||
| 4 | Relation of the `railiance-*` ownership axis to the principal a decision is rendered for | Ownership names who owns a capability. That is adjacent to the subject of a decision, not equal to it | `railiance-master` | `access-engine`, `gate-house` | 2026-11-29 |
|
||||
| 5 | The `glas-harness` / statute §3.4 seam | Tool policy and session semantics are glas-harness's; an agent may act only through a conduit or an Engine API. Neither half is sufficient. This is where "tool availability is not permission" is enforced or lost | `glas-harness` with `railiance-master` | `glas-harness` (required), `gate-house` | 2026-11-29 |
|
||||
|
||||
Question 5 is the highest-consequence of the five. No Railiance ADR may
|
||||
answer it without `glas-harness` assent (statute §20.4).
|
||||
|
||||
## What this record is not
|
||||
|
||||
- a mapping of `rail-*` / `rapp-*` / `reef-*` / `railiance-*` onto
|
||||
Taxonomy, Tooling, Engine, or Staff
|
||||
- a licence for a rail or rapp to invent a local claim shape
|
||||
- a substitute for statute §17 Taxonomy artifacts (request-claim schema,
|
||||
gap-record schema, emission-cadence declaration)
|
||||
|
||||
## Related
|
||||
|
||||
- [ADR-0009](adr/ADR-0009-netkingdom-security-layer-interaction.md)
|
||||
- [Consumption contract](netkingdom-security-consumption-contract.md)
|
||||
- Companion §9: "How the axes map onto the layer model is not settled"
|
||||
87
docs/netkingdom-security-consumption-contract.md
Normal file
87
docs/netkingdom-security-consumption-contract.md
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
# NetKingdom Security Consumption Contract
|
||||
|
||||
Date: 2026-08-29
|
||||
Status: Adopted under ADR-0009 / RMASTER-WP-0026-T03
|
||||
|
||||
## Purpose
|
||||
|
||||
Say what every Railiance rail, rapp, and reef owes when it consumes
|
||||
NetKingdom security, without copying engine schemas or turning this
|
||||
repository into a second decision point.
|
||||
|
||||
The statute is `net-kingdom/canon/standards/security-layer-model_v0.7.md`
|
||||
§20.2 and §6.4. The working companion is `net-kingdom/SECURITY-COMPANION.md`
|
||||
v0.2 §9. On disagreement the statute governs.
|
||||
|
||||
This contract does **not** decide:
|
||||
|
||||
- whether a binding may run in production — that is [ADR-0006](adr/ADR-0006-reef-production-admission.md);
|
||||
- who may reach a listener we control — that is [ADR-0008](adr/ADR-0008-private-by-default-exposure.md);
|
||||
- how the four Railiance axes map onto Taxonomy, Tooling, Engine, and Staff
|
||||
— that remains unset in [the open-questions record](netkingdom-axis-layer-open-questions.md).
|
||||
|
||||
## Three distinct questions
|
||||
|
||||
| Question | Owner | Must not be read as |
|
||||
| --- | --- | --- |
|
||||
| May this binding run in production? | Railiance admission (ADR-0006) | permission for an actor to act |
|
||||
| Who may reach the listener we control? | Railiance exposure (ADR-0008) | an authorization decision |
|
||||
| May this actor perform this action on this resource? | `access-engine` | admission or exposure |
|
||||
|
||||
`production-approved` and `exposure: public` MUST NOT be treated as
|
||||
authorization decisions. Compiled admission or exposure data that resolved
|
||||
whether an actor may act would be statute §6.1 — deciding early.
|
||||
|
||||
## Consumption rules
|
||||
|
||||
For any Railiance consumer of NetKingdom security, without exception:
|
||||
|
||||
1. **Authorization decisions come from `access-engine` and from nowhere
|
||||
else.** No rail, rapp, reef, or ownership repo may render or cache an
|
||||
authorization verdict. A registry, schema, or cache that resolves a
|
||||
result before the engine runs has decided early (statute §6.1).
|
||||
2. **Approvals are objects in `approval-engine`, consumed as claims.**
|
||||
They are not a Railiance axis and not an audit-core verdict. Callers
|
||||
needing current approval state ask `approval-engine`.
|
||||
3. **Credentials are materialized by `secrets-engine` after a decision,
|
||||
never as a substitute for one.** A lease or certificate is an artifact
|
||||
of authority, not its source.
|
||||
4. **Evidence goes to `audit-core` under the bound in statute §9.6.** An
|
||||
archive proves records were not altered or truncated after arrival. It
|
||||
does not prove an event was sent. Absence of a record is not
|
||||
non-occurrence.
|
||||
5. **A runtime that causes a protected side effect is PEP-shaped** and
|
||||
owes statute §6.4 **in its own repository**: no side effect without a
|
||||
decision record or a recorded unreachable-engine stance; no replay
|
||||
outside the decision's binding and lifetime; a published stance map
|
||||
inventoried in statute §13.1; reconstructability within the evidence
|
||||
bound.
|
||||
|
||||
This repository is not PEP-shaped. `layer.yaml` records that. Implementation
|
||||
rails, rapps, and reefs that do cause protected side effects inherit these
|
||||
obligations themselves. This contract does not publish a stance map.
|
||||
|
||||
## What this repository does not host
|
||||
|
||||
- a policy decision point
|
||||
- an approval store
|
||||
- a credential lifecycle API
|
||||
- an evidence archive
|
||||
- an actuation or containment surface
|
||||
|
||||
Observation-in-production and automatic containment are estate-wide zeros
|
||||
(companion §10). Do not plan Railiance operations as if they existed.
|
||||
|
||||
## Engine schemas stay with their owners
|
||||
|
||||
This file names the engines and the rules. It does not restate their
|
||||
request, decision, approval, credential, or evidence schemas. Those
|
||||
contracts live in the owning repositories and, for shared claim
|
||||
vocabulary, in Taxonomy artifacts statute §17 still requires.
|
||||
|
||||
## Related
|
||||
|
||||
- [ADR-0009](adr/ADR-0009-netkingdom-security-layer-interaction.md) — assent
|
||||
- [ADR-0006](adr/ADR-0006-reef-production-admission.md) — admission
|
||||
- [ADR-0008](adr/ADR-0008-private-by-default-exposure.md) — exposure
|
||||
- [Open questions](netkingdom-axis-layer-open-questions.md) — §20.3, unset
|
||||
|
|
@ -14,7 +14,8 @@ requires explicit readiness evidence.
|
|||
This contract does not decide who may reach a listener. That is
|
||||
[`ADR-0008`](adr/ADR-0008-private-by-default-exposure.md). A
|
||||
`production-approved` binding is still private until an exposure grant
|
||||
exists.
|
||||
exists. It also does not decide whether an actor may perform an action.
|
||||
That is `access-engine` ([`ADR-0009`](adr/ADR-0009-netkingdom-security-layer-interaction.md)).
|
||||
|
||||
## Admission States
|
||||
|
||||
|
|
|
|||
54
layer.yaml
Normal file
54
layer.yaml
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
# railiance-master — NetKingdom security layer declaration
|
||||
#
|
||||
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
|
||||
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
|
||||
# Assent: docs/adr/ADR-0009-netkingdom-security-layer-interaction.md
|
||||
#
|
||||
# §11 requires a machine-readable declaration: prose cannot distinguish a
|
||||
# declaration from a transcribed review. Form adapted from the kings-guard
|
||||
# no-contact shape offered under §11.
|
||||
#
|
||||
# This repository produces terms, family contracts, and standards for
|
||||
# workload operations. It owns no runtime position and no state another
|
||||
# layer depends on. It is Taxonomy of Railiance operations, not a row in
|
||||
# the NetKingdom §4 security-estate catalog.
|
||||
#
|
||||
# It is not PEP-shaped: nothing here causes a protected side effect, so
|
||||
# there is no pep_stance path.
|
||||
|
||||
schema_version: "0.1"
|
||||
framework: netkingdom-security-layer-model
|
||||
standard_version: "0.7"
|
||||
repository: railiance-master
|
||||
layer: Taxonomy
|
||||
declared_by: docs/adr/ADR-0009-netkingdom-security-layer-interaction.md
|
||||
declared_at: "2026-08-29"
|
||||
pep_shaped: false
|
||||
|
||||
catalog_entry:
|
||||
note: >-
|
||||
Not a NetKingdom §4 catalog row. This is Railiance operations Taxonomy,
|
||||
not NetKingdom security Taxonomy. info-tech-canon remains ecosystem-wide
|
||||
semantics; net-kingdom remains NetKingdom standards of record.
|
||||
|
||||
# §5 / §11: every direct contact with a Tooling-layer system (a §4 Tooling
|
||||
# row). Empty is a claim: this Taxonomy home holds no OpenBao, key-cape,
|
||||
# or cluster client.
|
||||
tooling_contacts: []
|
||||
|
||||
# §11 requires non-Tooling clients to be recorded so the check is total.
|
||||
non_tooling_clients:
|
||||
- id: state-hub-work-records
|
||||
target: state-hub
|
||||
layer: not-catalogued
|
||||
operation: "HTTP to the Custodian State Hub for work records and progress events"
|
||||
write: true
|
||||
note: >-
|
||||
Outside §5 by the v0.5 scope rule: "Tooling-layer system" means a §4
|
||||
Tooling row, and state-hub is not one. Recorded, not policed. Carries
|
||||
no security authority and no secret payload.
|
||||
|
||||
declared_shapes:
|
||||
"5.1": []
|
||||
"5.2": []
|
||||
"5.3": []
|
||||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Align railiance-master with the NetKingdom security-layer model"
|
||||
domain: financials
|
||||
repo: railiance-master
|
||||
status: ready
|
||||
status: finished
|
||||
owner: grok
|
||||
topic_slug: netkingdom-security-layer-alignment
|
||||
created: "2026-08-29"
|
||||
|
|
@ -43,7 +43,7 @@ Companion: `net-kingdom/SECURITY-COMPANION.md` v0.2.
|
|||
|
||||
```task
|
||||
id: RMASTER-WP-0026-T01
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "fede9ca2-1c38-5e51-aa37-ff1abdfdfcd3"
|
||||
```
|
||||
|
|
@ -66,11 +66,15 @@ declaration file is the §11 surface.
|
|||
**Done when:** `layer.yaml` is committed, agrees with `INTENT.md`, and a
|
||||
reviewer can see there are no Tooling contacts and no PEP claim.
|
||||
|
||||
Completed 2026-08-29. `layer.yaml` declares `layer: Taxonomy` against v0.7,
|
||||
empty `tooling_contacts`, State Hub as the only non-Tooling client,
|
||||
`pep_shaped: false`, and no `pep_stance` path. Frontmatter and file agree.
|
||||
|
||||
## T02 - Record assent to statute §20
|
||||
|
||||
```task
|
||||
id: RMASTER-WP-0026-T02
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "8c7baa43-0050-54ea-978e-6c58a2cb94e6"
|
||||
```
|
||||
|
|
@ -92,11 +96,17 @@ treating this repository as silent.
|
|||
`SCOPE.md`, and a State Hub message (or equivalent durable notice) has been
|
||||
sent to `gate-house`.
|
||||
|
||||
Completed 2026-08-29. Assent is `docs/adr/ADR-0009-netkingdom-security-layer-interaction.md`,
|
||||
cited from INTENT and SCOPE. Notice sent to `gate-house`
|
||||
(`da124e5c-fdc1-415a-bc6f-6a755508c981`), `net-kingdom`
|
||||
(`5d9a1e08-fc86-44a3-81c8-435390f50657`), and `glas-harness`
|
||||
(`f61159ea-d764-476b-a124-2182dc6ed749`) for the §20.3 seam.
|
||||
|
||||
## T03 - Framework consumption contract
|
||||
|
||||
```task
|
||||
id: RMASTER-WP-0026-T03
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "2ecaca39-c14e-567a-a667-d51babec749a"
|
||||
```
|
||||
|
|
@ -118,11 +128,15 @@ Distinguish this contract from ADR-0006 (admission) and ADR-0008 (exposure).
|
|||
**Done when:** the contract is in `docs/`, an ADR cites it, and SCOPE's
|
||||
"security consumption" gap no longer says the eight ADRs are silent on §20.2.
|
||||
|
||||
Completed 2026-08-29. Contract is
|
||||
`docs/netkingdom-security-consumption-contract.md`, cited by ADR-0009. SCOPE
|
||||
Current State names the contract rather than a silence.
|
||||
|
||||
## T04 - Split admission, exposure, and authorization
|
||||
|
||||
```task
|
||||
id: RMASTER-WP-0026-T04
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "73241688-9877-54e8-8498-507efc7a42f4"
|
||||
```
|
||||
|
|
@ -143,11 +157,15 @@ whether an actor may act would be statute §6.1 (deciding early).
|
|||
**Done when:** ADR-0006, ADR-0008, and the T03 contract each point at the
|
||||
split, and no schema field is renamed unless a later ADR requires it.
|
||||
|
||||
Completed 2026-08-29. The three-question table lives in the consumption
|
||||
contract. ADR-0006 and ADR-0008, plus the admission and exposure contracts,
|
||||
point at `access-engine` / ADR-0009. No schema field renamed.
|
||||
|
||||
## T05 - Track the five unsettled §20.3 questions
|
||||
|
||||
```task
|
||||
id: RMASTER-WP-0026-T05
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "7827d59b-66aa-5d8b-8cfc-57024a7e588c"
|
||||
```
|
||||
|
|
@ -173,11 +191,15 @@ decisions. Do not ship a mapping ADR in this workplan.
|
|||
non-answer, and SCOPE lists them as tracked rather than as missing
|
||||
architecture.
|
||||
|
||||
Completed 2026-08-29. `docs/netkingdom-axis-layer-open-questions.md` tracks
|
||||
all five with owners, 2026-11-29 review, and standing non-answer "unset".
|
||||
Question 5 requires `glas-harness` assent. No mapping ADR shipped.
|
||||
|
||||
## T06 - Close the SCOPE gap for this alignment
|
||||
|
||||
```task
|
||||
id: RMASTER-WP-0026-T06
|
||||
status: todo
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "6452ba15-0918-5907-a78d-b3d101e82060"
|
||||
```
|
||||
|
|
@ -191,6 +213,10 @@ T03 are open.
|
|||
match the files on disk, and this workplan can move to `finished` without
|
||||
leaving silent follow-on work.
|
||||
|
||||
Completed 2026-08-29. SCOPE Current State and Gap to Intent describe the
|
||||
evidenced artifacts. Remaining work is publication addressing and the
|
||||
tracked §20.3 questions, not a missing declaration.
|
||||
|
||||
## Sequencing
|
||||
|
||||
T01 can proceed immediately. T02 and T03 are the load-bearing pair; T04 may
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue