docs(reuse): establish reviewed NetKingdom security capabilities
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
parent
d379a3dfba
commit
6bd7129eac
3 changed files with 125 additions and 132 deletions
|
|
@ -1,121 +0,0 @@
|
|||
---
|
||||
id: capability.infotech.repo-template
|
||||
name: Coulomb Repository Template
|
||||
summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.
|
||||
owner: repo-seed
|
||||
status: draft
|
||||
domain: infotech
|
||||
tags:
|
||||
- template
|
||||
- bootstrap
|
||||
- state-hub
|
||||
- onboarding
|
||||
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: >
|
||||
Template purpose, consumer guide, and validation checklist are documented.
|
||||
Scope boundaries are explicit in SCOPE.md.
|
||||
availability:
|
||||
current: A3
|
||||
target: A4
|
||||
confidence: medium
|
||||
rationale: >
|
||||
Consumers clone or copy repo-seed and run statehub register. Template
|
||||
files are markdown/git artifacts without a hosted provisioning API.
|
||||
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C2
|
||||
confidence: medium
|
||||
basis: scope_vs_intent_and_consumer_expectations
|
||||
satisfied_expectations:
|
||||
- agent instruction scaffold (AGENTS.md, CLAUDE.md, .claude/rules/)
|
||||
- registry directory scaffold
|
||||
- statehub register consumer documentation
|
||||
- template validation checklist for bootstrap verification
|
||||
- bootstrap workplan pattern (WP-0001)
|
||||
broken_expectations: []
|
||||
out_of_scope_expectations:
|
||||
- automated repo creation on Gitea
|
||||
- runtime application code generation
|
||||
reliability:
|
||||
level: R2
|
||||
confidence: medium
|
||||
basis: consumer_quality_signals
|
||||
known_reliability_risks:
|
||||
- register output evolves with state-hub releases; checklist must be revalidated
|
||||
- LLM inference path depends on llm-connect availability
|
||||
|
||||
discovery:
|
||||
intent: >
|
||||
Give new Coulomb repositories a consistent starting point for agent
|
||||
coordination, capability registry growth, and State Hub workplan tracking.
|
||||
includes:
|
||||
- git template files for agent instructions and registry scaffold
|
||||
- documentation for statehub register usage
|
||||
- consumer validation checklist
|
||||
- bootstrap workplan convention
|
||||
excludes:
|
||||
- application runtime implementation
|
||||
- owning downstream project code
|
||||
assumptions:
|
||||
- consumers have access to state-hub CLI and API
|
||||
- workplans remain canonical in repo files (ADR-001)
|
||||
use_cases: []
|
||||
research_memos:
|
||||
- docs/statehub-register.md
|
||||
- docs/template-validation-checklist.md
|
||||
|
||||
availability:
|
||||
current_level: A3
|
||||
target_level: A4
|
||||
current_artifacts:
|
||||
- README.md
|
||||
- AGENTS.md
|
||||
- CLAUDE.md
|
||||
- .claude/rules/
|
||||
- registry/
|
||||
- docs/statehub-register.md
|
||||
- docs/template-validation-checklist.md
|
||||
consumption_modes:
|
||||
- git clone
|
||||
- informational
|
||||
|
||||
relations:
|
||||
depends_on:
|
||||
- capability.statehub.workstream-coordinate
|
||||
supports: []
|
||||
related_to:
|
||||
- capability.registry.register
|
||||
|
||||
evidence:
|
||||
documentation:
|
||||
- docs/statehub-register.md
|
||||
- docs/template-validation-checklist.md
|
||||
- SCOPE.md
|
||||
tests: []
|
||||
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- bootstrapping new Coulomb domain repositories
|
||||
- standardizing agent onboarding and workplan conventions
|
||||
not_recommended_for:
|
||||
- repos that already have mature agent instructions and hub registration
|
||||
- application templates with heavy code generation requirements
|
||||
known_limitations:
|
||||
- register must be run separately after cloning
|
||||
- fix-consistency requires operator access to state-hub checkout
|
||||
---
|
||||
|
||||
# Coulomb Repository Template
|
||||
|
||||
`repo-seed` is the canonical git template for new Coulomb repositories. Clone it,
|
||||
run `statehub register`, complete the bootstrap workplan, and sync with
|
||||
`make fix-consistency`.
|
||||
|
||||
See `docs/statehub-register.md` for the consumer workflow and
|
||||
`docs/template-validation-checklist.md` for verification steps.
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
---
|
||||
id: capability.security.credential-lifecycle
|
||||
owner: secrets-engine
|
||||
status: draft
|
||||
domain: infotech
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D5
|
||||
confidence: medium
|
||||
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||
are documented; no exhaustive or generalized maturity claim.
|
||||
availability:
|
||||
current: A2
|
||||
target: A2
|
||||
confidence: medium
|
||||
rationale: 'Source interface assessed 2026-10-14: CLI catalog, plan, exact OpenBao
|
||||
metadata apply, provisioning, verification, delivery and revoke. Availability
|
||||
describes the delivery form, not production acceptance. Production protected
|
||||
execution and independently anchored PDP authentication remain incomplete.'
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||
assessment in this review.
|
||||
reliability:
|
||||
level: R0
|
||||
confidence: low
|
||||
basis: No longitudinal consumer reliability measurement established by this review.
|
||||
name: Cataloged credential lifecycle
|
||||
summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
|
||||
delivery and revoke.
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
discovery:
|
||||
intent: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
|
||||
delivery and revoke
|
||||
includes:
|
||||
- CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery
|
||||
and revoke
|
||||
excludes:
|
||||
- Production protected execution and independently anchored PDP authentication remain
|
||||
incomplete
|
||||
use_cases:
|
||||
- 'U04: Protected operation obtains and consumes exact human approval before its
|
||||
side effect'
|
||||
- 'U05: Operator provisions and delivers a scoped workload credential through the
|
||||
approved owner lane'
|
||||
- 'U07: Owner inventories, rotates, revokes and detects exposure of credentials'
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A2
|
||||
current_artifacts:
|
||||
- SCOPE.md
|
||||
- src/secrets_engine/decision_check.py
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
relations:
|
||||
related_to:
|
||||
- capability.security.approval-lifecycle
|
||||
- capability.authorization.policy-evaluate
|
||||
- capability.railiance.platform-services
|
||||
- capability.security.ssh-certificate-issuance
|
||||
evidence:
|
||||
documentation:
|
||||
- SCOPE.md
|
||||
- src/secrets_engine/decision_check.py
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Protected operation obtains and consumes exact human approval before its side
|
||||
effect
|
||||
- Operator provisions and delivers a scoped workload credential through the approved
|
||||
owner lane
|
||||
- Owner inventories, rotates, revokes and detects exposure of credentials
|
||||
not_recommended_for:
|
||||
- Production protected execution and independently anchored PDP authentication remain
|
||||
incomplete
|
||||
known_limitations:
|
||||
- Production protected execution and independently anchored PDP authentication remain
|
||||
incomplete
|
||||
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||
entry does not authorize execution or establish deployment.
|
||||
---
|
||||
|
||||
# Cataloged credential lifecycle
|
||||
|
||||
CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.
|
||||
|
||||
## Reuse boundary
|
||||
|
||||
Production protected execution and independently anchored PDP authentication remain incomplete.
|
||||
|
||||
## Supported use cases
|
||||
|
||||
- U04: Protected operation obtains and consumes exact human approval before its side effect
|
||||
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
|
||||
- U07: Owner inventories, rotates, revokes and detects exposure of credentials
|
||||
|
||||
## Evidence and integration
|
||||
|
||||
- [SCOPE.md](../../SCOPE.md)
|
||||
- [src/secrets_engine/decision_check.py](../../src/secrets_engine/decision_check.py)
|
||||
|
||||
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||
|
|
@ -1,14 +1,20 @@
|
|||
version: 1
|
||||
updated: '2026-06-24'
|
||||
updated: '2026-10-14'
|
||||
domain: infotech
|
||||
capabilities:
|
||||
- id: capability.infotech.repo-template
|
||||
name: Coulomb Repository Template
|
||||
summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.
|
||||
vector: D3 / A3 / C2 / R2
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: repo-seed
|
||||
path: registry/capabilities/capability.infotech.repo-template.md
|
||||
tags: [template, bootstrap, state-hub, onboarding]
|
||||
consumption_modes: [git clone, informational]
|
||||
- id: capability.security.credential-lifecycle
|
||||
name: Cataloged credential lifecycle
|
||||
summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
|
||||
delivery and revoke.
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: secrets-engine
|
||||
tags:
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A2 / C1 / R0
|
||||
path: registry/capabilities/capability.security.credential-lifecycle.md
|
||||
consumption_modes:
|
||||
- CLI
|
||||
- source
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue