From 6bd7129eac94131b4cf689e47cbdc9899418beb3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 14 Oct 2026 06:45:46 +0200 Subject: [PATCH] docs(reuse): establish reviewed NetKingdom security capabilities Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684 --- .../capability.infotech.repo-template.md | 121 ------------------ ...apability.security.credential-lifecycle.md | 108 ++++++++++++++++ registry/indexes/capabilities.yaml | 28 ++-- 3 files changed, 125 insertions(+), 132 deletions(-) delete mode 100644 registry/capabilities/capability.infotech.repo-template.md create mode 100644 registry/capabilities/capability.security.credential-lifecycle.md diff --git a/registry/capabilities/capability.infotech.repo-template.md b/registry/capabilities/capability.infotech.repo-template.md deleted file mode 100644 index 5ee0399..0000000 --- a/registry/capabilities/capability.infotech.repo-template.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -id: capability.infotech.repo-template -name: Coulomb Repository Template -summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions. -owner: repo-seed -status: draft -domain: infotech -tags: - - template - - bootstrap - - state-hub - - onboarding - -maturity: - discovery: - current: D3 - target: D5 - confidence: medium - rationale: > - Template purpose, consumer guide, and validation checklist are documented. - Scope boundaries are explicit in SCOPE.md. - availability: - current: A3 - target: A4 - confidence: medium - rationale: > - Consumers clone or copy repo-seed and run statehub register. Template - files are markdown/git artifacts without a hosted provisioning API. - -external_evidence: - completeness: - level: C2 - confidence: medium - basis: scope_vs_intent_and_consumer_expectations - satisfied_expectations: - - agent instruction scaffold (AGENTS.md, CLAUDE.md, .claude/rules/) - - registry directory scaffold - - statehub register consumer documentation - - template validation checklist for bootstrap verification - - bootstrap workplan pattern (WP-0001) - broken_expectations: [] - out_of_scope_expectations: - - automated repo creation on Gitea - - runtime application code generation - reliability: - level: R2 - confidence: medium - basis: consumer_quality_signals - known_reliability_risks: - - register output evolves with state-hub releases; checklist must be revalidated - - LLM inference path depends on llm-connect availability - -discovery: - intent: > - Give new Coulomb repositories a consistent starting point for agent - coordination, capability registry growth, and State Hub workplan tracking. - includes: - - git template files for agent instructions and registry scaffold - - documentation for statehub register usage - - consumer validation checklist - - bootstrap workplan convention - excludes: - - application runtime implementation - - owning downstream project code - assumptions: - - consumers have access to state-hub CLI and API - - workplans remain canonical in repo files (ADR-001) - use_cases: [] - research_memos: - - docs/statehub-register.md - - docs/template-validation-checklist.md - -availability: - current_level: A3 - target_level: A4 - current_artifacts: - - README.md - - AGENTS.md - - CLAUDE.md - - .claude/rules/ - - registry/ - - docs/statehub-register.md - - docs/template-validation-checklist.md - consumption_modes: - - git clone - - informational - -relations: - depends_on: - - capability.statehub.workstream-coordinate - supports: [] - related_to: - - capability.registry.register - -evidence: - documentation: - - docs/statehub-register.md - - docs/template-validation-checklist.md - - SCOPE.md - tests: [] - -consumer_guidance: - recommended_for: - - bootstrapping new Coulomb domain repositories - - standardizing agent onboarding and workplan conventions - not_recommended_for: - - repos that already have mature agent instructions and hub registration - - application templates with heavy code generation requirements - known_limitations: - - register must be run separately after cloning - - fix-consistency requires operator access to state-hub checkout ---- - -# Coulomb Repository Template - -`repo-seed` is the canonical git template for new Coulomb repositories. Clone it, -run `statehub register`, complete the bootstrap workplan, and sync with -`make fix-consistency`. - -See `docs/statehub-register.md` for the consumer workflow and -`docs/template-validation-checklist.md` for verification steps. \ No newline at end of file diff --git a/registry/capabilities/capability.security.credential-lifecycle.md b/registry/capabilities/capability.security.credential-lifecycle.md new file mode 100644 index 0000000..b9c5232 --- /dev/null +++ b/registry/capabilities/capability.security.credential-lifecycle.md @@ -0,0 +1,108 @@ +--- +id: capability.security.credential-lifecycle +owner: secrets-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CLI catalog, plan, exact OpenBao + metadata apply, provisioning, verification, delivery and revoke. Availability + describes the delivery form, not production acceptance. Production protected + execution and independently anchored PDP authentication remain incomplete.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Cataloged credential lifecycle +summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke + includes: + - CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery + and revoke + excludes: + - Production protected execution and independently anchored PDP authentication remain + incomplete + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - src/secrets_engine/decision_check.py + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.approval-lifecycle + - capability.authorization.policy-evaluate + - capability.railiance.platform-services + - capability.security.ssh-certificate-issuance +evidence: + documentation: + - SCOPE.md + - src/secrets_engine/decision_check.py +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Owner inventories, rotates, revokes and detects exposure of credentials + not_recommended_for: + - Production protected execution and independently anchored PDP authentication remain + incomplete + known_limitations: + - Production protected execution and independently anchored PDP authentication remain + incomplete + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Cataloged credential lifecycle + +CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke. + +## Reuse boundary + +Production protected execution and independently anchored PDP authentication remain incomplete. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U07: Owner inventories, rotates, revokes and detects exposure of credentials + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [src/secrets_engine/decision_check.py](../../src/secrets_engine/decision_check.py) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 359c385..aad3b05 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,14 +1,20 @@ version: 1 -updated: '2026-06-24' +updated: '2026-10-14' domain: infotech capabilities: - - id: capability.infotech.repo-template - name: Coulomb Repository Template - summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions. - vector: D3 / A3 / C2 / R2 - domain: infotech - status: draft - owner: repo-seed - path: registry/capabilities/capability.infotech.repo-template.md - tags: [template, bootstrap, state-hub, onboarding] - consumption_modes: [git clone, informational] \ No newline at end of file +- id: capability.security.credential-lifecycle + name: Cataloged credential lifecycle + summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke. + domain: infotech + status: draft + owner: secrets-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.credential-lifecycle.md + consumption_modes: + - CLI + - source