docs(reuse): establish reviewed NetKingdom security capabilities
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
This commit is contained in:
parent
d379a3dfba
commit
6bd7129eac
3 changed files with 125 additions and 132 deletions
|
|
@ -1,121 +0,0 @@
|
||||||
---
|
|
||||||
id: capability.infotech.repo-template
|
|
||||||
name: Coulomb Repository Template
|
|
||||||
summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.
|
|
||||||
owner: repo-seed
|
|
||||||
status: draft
|
|
||||||
domain: infotech
|
|
||||||
tags:
|
|
||||||
- template
|
|
||||||
- bootstrap
|
|
||||||
- state-hub
|
|
||||||
- onboarding
|
|
||||||
|
|
||||||
maturity:
|
|
||||||
discovery:
|
|
||||||
current: D3
|
|
||||||
target: D5
|
|
||||||
confidence: medium
|
|
||||||
rationale: >
|
|
||||||
Template purpose, consumer guide, and validation checklist are documented.
|
|
||||||
Scope boundaries are explicit in SCOPE.md.
|
|
||||||
availability:
|
|
||||||
current: A3
|
|
||||||
target: A4
|
|
||||||
confidence: medium
|
|
||||||
rationale: >
|
|
||||||
Consumers clone or copy repo-seed and run statehub register. Template
|
|
||||||
files are markdown/git artifacts without a hosted provisioning API.
|
|
||||||
|
|
||||||
external_evidence:
|
|
||||||
completeness:
|
|
||||||
level: C2
|
|
||||||
confidence: medium
|
|
||||||
basis: scope_vs_intent_and_consumer_expectations
|
|
||||||
satisfied_expectations:
|
|
||||||
- agent instruction scaffold (AGENTS.md, CLAUDE.md, .claude/rules/)
|
|
||||||
- registry directory scaffold
|
|
||||||
- statehub register consumer documentation
|
|
||||||
- template validation checklist for bootstrap verification
|
|
||||||
- bootstrap workplan pattern (WP-0001)
|
|
||||||
broken_expectations: []
|
|
||||||
out_of_scope_expectations:
|
|
||||||
- automated repo creation on Gitea
|
|
||||||
- runtime application code generation
|
|
||||||
reliability:
|
|
||||||
level: R2
|
|
||||||
confidence: medium
|
|
||||||
basis: consumer_quality_signals
|
|
||||||
known_reliability_risks:
|
|
||||||
- register output evolves with state-hub releases; checklist must be revalidated
|
|
||||||
- LLM inference path depends on llm-connect availability
|
|
||||||
|
|
||||||
discovery:
|
|
||||||
intent: >
|
|
||||||
Give new Coulomb repositories a consistent starting point for agent
|
|
||||||
coordination, capability registry growth, and State Hub workplan tracking.
|
|
||||||
includes:
|
|
||||||
- git template files for agent instructions and registry scaffold
|
|
||||||
- documentation for statehub register usage
|
|
||||||
- consumer validation checklist
|
|
||||||
- bootstrap workplan convention
|
|
||||||
excludes:
|
|
||||||
- application runtime implementation
|
|
||||||
- owning downstream project code
|
|
||||||
assumptions:
|
|
||||||
- consumers have access to state-hub CLI and API
|
|
||||||
- workplans remain canonical in repo files (ADR-001)
|
|
||||||
use_cases: []
|
|
||||||
research_memos:
|
|
||||||
- docs/statehub-register.md
|
|
||||||
- docs/template-validation-checklist.md
|
|
||||||
|
|
||||||
availability:
|
|
||||||
current_level: A3
|
|
||||||
target_level: A4
|
|
||||||
current_artifacts:
|
|
||||||
- README.md
|
|
||||||
- AGENTS.md
|
|
||||||
- CLAUDE.md
|
|
||||||
- .claude/rules/
|
|
||||||
- registry/
|
|
||||||
- docs/statehub-register.md
|
|
||||||
- docs/template-validation-checklist.md
|
|
||||||
consumption_modes:
|
|
||||||
- git clone
|
|
||||||
- informational
|
|
||||||
|
|
||||||
relations:
|
|
||||||
depends_on:
|
|
||||||
- capability.statehub.workstream-coordinate
|
|
||||||
supports: []
|
|
||||||
related_to:
|
|
||||||
- capability.registry.register
|
|
||||||
|
|
||||||
evidence:
|
|
||||||
documentation:
|
|
||||||
- docs/statehub-register.md
|
|
||||||
- docs/template-validation-checklist.md
|
|
||||||
- SCOPE.md
|
|
||||||
tests: []
|
|
||||||
|
|
||||||
consumer_guidance:
|
|
||||||
recommended_for:
|
|
||||||
- bootstrapping new Coulomb domain repositories
|
|
||||||
- standardizing agent onboarding and workplan conventions
|
|
||||||
not_recommended_for:
|
|
||||||
- repos that already have mature agent instructions and hub registration
|
|
||||||
- application templates with heavy code generation requirements
|
|
||||||
known_limitations:
|
|
||||||
- register must be run separately after cloning
|
|
||||||
- fix-consistency requires operator access to state-hub checkout
|
|
||||||
---
|
|
||||||
|
|
||||||
# Coulomb Repository Template
|
|
||||||
|
|
||||||
`repo-seed` is the canonical git template for new Coulomb repositories. Clone it,
|
|
||||||
run `statehub register`, complete the bootstrap workplan, and sync with
|
|
||||||
`make fix-consistency`.
|
|
||||||
|
|
||||||
See `docs/statehub-register.md` for the consumer workflow and
|
|
||||||
`docs/template-validation-checklist.md` for verification steps.
|
|
||||||
|
|
@ -0,0 +1,108 @@
|
||||||
|
---
|
||||||
|
id: capability.security.credential-lifecycle
|
||||||
|
owner: secrets-engine
|
||||||
|
status: draft
|
||||||
|
domain: infotech
|
||||||
|
maturity:
|
||||||
|
discovery:
|
||||||
|
current: D3
|
||||||
|
target: D5
|
||||||
|
confidence: medium
|
||||||
|
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
|
||||||
|
are documented; no exhaustive or generalized maturity claim.
|
||||||
|
availability:
|
||||||
|
current: A2
|
||||||
|
target: A2
|
||||||
|
confidence: medium
|
||||||
|
rationale: 'Source interface assessed 2026-10-14: CLI catalog, plan, exact OpenBao
|
||||||
|
metadata apply, provisioning, verification, delivery and revoke. Availability
|
||||||
|
describes the delivery form, not production acceptance. Production protected
|
||||||
|
execution and independently anchored PDP authentication remain incomplete.'
|
||||||
|
external_evidence:
|
||||||
|
completeness:
|
||||||
|
level: C1
|
||||||
|
confidence: low
|
||||||
|
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
|
||||||
|
assessment in this review.
|
||||||
|
reliability:
|
||||||
|
level: R0
|
||||||
|
confidence: low
|
||||||
|
basis: No longitudinal consumer reliability measurement established by this review.
|
||||||
|
name: Cataloged credential lifecycle
|
||||||
|
summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
|
||||||
|
delivery and revoke.
|
||||||
|
tags:
|
||||||
|
- security
|
||||||
|
- netkingdom
|
||||||
|
- framework-reuse
|
||||||
|
discovery:
|
||||||
|
intent: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
|
||||||
|
delivery and revoke
|
||||||
|
includes:
|
||||||
|
- CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery
|
||||||
|
and revoke
|
||||||
|
excludes:
|
||||||
|
- Production protected execution and independently anchored PDP authentication remain
|
||||||
|
incomplete
|
||||||
|
use_cases:
|
||||||
|
- 'U04: Protected operation obtains and consumes exact human approval before its
|
||||||
|
side effect'
|
||||||
|
- 'U05: Operator provisions and delivers a scoped workload credential through the
|
||||||
|
approved owner lane'
|
||||||
|
- 'U07: Owner inventories, rotates, revokes and detects exposure of credentials'
|
||||||
|
availability:
|
||||||
|
current_level: A2
|
||||||
|
target_level: A2
|
||||||
|
current_artifacts:
|
||||||
|
- SCOPE.md
|
||||||
|
- src/secrets_engine/decision_check.py
|
||||||
|
consumption_modes:
|
||||||
|
- CLI
|
||||||
|
- source
|
||||||
|
relations:
|
||||||
|
related_to:
|
||||||
|
- capability.security.approval-lifecycle
|
||||||
|
- capability.authorization.policy-evaluate
|
||||||
|
- capability.railiance.platform-services
|
||||||
|
- capability.security.ssh-certificate-issuance
|
||||||
|
evidence:
|
||||||
|
documentation:
|
||||||
|
- SCOPE.md
|
||||||
|
- src/secrets_engine/decision_check.py
|
||||||
|
consumer_guidance:
|
||||||
|
recommended_for:
|
||||||
|
- Protected operation obtains and consumes exact human approval before its side
|
||||||
|
effect
|
||||||
|
- Operator provisions and delivers a scoped workload credential through the approved
|
||||||
|
owner lane
|
||||||
|
- Owner inventories, rotates, revokes and detects exposure of credentials
|
||||||
|
not_recommended_for:
|
||||||
|
- Production protected execution and independently anchored PDP authentication remain
|
||||||
|
incomplete
|
||||||
|
known_limitations:
|
||||||
|
- Production protected execution and independently anchored PDP authentication remain
|
||||||
|
incomplete
|
||||||
|
- 2026-10-14 architecture review estimates operational maturity separately; a registry
|
||||||
|
entry does not authorize execution or establish deployment.
|
||||||
|
---
|
||||||
|
|
||||||
|
# Cataloged credential lifecycle
|
||||||
|
|
||||||
|
CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.
|
||||||
|
|
||||||
|
## Reuse boundary
|
||||||
|
|
||||||
|
Production protected execution and independently anchored PDP authentication remain incomplete.
|
||||||
|
|
||||||
|
## Supported use cases
|
||||||
|
|
||||||
|
- U04: Protected operation obtains and consumes exact human approval before its side effect
|
||||||
|
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
|
||||||
|
- U07: Owner inventories, rotates, revokes and detects exposure of credentials
|
||||||
|
|
||||||
|
## Evidence and integration
|
||||||
|
|
||||||
|
- [SCOPE.md](../../SCOPE.md)
|
||||||
|
- [src/secrets_engine/decision_check.py](../../src/secrets_engine/decision_check.py)
|
||||||
|
|
||||||
|
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
|
||||||
|
|
@ -1,14 +1,20 @@
|
||||||
version: 1
|
version: 1
|
||||||
updated: '2026-06-24'
|
updated: '2026-10-14'
|
||||||
domain: infotech
|
domain: infotech
|
||||||
capabilities:
|
capabilities:
|
||||||
- id: capability.infotech.repo-template
|
- id: capability.security.credential-lifecycle
|
||||||
name: Coulomb Repository Template
|
name: Cataloged credential lifecycle
|
||||||
summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.
|
summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
|
||||||
vector: D3 / A3 / C2 / R2
|
delivery and revoke.
|
||||||
domain: infotech
|
domain: infotech
|
||||||
status: draft
|
status: draft
|
||||||
owner: repo-seed
|
owner: secrets-engine
|
||||||
path: registry/capabilities/capability.infotech.repo-template.md
|
tags:
|
||||||
tags: [template, bootstrap, state-hub, onboarding]
|
- security
|
||||||
consumption_modes: [git clone, informational]
|
- netkingdom
|
||||||
|
- framework-reuse
|
||||||
|
vector: D3 / A2 / C1 / R0
|
||||||
|
path: registry/capabilities/capability.security.credential-lifecycle.md
|
||||||
|
consumption_modes:
|
||||||
|
- CLI
|
||||||
|
- source
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue