tegwick
5b48033bce
Token scope is now bound to package maturity, gated on netkingdom's own maturity: - maturity-build -> gitea-wide, maturity-test -> org-wide, maturity-prod -> repo-scoped (scope narrows as stakes rise; broad tokens only for low-stakes build artifacts) - the graduated table is DORMANT until netkingdom reaches production grade; until then every lane clamps to repo-scope, injected as NPM_AUTH_TOKEN (fail-safe) - token env-var name signals blast radius: NPM_AUTH_TOKEN (repo default), NPM_AUTH_COULOMB_TOKEN (org), NPM_AUTH_GITEA_TOKEN (gitea), NPM_AUTH_WHYNOT_TOKEN (npm scope, defined but unused), NPM_AUTH_WHYNOTDESIGN (explicit repo) netkingdom is at maturity-build today, so whynot-design resolves to repo-scope / NPM_AUTH_TOKEN. Flip netkingdom_maturity to maturity-prod to activate graduation. - policies/netkingdom-publication-scope.yaml: the policy data + gate - publication_policy.py: load + resolve (clamp/active, env naming, override) - exec delivery injects under the resolved env-var name (was fixed SE_NPM_TOKEN) - catalog lane carries delivery_config.npm.maturity - new CLI: `secrets-engine policy publication <lane>` - docs/publication-scope-policy.md; tests for clamp, graduation, naming, override Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
2.1 KiB
YAML
46 lines
2.1 KiB
YAML
# Publication-scope policy — owned by the netkingdom security-infrastructure domain,
|
|
# enforced by secrets-engine.
|
|
#
|
|
# Binds npm package *publication scope* to package *maturity*, and GATES the
|
|
# graduated (relaxed) scoping behind netkingdom itself reaching production grade.
|
|
#
|
|
# Design intent (proves policy-bound secret handling):
|
|
# - A repo's maturity translates into the maturity tag of the package it ships
|
|
# (maturity-build / maturity-test / maturity-prod).
|
|
# - Each maturity tag is restricted by the publication scope its token carries.
|
|
# - Low-stakes build artifacts may publish with a BROAD shared token; high-stakes
|
|
# production publishes require a TIGHT, repo-scoped token. Scope narrows as
|
|
# stakes rise.
|
|
# - The graduated table is DORMANT until netkingdom is production grade. While
|
|
# dormant, every lane clamps to the safest scope (repo) — fail-safe, never
|
|
# fail-open.
|
|
domain: netkingdom
|
|
policy: publication-scope
|
|
version: "0.1.0"
|
|
|
|
# netkingdom's own maturity. `production_grade` is derived: it is true only when
|
|
# this equals "maturity-prod". Today netkingdom is at maturity-build.
|
|
netkingdom_maturity: maturity-build
|
|
|
|
# When ACTIVE (production_grade == true): package maturity tag -> required scope.
|
|
maturity_scope:
|
|
maturity-build: gitea # gitea-wide publication rights
|
|
maturity-test: org # org-wide publication rights
|
|
maturity-prod: repo # repo-scoped publication rights
|
|
|
|
# Safe scope applied while DORMANT, and the floor that cannot be exceeded before
|
|
# netkingdom is production grade.
|
|
dormant_scope: repo
|
|
|
|
# Token env-var naming convention by effective scope. {ORG}/{SCOPE}/{REPO} are
|
|
# upper-cased, de-hyphenated forms of the lane's org / npm-scope / repo.
|
|
# org coulomb -> COULOMB
|
|
# scope @whynot -> WHYNOT (npm scope = "project"; defined, NOT used by policy)
|
|
# repo whynot-design -> WHYNOTDESIGN
|
|
# The default repo-scope name is the bare NPM_AUTH_TOKEN; the explicit per-repo
|
|
# form (NPM_AUTH_{REPO}) is available when a lane overrides it.
|
|
token_env:
|
|
gitea: "NPM_AUTH_GITEA_TOKEN"
|
|
org: "NPM_AUTH_{ORG}_TOKEN"
|
|
scope: "NPM_AUTH_{SCOPE}_TOKEN"
|
|
repo: "NPM_AUTH_TOKEN"
|