tegwick
1945e16685
Replace the gate-house review note with this repository's own declaration: INTENT.md frontmatter, layer.yaml, and a published PEP stance map. SCOPE.md and agent boundary docs now match that layer. The review under history/ identifies the implementation remainder; SECRETS-WP-0008 is the follow-on workplan. SECRETS-IN-0001 is closed. The layer is not contested. Catalog "custody" is a finding: OpenBao owns custody, this engine owns the lifecycle API over it. SSH-CA signing is accepted as a proposed engine API and declined as a Staff lane. Assistant: grok Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
15 lines
757 B
Markdown
15 lines
757 B
Markdown
## Repo boundary
|
|
|
|
This repo owns the **secrets-engine** Lifecycle engine only (NetKingdom
|
|
security layer model v0.7: Engine / Lifecycle). It does not own:
|
|
|
|
- Secret custody, policy, lease, and audit backend → OpenBao / railiance-platform
|
|
- SSH certificate issuance (Staff PEP) → ops-warden (`warden sign`)
|
|
- Tunnels and remote transport → ops-bridge
|
|
- Authorization decisions → access-engine (`flex-auth`)
|
|
- Approval objects → approval-engine
|
|
- Evidence custody and integrity → audit-core
|
|
- Identity and claim lifecycle → user-engine / key-cape
|
|
- Security doctrine and the layer model → gate-house / net-kingdom canon
|
|
- Cross-system security boundary doc → net-kingdom/docs/
|
|
- Request history and progress index → State Hub (read model)
|