security-canon/AGENTS.md

# Agent instructions — security-canon

## Repo Identity

**Purpose:** Orthogonal vocabulary and canonical model for security-related concepts, extending InfoTechCanon.

**Domain:** infotech
**Repo slug:** security-canon
**Topic ID:** `fe2aaa78-9c20-4feb-b3d2-4fe0529572a3`
**Workplan prefix:** `SECURITY-WP-`
**Upstream canon:** info-tech-canon

Orient: INTENT.md → SCOPE.md → workplans/.


## State Hub Integration

<!-- BEGIN STATE-HUB-ACCESS -->
| Context | URL |
|---------|-----|
| Local workstation | `http://127.0.0.1:8000` |
| Remote (railiance01, in-cluster) | `http://10.43.68.154:8000` |
| Optional local edge relay | `http://127.0.0.1:18080` |

Do not instruct a remote agent to use `http://127.0.0.1:18000`. That reverse tunnel is retired; on railiance01 reach the hub at the in-cluster address above.
<!-- END STATE-HUB-ACCESS -->

## Cross-repo waits

If blocked on another repo, look for a `prj-` driver workplan and follow `coordination-engine` `spec/cross-owner-wait-mode-v0.1.md`. Do not mint a stranded `wait`, implement `flavor: residual`, or message `ops-warden` for secrets.
Bootstrap security-canon governance and extraction plan Scaffold the repository to the repo-manager standard and establish its governance surface: INTENT declaring the Taxonomy-layer claim and boundary against NetKingdom, flex-auth, key-cape, OpenBao and whitehat-security; GOAL with migration invariants and success gates; SCOPE listing the extraction candidates and the unresolved boundary questions; AGENTS repo identity; repo classification. Add SECURITY-WP-0001 covering registration, the disposition review of InfoTechCanon's security material, the reference-impact survey, the federation interface card, and the handoff to a migration workplan. No canon content is moved yet — the migration waits on the reviewed disposition. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUkN13CAqtXWPXuEiEtmJj Assistant: claude-code Assistant-Model: opus Assistant-Process: 36656@bnt-lap001 Assistant-Session: 66d6eece-d245-43ca-85e8-68a1b5970a67 2026-09-20 20:32:05 +02:00			`# Agent instructions — security-canon`

			`## Repo Identity`

			`Purpose: Orthogonal vocabulary and canonical model for security-related concepts, extending InfoTechCanon.`

			`Domain: infotech`
			`Repo slug: security-canon`
			Topic ID: `fe2aaa78-9c20-4feb-b3d2-4fe0529572a3`
			Workplan prefix: `SECURITY-WP-`
			`Upstream canon: info-tech-canon`

Fold GOAL.md into INTENT.md for prj-flavor conformance fix-consistency C-35 flags shipping both INTENT.md and GOAL.md under the project flavor. The sibling canons (CommerceCanon, InterfaceCanon) ship INTENT.md only, and the repository owner asked for INTENT.md, so the outcome, invariants, success gates and retirement condition move into INTENT.md and GOAL.md is removed. References in README, AGENTS and SECURITY-WP-0001 updated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUkN13CAqtXWPXuEiEtmJj Assistant: claude-code Assistant-Model: opus Assistant-Process: 36656@bnt-lap001 Assistant-Session: 66d6eece-d245-43ca-85e8-68a1b5970a67 2026-09-20 20:33:56 +02:00			`Orient: INTENT.md → SCOPE.md → workplans/.`
Bootstrap security-canon governance and extraction plan Scaffold the repository to the repo-manager standard and establish its governance surface: INTENT declaring the Taxonomy-layer claim and boundary against NetKingdom, flex-auth, key-cape, OpenBao and whitehat-security; GOAL with migration invariants and success gates; SCOPE listing the extraction candidates and the unresolved boundary questions; AGENTS repo identity; repo classification. Add SECURITY-WP-0001 covering registration, the disposition review of InfoTechCanon's security material, the reference-impact survey, the federation interface card, and the handoff to a migration workplan. No canon content is moved yet — the migration waits on the reviewed disposition. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUkN13CAqtXWPXuEiEtmJj Assistant: claude-code Assistant-Model: opus Assistant-Process: 36656@bnt-lap001 Assistant-Session: 66d6eece-d245-43ca-85e8-68a1b5970a67 2026-09-20 20:32:05 +02:00

			`## State Hub Integration`

			`<!-- BEGIN STATE-HUB-ACCESS -->`
			`\| Context \| URL \|`
			`\|---------\|-----\|`
			\| Local workstation \| `http://127.0.0.1:8000` \|
			\| Remote (railiance01, in-cluster) \| `http://10.43.68.154:8000` \|
			\| Optional local edge relay \| `http://127.0.0.1:18080` \|

			Do not instruct a remote agent to use `http://127.0.0.1:18000`. That reverse tunnel is retired; on railiance01 reach the hub at the in-cluster address above.
			`<!-- END STATE-HUB-ACCESS -->`

			`## Cross-repo waits`

			If blocked on another repo, look for a `prj-` driver workplan and follow `coordination-engine` `spec/cross-owner-wait-mode-v0.1.md`. Do not mint a stranded `wait`, implement `flavor: residual`, or message `ops-warden` for secrets.