coulomb/security-canon
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record scoped Emergent knowledge owner review

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10238-7ecc-78e2-903d-075f50e913cc
This commit is contained in:
tegwick 2026-10-03 17:34:43 +02:00
parent bbd4433254
commit 9320e6569f
5 changed files with 160 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
INTENT.md
View file

@ -34,7 +34,7 @@ depends:
- **NetKingdom** owns its security architecture, its standards of record,
including the security layer model, and any NetKingdom-specific profiles that
import this canon.
- **access-engine** (the repository is still `flex-auth`) owns authorization
- **access-engine** (formerly the repository `flex-auth`) owns authorization
decisions; **key-cape** and Keycloak own login, OIDC, and MFA; **OpenBao**
owns secret custody. SecurityCanon describes those concepts; it does not
perform them. There is one decision point.

18
SCOPE.md
View file

@ -1,15 +1,14 @@
# SCOPE
Reviewed: 2026-09-20 (Europe/Berlin), after [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md).
Reviewed: 2026-10-03 (Europe/Berlin), following the completed vocabulary work and [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md).
## Current repository scope
Bootstrap. The repository carries governance files — INTENT, SCOPE, AGENTS,
repo classification — the [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md)
boundary decision, the Mode of Authority review in `history/`, and one active
workplan. The only content is the Mode of Authority v0.1 research draft, not yet
promoted into a canon artifact. There is no service code, and by decision there
will be none.
The repository publishes Mode of Authority draft 0.2.0 vocabulary artifacts,
mode/dimension catalogs, declared imports, a federation interface, cross-canon
mappings and orientation surfaces. SECURITY-WP-0001 is finished. The retained
v0.1 research draft is historical, not the current orientation artifact. There
is no service code; SEC-ADR-001 keeps validation in InfoTechCanon's service.
## Ownership and boundaries
@ -25,9 +24,10 @@ Out of scope, with the owner named:
- any CLI, HTTP API, or validation service — **InfoTechCanon's service surface**,
by SEC-ADR-001 D4; integration is via the canon-federation interface card
- security architecture and standards of record for the estate — NetKingdom
- authorization decisions — flex-auth
- authorization decisions — access-engine (runtime/product flex-auth)
- login, OIDC, MFA — key-cape / Keycloak
- secret custody and credential issuance — OpenBao, ops-warden
- credential lifecycle — secrets-engine over OpenBao custody; operational
routing and SSH certificates — ops-warden
- adversarial evidence and findings practice — whitehat-security
- shared artifact/ownership/mapping/profile mechanisms — InfoTechCanon
- consumer runtime state, enforcement, observation, and adoption evidence — the consumers

91
docs/emergent-knowledge-021-review.md Normal file
View file

@ -0,0 +1,91 @@
# SecurityCanon vocabulary review — Emergent knowledge 0.2.1
Disposition: no blocking vocabulary conflict in the orientation profile's
mode/scope mapping. No runtime wire attribute, ordinal privilege mapping or new
canonical concept is approved. The adoption decision remains human-owned.
## Reviewed artifact and limits
Knowledge 0.2.1; digest `d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`; emergent-security commit `f9cba6fb35425f74e34401b1baf09f6057ace493`.
Reviewed by the Codex repository worker, 2026-10-03, under the user's
EMERGENT-WP-0002 owner-review delegation. This is an owner-scoped documentary
review by an agent, not human assent, adoption, independent whitehat evidence,
or a runtime grant. The existing adoption decision
`d20a9750-2b29-534e-8227-fb866581a6ca` remains open.
Read the artifact's adoption-review, closure-attempt, integration-profile decision,
operational contracts, integration map, source matrix, all 14 cards, unsigned
exact-release adoption draft, knowledge-maintenance, and T02/T08/T09. Retrieval
with `--repositories /home/worsch` reported 0.2.1 and the digest above; all 24
owners were `verified-files`, `live_state_verified: false`. File verification
is distinct from live readiness. No inventoried source content was changed.
The unsigned memo asks only whether this exact non-normative orientation
boundary is accepted. Its `knowledge-profile` class and `net-kingdom-admins`
group are proposals requiring informed-decision's real submission/admission
route. A synthetic validation grant proves format only. Do not sign, seal,
bind, answer, or infer approval from this review or silence.
## Sources and mappings
Reviewed security-canon@bbd44332543e1cc40b2ebed10ec06123b9c798ea: INTENT/SCOPE,
SEC-ADR-001/002, SECURITY-DEC-2026-001/-002/-003, SECURITY-WP-0001,
concept-placement, federation interface, vocabulary card/disambiguation, auth
modes/dimensions catalogs and Mode-of-Authority-to-InfoTechCanon mapping.
| Mapping | Disposition |
| --- | --- |
| MODE @ SCOPE | Seven non-ordered kinds of authority. Emergent L0-L4 are decision scopes, not these modes or a permission ladder. Identity/root cards preserve this. |
| SOVEREIGN | Relative to a named authority realm; substrate dominance does not make it universally sovereign. SOVEREIGN at a tenant/database is not platform-root. |
| BREAK_GLASS | Activation orthogonal to AuthMode, never an eighth mode or grant. |
| Actor/principal/runtime identity | Gate House's request vocabulary is preserved in its owner context. SecurityCanon AuthorityContext names authority drawn on; it does not rename InfoTechCanon Subject, which is the access-control view of an actor. No wire-level field equivalence follows. |
| Role/plane/mode | CARING Operator role is not OPERATE; Build Plane is not CONSTRUCT; Policy Plane is not GOVERN. Build mode and environment are independent from all three. |
| Scope/tenant/environment/zone/temperature | Separate questions with named owners and authoritative evidence. No ordinal or automatic conversion. |
| EvidenceBoundary | Actor independence/custody is distinct from Audit Plane, source completeness, hash checks and live signature validation. The evidence card correctly preserves the distinctions. |
## Documentary corrections and remaining limitation
Corrected uninventoried INTENT/SCOPE owner labels: access-engine is the current
repository coordinate, credential lifecycle belongs to secrets-engine over
OpenBao custody with ops-warden routing/SSH, and bootstrap-only SCOPE prose is
historical now that SECURITY-WP-0001 is finished and the vocabulary is published
as draft 0.2.0 artifacts. No imported definition or reviewed source was changed.
Source-owner finding for a future reviewed source revision: vocabulary-card
describes principal_type as imported, while dimensions.yaml says SecurityCanon
owns the classification of the imported InfoTechCanon Principal. The reviewed
Emergent cards do not adopt that classification or encode principal type into
AuthMode; the current non-normative mapping is unaffected. Do not expand the
profile to that field until the vocabulary owner corrects the card and the
publisher reseals affected guidance. This is not a new runtime claim schema.
SecurityCanon's ongoing responsibility is terminology and cross-canon mappings,
not maintaining the estate orientation bundle or granting consumer adoption.
The artifact's AuthMode machine-readable operational-consumption question stays
open with the owners; this review does not settle it. Any future executable
mapping requires an owner-reviewed profile with explicit provenance, blanks and
compatibility, rather than mapping by name or ordinal value.
Approval-ready question: accept the exact non-normative orientation boundary,
return it, or decline, using the existing human decision route. Publication
requires NetKingdom/Gate House disposition; this vocabulary review is evidence,
not an authenticated human answer or canonical promotion.
Review work record: SECURITY-WP-ADHOC-2026-10-03-T01. The documentary review is
complete. Adoption and rollout remain existing EMERGENT-WP-0002 work; no foreign
tasks were copied and no stranded cross-owner wait was opened.
## Subsequent corrected-release condition
The coordinating worker reports a planned 0.2.2 remediation for post-load card
tamper/lifecycle invalidation and serving the bytes that were verified. This
review retains its original 0.2.1 version/digest and does not certify the fix.
Before adopting a replacement, record its exact digest/commit, check the changed
content/source and unsigned memo freshness, repeat affected retrieval/scenario
checks, and obtain independent whitehat close-out. Unchanged vocabulary/doctrine
findings may be carried forward explicitly; changed content requires review.
The proposed publication filename must follow the release actually accepted.
The principal_type documentary correction is tracked as live intake
SECURITY-IN-0001 (origin: residual, origin_ref: SECURITY-WP-ADHOC-2026-10-03).

27
intakes/intakes.md Normal file
View file

@ -0,0 +1,27 @@
# Intake records
## SECURITY-IN-0001 — Align principal-type classification ownership wording
```yaml
id: SECURITY-IN-0001
kind: intake
title: Align principal-type classification ownership wording
status: open
origin: residual
origin_ref: SECURITY-WP-ADHOC-2026-10-03
priority: low
owner: security-canon
requested_by: codex
created: '2026-10-03'
updated: '2026-10-03'
description: >-
The Emergent knowledge 0.2.1 owner review found that docs/vocabulary-card.md
labels principal_type imported, whereas the dimensions catalog describes
SecurityCanon's classification of the imported InfoTechCanon Principal.
Reconcile the labels against SECURITY-DEC-2026-003 and the declared imports;
do not redefine InfoTechCanon Principal or turn this into a runtime claim.
The current Emergent card mapping does not adopt this classification and is
unaffected. Because the vocabulary card is inventoried in the reviewed
Emergent bundle, coordinate a new source revision/reseal with its publisher
before changed guidance is distributed. Evidence: docs/emergent-knowledge-021-review.md.
```

32
workplans/ADHOC-2026-10-03.md Normal file
View file

@ -0,0 +1,32 @@
---
id: SECURITY-WP-ADHOC-2026-10-03
type: workplan
title: "Review Emergent Security 0.2.1 orientation boundary"
domain: infotech
repo: security-canon
status: finished
owner: codex
topic_slug: security-canon
created: "2026-10-03"
updated: "2026-10-03"
---
## Complete owner-scoped documentary review
```task
id: SECURITY-WP-ADHOC-2026-10-03-T01
status: done
priority: medium
```
Evidence: docs/emergent-knowledge-021-review.md. The user authorized repository workers to review the exact
0.2.1 release for EMERGENT-WP-0002. Review and feedback are complete within
this owner's published boundaries. No policy or operational authority changed;
no authenticated human assent asserted. Existing decision
d20a9750-2b29-534e-8227-fb866581a6ca and EMERGENT-WP-0002-T02/T08/T09 retain
pending acceptance/publication/pilot gates; this record does not duplicate them.
Residual handed off before close: SECURITY-IN-0001 owns the principal_type
source-card classification label correction and publisher refresh coordination.
The current orientation mode mapping is unaffected; the intake is live rather
than a prose-only leftover.