diff --git a/INTENT.md b/INTENT.md index cf24348..3cba165 100644 --- a/INTENT.md +++ b/INTENT.md @@ -34,7 +34,7 @@ depends: - **NetKingdom** owns its security architecture, its standards of record, including the security layer model, and any NetKingdom-specific profiles that import this canon. -- **access-engine** (the repository is still `flex-auth`) owns authorization +- **access-engine** (formerly the repository `flex-auth`) owns authorization decisions; **key-cape** and Keycloak own login, OIDC, and MFA; **OpenBao** owns secret custody. SecurityCanon describes those concepts; it does not perform them. There is one decision point. diff --git a/SCOPE.md b/SCOPE.md index 31f0d9b..bff4ca5 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -1,15 +1,14 @@ # SCOPE -Reviewed: 2026-09-20 (Europe/Berlin), after [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md). +Reviewed: 2026-10-03 (Europe/Berlin), following the completed vocabulary work and [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md). ## Current repository scope -Bootstrap. The repository carries governance files — INTENT, SCOPE, AGENTS, -repo classification — the [SEC-ADR-001](docs/adr-001-securitycanon-boundary.md) -boundary decision, the Mode of Authority review in `history/`, and one active -workplan. The only content is the Mode of Authority v0.1 research draft, not yet -promoted into a canon artifact. There is no service code, and by decision there -will be none. +The repository publishes Mode of Authority draft 0.2.0 vocabulary artifacts, +mode/dimension catalogs, declared imports, a federation interface, cross-canon +mappings and orientation surfaces. SECURITY-WP-0001 is finished. The retained +v0.1 research draft is historical, not the current orientation artifact. There +is no service code; SEC-ADR-001 keeps validation in InfoTechCanon's service. ## Ownership and boundaries @@ -25,9 +24,10 @@ Out of scope, with the owner named: - any CLI, HTTP API, or validation service — **InfoTechCanon's service surface**, by SEC-ADR-001 D4; integration is via the canon-federation interface card - security architecture and standards of record for the estate — NetKingdom -- authorization decisions — flex-auth +- authorization decisions — access-engine (runtime/product flex-auth) - login, OIDC, MFA — key-cape / Keycloak -- secret custody and credential issuance — OpenBao, ops-warden +- credential lifecycle — secrets-engine over OpenBao custody; operational + routing and SSH certificates — ops-warden - adversarial evidence and findings practice — whitehat-security - shared artifact/ownership/mapping/profile mechanisms — InfoTechCanon - consumer runtime state, enforcement, observation, and adoption evidence — the consumers diff --git a/docs/emergent-knowledge-021-review.md b/docs/emergent-knowledge-021-review.md new file mode 100644 index 0000000..735097d --- /dev/null +++ b/docs/emergent-knowledge-021-review.md @@ -0,0 +1,91 @@ +# SecurityCanon vocabulary review — Emergent knowledge 0.2.1 + +Disposition: no blocking vocabulary conflict in the orientation profile's +mode/scope mapping. No runtime wire attribute, ordinal privilege mapping or new +canonical concept is approved. The adoption decision remains human-owned. + +## Reviewed artifact and limits + +Knowledge 0.2.1; digest `d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`; emergent-security commit `f9cba6fb35425f74e34401b1baf09f6057ace493`. + +Reviewed by the Codex repository worker, 2026-10-03, under the user's +EMERGENT-WP-0002 owner-review delegation. This is an owner-scoped documentary +review by an agent, not human assent, adoption, independent whitehat evidence, +or a runtime grant. The existing adoption decision +`d20a9750-2b29-534e-8227-fb866581a6ca` remains open. + +Read the artifact's adoption-review, closure-attempt, integration-profile decision, +operational contracts, integration map, source matrix, all 14 cards, unsigned +exact-release adoption draft, knowledge-maintenance, and T02/T08/T09. Retrieval +with `--repositories /home/worsch` reported 0.2.1 and the digest above; all 24 +owners were `verified-files`, `live_state_verified: false`. File verification +is distinct from live readiness. No inventoried source content was changed. + +The unsigned memo asks only whether this exact non-normative orientation +boundary is accepted. Its `knowledge-profile` class and `net-kingdom-admins` +group are proposals requiring informed-decision's real submission/admission +route. A synthetic validation grant proves format only. Do not sign, seal, +bind, answer, or infer approval from this review or silence. + +## Sources and mappings + +Reviewed security-canon@bbd44332543e1cc40b2ebed10ec06123b9c798ea: INTENT/SCOPE, +SEC-ADR-001/002, SECURITY-DEC-2026-001/-002/-003, SECURITY-WP-0001, +concept-placement, federation interface, vocabulary card/disambiguation, auth +modes/dimensions catalogs and Mode-of-Authority-to-InfoTechCanon mapping. + +| Mapping | Disposition | +| --- | --- | +| MODE @ SCOPE | Seven non-ordered kinds of authority. Emergent L0-L4 are decision scopes, not these modes or a permission ladder. Identity/root cards preserve this. | +| SOVEREIGN | Relative to a named authority realm; substrate dominance does not make it universally sovereign. SOVEREIGN at a tenant/database is not platform-root. | +| BREAK_GLASS | Activation orthogonal to AuthMode, never an eighth mode or grant. | +| Actor/principal/runtime identity | Gate House's request vocabulary is preserved in its owner context. SecurityCanon AuthorityContext names authority drawn on; it does not rename InfoTechCanon Subject, which is the access-control view of an actor. No wire-level field equivalence follows. | +| Role/plane/mode | CARING Operator role is not OPERATE; Build Plane is not CONSTRUCT; Policy Plane is not GOVERN. Build mode and environment are independent from all three. | +| Scope/tenant/environment/zone/temperature | Separate questions with named owners and authoritative evidence. No ordinal or automatic conversion. | +| EvidenceBoundary | Actor independence/custody is distinct from Audit Plane, source completeness, hash checks and live signature validation. The evidence card correctly preserves the distinctions. | + +## Documentary corrections and remaining limitation + +Corrected uninventoried INTENT/SCOPE owner labels: access-engine is the current +repository coordinate, credential lifecycle belongs to secrets-engine over +OpenBao custody with ops-warden routing/SSH, and bootstrap-only SCOPE prose is +historical now that SECURITY-WP-0001 is finished and the vocabulary is published +as draft 0.2.0 artifacts. No imported definition or reviewed source was changed. + +Source-owner finding for a future reviewed source revision: vocabulary-card +describes principal_type as imported, while dimensions.yaml says SecurityCanon +owns the classification of the imported InfoTechCanon Principal. The reviewed +Emergent cards do not adopt that classification or encode principal type into +AuthMode; the current non-normative mapping is unaffected. Do not expand the +profile to that field until the vocabulary owner corrects the card and the +publisher reseals affected guidance. This is not a new runtime claim schema. + +SecurityCanon's ongoing responsibility is terminology and cross-canon mappings, +not maintaining the estate orientation bundle or granting consumer adoption. +The artifact's AuthMode machine-readable operational-consumption question stays +open with the owners; this review does not settle it. Any future executable +mapping requires an owner-reviewed profile with explicit provenance, blanks and +compatibility, rather than mapping by name or ordinal value. + +Approval-ready question: accept the exact non-normative orientation boundary, +return it, or decline, using the existing human decision route. Publication +requires NetKingdom/Gate House disposition; this vocabulary review is evidence, +not an authenticated human answer or canonical promotion. + +Review work record: SECURITY-WP-ADHOC-2026-10-03-T01. The documentary review is +complete. Adoption and rollout remain existing EMERGENT-WP-0002 work; no foreign +tasks were copied and no stranded cross-owner wait was opened. + +## Subsequent corrected-release condition + +The coordinating worker reports a planned 0.2.2 remediation for post-load card +tamper/lifecycle invalidation and serving the bytes that were verified. This +review retains its original 0.2.1 version/digest and does not certify the fix. +Before adopting a replacement, record its exact digest/commit, check the changed +content/source and unsigned memo freshness, repeat affected retrieval/scenario +checks, and obtain independent whitehat close-out. Unchanged vocabulary/doctrine +findings may be carried forward explicitly; changed content requires review. +The proposed publication filename must follow the release actually accepted. + +The principal_type documentary correction is tracked as live intake +SECURITY-IN-0001 (origin: residual, origin_ref: SECURITY-WP-ADHOC-2026-10-03). diff --git a/intakes/intakes.md b/intakes/intakes.md new file mode 100644 index 0000000..e7a1e5d --- /dev/null +++ b/intakes/intakes.md @@ -0,0 +1,27 @@ +# Intake records + +## SECURITY-IN-0001 — Align principal-type classification ownership wording + +```yaml +id: SECURITY-IN-0001 +kind: intake +title: Align principal-type classification ownership wording +status: open +origin: residual +origin_ref: SECURITY-WP-ADHOC-2026-10-03 +priority: low +owner: security-canon +requested_by: codex +created: '2026-10-03' +updated: '2026-10-03' +description: >- + The Emergent knowledge 0.2.1 owner review found that docs/vocabulary-card.md + labels principal_type imported, whereas the dimensions catalog describes + SecurityCanon's classification of the imported InfoTechCanon Principal. + Reconcile the labels against SECURITY-DEC-2026-003 and the declared imports; + do not redefine InfoTechCanon Principal or turn this into a runtime claim. + The current Emergent card mapping does not adopt this classification and is + unaffected. Because the vocabulary card is inventoried in the reviewed + Emergent bundle, coordinate a new source revision/reseal with its publisher + before changed guidance is distributed. Evidence: docs/emergent-knowledge-021-review.md. +``` diff --git a/workplans/ADHOC-2026-10-03.md b/workplans/ADHOC-2026-10-03.md new file mode 100644 index 0000000..eedf75e --- /dev/null +++ b/workplans/ADHOC-2026-10-03.md @@ -0,0 +1,32 @@ +--- +id: SECURITY-WP-ADHOC-2026-10-03 +type: workplan +title: "Review Emergent Security 0.2.1 orientation boundary" +domain: infotech +repo: security-canon +status: finished +owner: codex +topic_slug: security-canon +created: "2026-10-03" +updated: "2026-10-03" +--- + +## Complete owner-scoped documentary review + +```task +id: SECURITY-WP-ADHOC-2026-10-03-T01 +status: done +priority: medium +``` + +Evidence: docs/emergent-knowledge-021-review.md. The user authorized repository workers to review the exact +0.2.1 release for EMERGENT-WP-0002. Review and feedback are complete within +this owner's published boundaries. No policy or operational authority changed; +no authenticated human assent asserted. Existing decision +d20a9750-2b29-534e-8227-fb866581a6ca and EMERGENT-WP-0002-T02/T08/T09 retain +pending acceptance/publication/pilot gates; this record does not duplicate them. + +Residual handed off before close: SECURITY-IN-0001 owns the principal_type +source-card classification label correction and publisher refresh coordination. +The current orientation mode mapping is unaffected; the intake is live rather +than a prose-only leftover.