From 275bfd530b9a38e2cd5de0ae3588974b8acda4fe Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 19 Aug 2026 14:42:28 +0200 Subject: [PATCH] =?UTF-8?q?Update=20SCOPE=20to=20the=20finished=20USER-WP-?= =?UTF-8?q?0001=E2=80=930023=20surface?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the WP-0015 planning note with the shipped in/out boundary, published NetKingdom contracts, operator residuals, and an INTENT assessment. Fill the repo-boundary neighbor list to match. --- .claude/rules/repo-boundary.md | 20 +++-- SCOPE.md | 158 +++++++++++++++++++++++---------- 2 files changed, 124 insertions(+), 54 deletions(-) diff --git a/.claude/rules/repo-boundary.md b/.claude/rules/repo-boundary.md index 1361e9a..0e41b2b 100644 --- a/.claude/rules/repo-boundary.md +++ b/.claude/rules/repo-boundary.md @@ -1,8 +1,18 @@ ## Repo boundary -This repo owns **user-engine** only. It does not own: +This repo owns **user-engine** only: user-domain facts, identity-context +mappings, projections, the optional portal, and the adapters that call +neighbors. - +It does not own: + +- OIDC login, tokens, passwords, MFA — key-cape / Keycloak +- authorization decisions and protected-system registry — flex-auth +- tenant identifier, grouping, and capability-role authority — tenant-engine +- application-owned first-login profiles and action step-up — consuming apps +- runtime secrets — OpenBao / railiance-platform +- platform audit store — audit-core +- transactional mail — email-connect +- State Hub — state-hub +- published policy site — policy-nexus +- SSH certificates — ops-warden diff --git a/SCOPE.md b/SCOPE.md index 9a65dc0..6799377 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -2,67 +2,127 @@ ## One-Liner -Headless user-domain and identity-domain integration engine for accounts, -identity links, actor/principal/subject context, preferences, memberships, -application catalogs, projections, evidence references, audit, and events. +Headless user-domain and identity-domain service for accounts, identity +links, memberships, catalogs, projections, audit, and events, with an +optional in-repo portal. It consumes NetKingdom IAM, authorization, tenant +authority, provisioning, and delivery; it does not own them. ## In Scope -- user and account records; -- account lifecycle state; -- external identity links; -- actor, authenticated subject, authorization principal, account, and user - context mappings; -- global, tenant, application, and membership profile values; -- preference values; +- user and account records, and account lifecycle state; +- external identity links keyed by `(issuer, subject)`; +- actor, authenticated-subject, authorization-principal, and user-context + mappings from verified IAM Profile claims; +- global, tenant, application, and membership profile values and + preferences; - tenant, application, team, and scope memberships; +- hats, realms, services, assets, access profiles, and active access + context as user-domain facts; - identity-context read models for domain consumers; -- canon interface cards, entity mappings, relationship mappings, and explicit +- canon interface cards, entity and relationship mappings, and explicit gap records; - application registry for profile consumers; -- customization catalog registry and validation; -- effective profile resolution; -- projection APIs for self-service, admin, application runtime, audit, and - agent contexts; -- audit records and lifecycle/profile-change events; -- local evidence references derived from audit and event records; -- local standalone development mode; -- integration ports for identity claims, authorization checks, events, and - runtime secrets; -- adapter contracts for evidence export, policy/control references, and - lifecycle task handoff. +- customization catalog registry, versioning, and validation; +- effective profile resolution and projections (self-service, admin, + application runtime, audit, agent, claims-enrichment); +- local audit records and durable outbox events; +- local evidence references derived from audit and events; +- invitations, prepared accounts, entitlement claims, and onboarding + journeys that user-engine owns; +- public registration *orchestration* (start, verify, resume, cancel, + provider handoff) behind an explicit runtime flag; +- provider-neutral tenant lifecycle *calls* to the tenant authority + (create, read, update, retire, reactivate, recover); +- optional CSRF-protected portal over the same APIs (self-service, + onboarding, tenant admin, platform operator); +- standalone/local fixtures and a production PostgreSQL store; +- integration ports for claims, flex-auth decisions (including a rotating + caller token), provisioning, registration verification, tenant + management, outbox delivery, and runtime secrets. ## Out Of Scope -- login and authentication flows; -- password, passkey, session, and MFA lifecycle; -- OIDC/SAML token issuance; -- final authorization policy decisions; -- durable authorization grant authority outside user-engine-owned memberships; -- policy, control, access-review, exception, and organization source-of-truth - ownership; -- runtime secret custody; -- UI implementation in the current MVP; optional registration and access - management UI work is proposed separately under `USER-WP-0014`; -- full SCIM server or enterprise directory replacement in the initial product. +- login, OIDC/SAML token issuance, passwords, passkeys, sessions, and MFA + lifecycle — `key-cape`, Keycloak, or `local-identity`; +- final authorization policy decisions and the protected-system registry — + `flex-auth`; +- durable authorization grants beyond user-engine-owned memberships; +- tenant identifier authority, grouping reclassification, and capability + role grants — `tenant-engine`; +- application-owned first-login profiles, unlink, and action step-up — + consuming apps (e.g. coulomb-social) and KeyCape client policy; +- policy, control, access-review, exception, and organization + source-of-truth ownership; +- runtime secret custody — OpenBao / Railiance; +- platform audit store and transactional SMTP — `audit-core` and + `email-connect`; +- full SCIM server, enterprise directory replacement, or inbound + SAML/OIDC federation (demand-triggered; Keycloak expanded mode is the + published path); +- a generic extracted profile engine. + +The in-repo portal is an optional surface, not a UI product. Password and +MFA screens stay on the identity provider. ## Boundary Rule -user-engine owns user-domain facts, identity-context mappings, and projections. -Other systems may provide authentication, IAM claims, authorization decisions, -policy/control authority, deployment, event transport, durable audit, secrets, -organization records, or UI surfaces, but they must integrate through explicit -interfaces rather than becoming hidden sources of profile or identity-domain -truth. +user-engine owns user-domain facts, identity-context mappings, and +projections. Adjacent systems provide authentication, IAM claims, +authorization decisions, tenant authority, policy/control definitions, +deployment, event transport, durable audit, secrets, organization records, +or additional UI — and they integrate through explicit adapters. They must +not become hidden sources of profile or identity-domain truth. -## Current Planning +Governing published contracts: -Implementation and planning work is tracked in `workplans/USER-WP-0001` -through `USER-WP-0015`. `USER-WP-0010` implements the first headless -registration and factor-evidence slice. `USER-WP-0011` implements prepared -accounts and entitlement claims. `USER-WP-0012` implements hats, realms, -services, assets, access profiles, active context, and exportable -access-control facts. `USER-WP-0013` implements onboarding journeys and -welcome protocols. `USER-WP-0014` implements the optional registration and -access-management UI contract facade. `USER-WP-0015` implements registration -scenario and security conformance tests. +- IAM Profile v0.3 — https://policy.coulomb.social/standards/iam-profile/v0.3/ +- Tenancy Posture v0.1 — https://policy.coulomb.social/standards/tenancy-posture/v0.1/ +- NetKingdom architecture — https://policy.coulomb.social/architecture/net-kingdom/v0.1/ +- User-engine boundary contract (accepted, not yet published) — + `~/net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md` + +## Current Status + +Workplans `USER-WP-0001` through `USER-WP-0023` are finished. There is no +active workplan. The isolated MVP, multi-tenancy, catalogs, canon +alignment, durable PostgreSQL store, self-service and admin portal, +public-registration orchestration, and flex-auth caller identity (live A2 +on `flex-auth-user-engine`) are in the repo and, where applicable, on +Railiance. + +Still operator-owned, not remaining product scope: + +- public registration and outbox mail stay fail-closed until governed + OpenBao verification/delivery tokens and the transactional SMTP lane + are installed; +- the live tenant-lifecycle probe from a user-engine pod (GET / PATCH / + retire / reactivate on a disposable tenant) is still owed; +- `policy.enabled` and tenant-engine caller `enforce` belong to flex-auth + / tenant-engine. + +## Against INTENT.md + +INTENT is the stable aspiration. Against it, the repo now does the job it +set out to do. + +| INTENT aim | Status | +| --- | --- | +| Headless user-domain service, provider- and PDP-agnostic | Met. Ports and adapters; production uses IAM Profile v0.3 and flex-auth. | +| Standalone now, multi-tenant / multi-app later | Met. Fixtures and in-memory conformance plus live PostgreSQL and Railiance. | +| Users, links, memberships, catalogs, projections, events | Met. | +| NetKingdom identity-domain integration layer | Met for the owned slice. Consumes KeyCape, flex-auth, tenant-engine, identity-provisioner, audit-core, email-connect. | +| Applications answer who / which scopes / what to project | Met via `/me`, identity context, catalogs, and projections. | +| Not an IdP, PDP, secret store, directory, or org authority | Held. | +| Optional UI, not UI-driven | Held, with a narrower reading: an optional portal now lives *in this repo* over the same APIs. INTENT's "not a UI application" still applies to product identity. | +| Canon-aligned mappings without taking IAM as SoT | Met (`USER-WP-0007`, interface card). Access-review, policy, and control remain references, not owned records. | +| Path from local setup to governed NetKingdom deploy | Met. | + +Still aspirational, and deliberately not started here: + +- inbound federation / SCIM / directory sync — new workplan only on tenant + demand, targeting published Keycloak expanded mode; +- first-class access-review and governance records; +- a dedicated agent consumption product (projections exist); +- extracting a generic profile engine. + +Those remain INTENT, not a hole in SCOPE.