tegwick
4349758608
Declare Engine/PIP machine-readably, publish a total fail-closed PEP stance map, stop minting local decision ids on engine-unavailable DENY, bind allows to a 30s request lifetime, confine the local authorization double, classify evidence and emit a denial/revocation heartbeat, and prove access-control facts remain claims. Assistant: grok Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb
79 lines
2.4 KiB
YAML
79 lines
2.4 KiB
YAML
# user-engine — NetKingdom security layer declaration
|
|
#
|
|
# Framework: net-kingdom/canon/standards/security-layer-model_v0.7.md
|
|
# Companion: net-kingdom/SECURITY-COMPANION.md v0.2
|
|
# Declare: INTENT.md (own voice) + this file (§11 machine-readable form)
|
|
# Validate: python3 scripts/check_layer_conformance.py
|
|
#
|
|
# Engine/PIP: same authoritative user-domain inputs yield the same result.
|
|
# Catalogued Tooling is key-cape and OpenBao. This repository holds no client
|
|
# for either. PostgreSQL is the modeled-concept store, not a §4 Tooling row.
|
|
|
|
schema_version: "0.1"
|
|
framework: netkingdom-security-layer-model
|
|
standard_version: "0.7"
|
|
repository: user-engine
|
|
layer: engine
|
|
role: pip
|
|
declared_by: INTENT.md
|
|
declared_at: "2026-08-29"
|
|
|
|
pep_shape: true
|
|
pep_stance: pep-stance.yaml
|
|
|
|
catalog_entry:
|
|
owns:
|
|
- users
|
|
- accounts
|
|
- memberships
|
|
role: PIP
|
|
|
|
# Empty is a claim. scripts/check_layer_conformance.py fails the commit that
|
|
# introduces an OpenBao, Vault, LDAP, or cluster client.
|
|
tooling_contacts: []
|
|
|
|
own_store:
|
|
- id: postgres-modeled-concept
|
|
module: src/user_engine/adapters/postgres.py
|
|
import_root: psycopg
|
|
symbol: PostgresUserEngineStore
|
|
store: PostgreSQL
|
|
write: true
|
|
note: Persistence of the modeled concept a PIP owns. Not catalogued Tooling.
|
|
|
|
non_tooling_clients:
|
|
- id: flex-auth-engine-api
|
|
target: access-engine
|
|
layer: engine
|
|
module: src/user_engine/adapters/flex_auth.py
|
|
operation: "HTTP POST /v1/check"
|
|
write: false
|
|
note: Engine API. The shape §5 prescribes for a PEP-shaped consumer.
|
|
|
|
- id: oidc-claim-input
|
|
target: key-cape
|
|
layer: tooling-as-claim-input
|
|
module: src/user_engine/oidc.py
|
|
operation: "OIDC discovery and JWKS for verified IAM Profile claims"
|
|
write: false
|
|
note: Consumes identity claims as PIP input. Not a key-cape admin client.
|
|
|
|
- id: env-injected-secrets
|
|
target: Railiance secret injection
|
|
layer: not-catalogued
|
|
module: src/user_engine/runtime.py
|
|
operation: "read environment and projected token files"
|
|
write: false
|
|
note: No OpenBao client. SecretProvider remains an unused port.
|
|
|
|
- id: state-hub-work-records
|
|
target: state-hub
|
|
layer: not-catalogued
|
|
operation: "HTTP to the Custodian State Hub for work records and progress events"
|
|
write: true
|
|
note: Agents writing this repository, not the service runtime.
|
|
|
|
declared_shapes:
|
|
"5.1": []
|
|
"5.2": []
|
|
"5.3": []
|