tegwick
4349758608
Declare Engine/PIP machine-readably, publish a total fail-closed PEP stance map, stop minting local decision ids on engine-unavailable DENY, bind allows to a 30s request lifetime, confine the local authorization double, classify evidence and emit a denial/revocation heartbeat, and prove access-control facts remain claims. Assistant: grok Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb
146 lines
4.7 KiB
Markdown
146 lines
4.7 KiB
Markdown
---
|
|
id: USER-WP-0024
|
|
type: workplan
|
|
title: "Security layer model conformance for Engine/PIP"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: finished
|
|
owner: grok
|
|
topic_slug: netkingdom
|
|
created: "2026-08-29"
|
|
updated: "2026-08-29"
|
|
depends_on:
|
|
- USER-WP-0023
|
|
state_hub_workstream_id: "dee4ec0e-c451-50be-9363-e9cbc8ff68de"
|
|
---
|
|
|
|
# USER-WP-0024 — security layer model conformance
|
|
|
|
Adopt the accepted NetKingdom Security Layer Model
|
|
(`net-kingdom/canon/standards/security-layer-model_v0.7.md`, companion
|
|
`net-kingdom/SECURITY-COMPANION.md`) as this repository's own declaration
|
|
and close the implementation gaps that leave a PEP-shaped Engine short of
|
|
the standard.
|
|
|
|
Assessment:
|
|
`history/2026-08-29-security-layer-scope-intent-assessment.md`.
|
|
|
|
Working references: `ops-warden/layer.yaml` and
|
|
`kings-guard/layer.yaml` (no Tooling contacts). Credential and lane
|
|
questions go to `ops-warden`, not this workplan.
|
|
|
|
## T01 — Declare Engine/PIP in own voice
|
|
|
|
```task
|
|
id: USER-WP-0024-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "ee4c6a3c-a48c-5508-85c1-a02c6a0b1d11"
|
|
```
|
|
|
|
Replace the gate-house review note in `INTENT.md` with this repository's
|
|
own declaration: frontmatter `layer: Engine`, `role: PIP`, plus prose that
|
|
subject context is a claim, never a decision, and that protected
|
|
mutations are PEP-shaped without changing layer. Restate `SCOPE.md` from
|
|
that INTENT. Record the scope-vs-intent-vs-implementation assessment
|
|
under `history/`.
|
|
|
|
Done 2026-08-29. Closes the declaration half of `USER-IN-0001`. Does not
|
|
by itself make the runtime conforming.
|
|
|
|
## T02 — Machine-readable layer declaration and check
|
|
|
|
```task
|
|
id: USER-WP-0024-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "2874fd05-5b54-5812-9e89-2832408e488b"
|
|
```
|
|
|
|
Add `layer.yaml` (or equivalent) naming Engine/PIP, empty catalogued
|
|
Tooling contacts, non-Tooling / own-store clients (PostgreSQL modeled
|
|
concept, State Hub, env-injected secrets, flex-auth Engine API, OIDC
|
|
claim input), and the path of the PEP stance map. Adapt
|
|
`kings-guard/scripts/check_layer_conformance.py` and a unit test so an
|
|
undeclared OpenBao, Vault, LDAP, or cluster client fails the commit that
|
|
introduces it.
|
|
|
|
Done 2026-08-29. `layer.yaml`, `scripts/check_layer_conformance.py`, and
|
|
`tests/test_layer_conformance.py`. Checker exits 0; a synthetic `hvac`
|
|
import fails the scan.
|
|
|
|
## T03 — PEP obligations on the production path
|
|
|
|
```task
|
|
id: USER-WP-0024-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "caf7ef66-d221-5548-947b-17b5ff1865ee"
|
|
```
|
|
|
|
Ship the four §6.4 obligations for this PEP-shaped Engine.
|
|
|
|
Done 2026-08-29. `pep-stance.yaml` is total fail-closed including unknown
|
|
and equals `user_engine.pep_stance`. Unavailable DENY sets
|
|
`stance_applied` and `decision_id=None`. Allows are request-bound with a
|
|
30s lifetime. `LocalAuthorizationCheckPort` raises when
|
|
`USER_ENGINE_FLEX_AUTH_TOKEN_FILE` is set; `runtime.py` does not import
|
|
it.
|
|
|
|
## T04 — Evidence bound and cadence
|
|
|
|
```task
|
|
id: USER-WP-0024-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "b4cebd66-21d0-5a6d-b718-971af70bebb6"
|
|
```
|
|
|
|
Classify local audit and outbox events as load-bearing or attributive.
|
|
Keep mutation+audit+outbox atomic in the store transaction (already
|
|
true). For denials and membership/account revocations — low-volume
|
|
load-bearing classes — declare a heartbeat or reconciliation, not a
|
|
rate.
|
|
|
|
Done 2026-08-29. `src/user_engine/evidence.py`,
|
|
`UserEngineService.record_evidence_heartbeat()`,
|
|
`docs/evidence-classification.md`. Operability copy no longer says
|
|
audit correlation completeness.
|
|
|
|
## T05 — Access-control facts remain claims
|
|
|
|
```task
|
|
id: USER-WP-0024-T05
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "f1ac9244-0639-5e97-8981-babdbe8991e5"
|
|
```
|
|
|
|
Prove under statute §6.1 that hats, access profiles, and
|
|
`AccessControlFact` exports cannot be mistaken for an authorization
|
|
decision.
|
|
|
|
Done 2026-08-29. `tests/test_evidence.py` forbids effect fields on claim
|
|
shapes and asserts hat selection and export never return allow/deny.
|
|
`docs/hats-realms-services-assets-access-profiles.md` states the
|
|
consumer contract.
|
|
|
|
## T06 — Close the intake and request the stance-map row
|
|
|
|
```task
|
|
id: USER-WP-0024-T06
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "81ecfc55-2b23-53cd-9269-c7211bad8bd9"
|
|
```
|
|
|
|
Mark `USER-IN-0001` answered: Engine/PIP, not contested. Message
|
|
`gate-house` with the declaration path, the PEP-shaped finding for
|
|
statute §13.1 (user-engine is a third PEP-shaped consumer; the register
|
|
currently has one published row), and a pointer at this workplan for the
|
|
runtime follow-through.
|
|
|
|
Done 2026-08-29. Intake marked answered in `intakes/intakes.md`. Message
|
|
`c014d12a-fe7a-4a90-ba73-03a5ac3e7f73` to `gate-house` carries the
|
|
declaration, the non-contest, and the §13.1 request (row to be added
|
|
when `pep-stance.yaml` ships in T03).
|