coulomb/key-cape
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Make INTENT.md self-coherent
Some checks failed
Build and Publish Container Image / build-and-push (push) Has been cancelled
Details

Browse Source 
Remove external reference points so the intent stands on its own at the
abstract, stable level. The IAM profile this repo implements is described
as a versioned profile contract rather than attributed to an external
owner, and the heavier comparison mode is described generically instead of
by product name. All of KeyCape's own substance is preserved — purpose,
primary utility, intended users, strategic role and boundaries, design
principles, maturity target, and stability note.

Relationships to other systems belong in interface contracts and the
orchestration responsibility map, not in intent.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-05-21 01:50:08 +02:00
parent 465a778c1f
commit f45784f951
1 changed files with 13 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
INTENT.md
View File

@@ -2,7 +2,7 @@
## Purpose
This repository exists to provide a **lightweight, profile-conformant identity and access management (IAM) system** for the NetKingdom ecosystem.
This repository exists to provide a **lightweight, profile-conformant identity and access management (IAM) system**.
It ensures that applications can rely on a **stable, versioned authentication contract** independent of the underlying IAM implementation.
@@ -10,11 +10,11 @@ It ensures that applications can rely on a **stable, versioned authentication co
## Primary Utility
The repository provides an implementation of the **NetKingdom IAM Profile** that:
The repository provides an implementation of a **versioned IAM profile** that:
* Delivers OIDC/PKCE-based authentication with strong security constraints
* Normalizes identity data across heterogeneous backend systems
* Enforces strict adherence to a defined IAM contract
* Enforces strict adherence to the defined IAM contract
* Enables seamless migration between lightweight and expanded IAM modes
It transforms IAM from a system dependency into a **replaceable, contract-driven capability**.
@@ -23,7 +23,7 @@ It transforms IAM from a system dependency into a **replaceable, contract-driven
## Intended Users
* Application developers integrating against the NetKingdom IAM Profile
* Application developers integrating against the IAM profile
* Infrastructure operators (`adm`) deploying IAM in constrained environments
* Automation systems (`atm`) managing identity, migration, and validation workflows
* LLM agents (`agt`) interacting with authenticated services
@@ -32,14 +32,14 @@ It transforms IAM from a system dependency into a **replaceable, contract-driven
## Strategic Role in the System
This repository serves as the **lightweight IAM layer** within NetKingdom:
This repository serves as the **lightweight IAM layer**:
* It provides a **drop-in alternative to Keycloak** for environments with limited resources
* It provides a **resource-efficient implementation** of the IAM profile for environments with limited resources
* It anchors IAM around a **profile contract rather than a specific implementation**
* It enables a **two-mode architecture**:
* Lightweight mode (KeyCape)
* Expanded mode (Keycloak)
* Lightweight mode (this implementation)
* Expanded mode (a heavier, full-featured implementation)
The profile ensures that both modes are **interchangeable without application changes**.
@@ -50,9 +50,9 @@ The profile ensures that both modes are **interchangeable without application ch
This repository is **not** intended to:
* Become a full-featured, general-purpose IAM platform
* Extend beyond the defined NetKingdom IAM Profile
* Extend beyond the defined IAM profile
* Support features that weaken security guarantees (e.g., implicit flow, wildcard redirects)
* Replace or wrap Keycloak in expanded deployments
* Replace or wrap the heavier expanded-mode implementation
Its responsibility is limited to **strict, secure, and transparent profile implementation**.
@@ -70,7 +70,7 @@ Its responsibility is limited to **strict, secure, and transparent profile imple
Unsupported features must fail clearly and predictably
* **Replaceability by design**
The system must be swappable with Keycloak without breaking integrations
The system must be swappable with a heavier profile implementation without breaking integrations
* **Canonical identity model**
Identity data must be normalized and consistent across all backends
@@ -81,10 +81,10 @@ Its responsibility is limited to **strict, secure, and transparent profile imple
A mature version of this repository should:
* Fully implement and enforce the **NetKingdom IAM Profile** with zero ambiguity
* Fully implement and enforce the **IAM profile** with zero ambiguity
* Provide **complete migration pathways** between lightweight and expanded modes
* Offer **deterministic and testable behavior** across all supported scenarios
* Act as a **reference implementation** of the IAM Profile
* Act as a **reference implementation** of the IAM profile
* Enable IAM deployments that are **minimal, secure, and operationally efficient**
---
@@ -94,5 +94,3 @@ A mature version of this repository should:
Changes to this file represent a **deliberate shift in the IAM contract, scope, or architectural role** of this repository.
Such changes must be made with explicit intent, as they directly affect all dependent applications.