Create docs/responsibility-map.md: the single home for NetKingdom's
orchestration relationships, kept out of the orchestrated repos' intents
per ADR-0010. Records the classification criterion, the current
minimal-foundation scope, and per orchestrated repo (railiance-infra,
railiance-cluster, railiance-platform, key-cape, flex-auth) the resources
held, what the repo owns (execution), and what NetKingdom orchestrates
(meta). Lists dependencies and out-of-scope repos so the scoping decision
is explicit and revisitable.
Update ADR-0010 to point at the now-created map.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Record two foundational principles that emerged while aligning ecosystem
INTENT.md files:
1. Orchestration != dependency. NetKingdom orchestrates a repo when that
repo holds resources NetKingdom must manage (users, roles, scopes,
policies, infra resources). It depends on a repo when it merely uses it
as a tool. Defining question: does the repo hold resources NetKingdom
needs to orchestrate? (railiance-fabric = dependency;
railiance-infra/cluster/platform = orchestrated.)
2. Intent is self-coherent. A repo's INTENT.md describes its own purpose
abstractly; it must not reference NetKingdom, sister projects' intents,
or even dependencies. Relationships live in the responsibility map /
ADRs / interface contracts, not in intent.
Rejects the earlier "place in the NetKingdom landscape" block idea as a
Principle 2 violation.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- ADR-0007: refine (not overturn) the orchestration boundary with the
two-layer model — Railiance executes parametrized playbooks, NetKingdom
does meta-orchestration (scenario->playbook selection, parametrization,
responsibility map). Add the playbook/capability-contract dependency as
the prerequisite, analogous to the IAM Profile.
- INTENT.md: add "Why NetKingdom" (the kingdom metaphor: governed,
defended, living/evolving, tended by its people); Principle 7
(Meta-Orchestration over Re-Implementation); an Operating Model section
(kaizen-agent workforce for recurring duties + change/improvement); and
matching Direction-of-Evolution entries.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Refine the recursive platform security architecture to make OpenBao the
canonical runtime secret authority, with SOPS/age, K8s Secrets, and the
emergency bundle reframed as bootstrap/delivery/break-glass mechanisms.
- credential-management standard v0.2: add OpenBao runtime authority
section, rotation rules, and prohibited patterns (OpenBao-as-PDP,
tenant platform-root)
- platform-identity-security-architecture: mark implemented; add
flex-auth/Topaz implications, Coulomb onboarding path, and a
production-readiness checklist
- NK-WP-0004/0005: document bootstrap-to-OpenBao handoff boundary
- NK-WP-0006/0007: status -> done with implementation reviews; add
recursive platform/tenant split and OpenBao broker/audit role for
object-storage STS vending
- NK-WP-0008: status -> done; repoint corpus to infospace-bench
- new ADR-0007 (orchestration boundary), ADR-0008 (STS vending
boundary), and the object-storage STS credential-vending architecture
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
