Skip to main content

Security

jhf-heddle is the Helpifyr technical identity runtime. It owns OIDC client contracts, claim/session/revocation posture, and fail-closed identity runtime verification. It does not own business-role truth, commercial eligibility, or Fabric policy/admission truth.

Security Ownership​

This repository owns:

  • Keycloak-based technical identity runtime contracts
  • OIDC client templates and admitted-surface bootstrap posture
  • claim, session, revocation, and delegated-principal contracts
  • identity-runtime verification scripts
  • fail-closed consumer behavior for Fabric-derived truth

This repository does not own:

  • business identity or entitlement truth from jhf-spindle
  • Fabric projection/admission verdicts
  • downstream module authorization decisions
  • environment-level runtime materialization owned by jhf-openclaw-env
  • secret-store product behavior owned by jhf-keystore

Fail-Closed Identity Rules​

Heddle security posture is fail-closed:

  • missing Fabric truth is denied, not inferred
  • stale claims or projection revisions are denied
  • revoked sessions or delegated principals are denied
  • local business-role shadow truth is forbidden
  • consumer services must use admitted OIDC/client contracts

Docs must not present planned identity paths as implemented runtime behavior.

Secret And Evidence Handling​

Secrets, passwords, tokens, private keys, raw .env values, and customer data must never be committed or copied into docs. Evidence may cite a verifier, status, issue, or redacted runtime readback, but not credential payloads.

OIDC examples must be clearly classified as illustrative or copy-paste-safe. Any operator-only runtime path must remain redacted before public publication.

Public Documentation Safety​

Public-safe Heddle docs may describe identity ownership, OIDC flows, claim boundaries, fail-closed behavior, and verification commands. They must not publish:

  • raw local paths or host-only paths unless redacted and operator-safe
  • real secrets, tokens, passwords, or private keys
  • customer identity payloads or personal data
  • incident evidence with sensitive request/claim content
  • scratchpad notes or unfinished plans as product truth

Verification​

Recommended repo-local checks:

python scripts/validate-root-docs-manifest.py --manifest docs_manifest.yml
python scripts/docs/validate_docs_inventory.py
python scripts/validate-module-features-registry.py --file docs/MODULE_FEATURES.md

Runtime/security checks depend on the issue scope and must use the specific validator named in docs/MODULE_FEATURES.md or the relevant runbook.

License: AGPLv3 Project: https://helpifyr.com