AUDIT-WP-0018-T04: align seed with settled CCR-2026-0063 (railiance-platform f3b0c4f)

- sso delivery is ExternalSecret/Secret sso/bounded-executor-tokens key
  audit-core (the Secret the rapp run Job already mounts), not
  nk-bind-executor-audit/audit-token.
- CCR check now also pins the new reader shape (audience openbao, explicit
  max TTL 15m, token_self_lifecycle) and that the CCR names this script as
  its custody procedure and the bounded-executor-tokens delivery.
- Docs/workplan: this script is the single seeder; railiance-platform
  fences the boundary (nk_bind_executor_custody.py fence) and owns
  manifests/nk-bind-executor-eso.yaml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

docs/bounded-executor-receipts.md

@@ -266,8 +266,9 @@ How the token reaches both sides. One founder-run process,
    - tenant `tenant:platform` gets 403;
    - another source gets 403.
    An unknown bearer gets 401.
-7. It force-syncs `sso/nk-bind-executor-audit` and compares `audit-token` by
-   hash, but only if that ExternalSecret exists.
+7. It force-syncs `sso/bounded-executor-tokens` and compares key `audit-core`
+   by hash, but only if that ExternalSecret exists. That is the Secret the
+   rapp run Job already mounts.
 
 The script is silent. The receipt holds versions, booleans and a 12-hex
 fingerprint. A rerun reuses its own custody and writes nothing new. It refuses
@@ -277,24 +278,30 @@ collision and a concurrent registry write. Tests:
 
 The script refuses before any write unless all of the following hold:
 
-- CCR-2026-0063 is `approved` or later, with all three owner reviews;
+- CCR-2026-0063 is `approved` or later, with all three owner reviews. Its
+  reader shape must be audience `openbao`, explicit max TTL and token self-lifecycle.
+  Its delivery must be `sso/bounded-executor-tokens` key `audit-core`, and it must
+  name this script as its custody procedure;
 - the cluster is railiance01 (kube-system UID);
 - the receiver runs the pinned image;
 - the live scope ConfigMap matches;
 - the ingress policy exists;
 - the coding-agent boundary already denies the custody data and metadata paths.
 
-It does not create the reader policy, the role or the boundary
-(railiance-platform). It also does not create the `sso` ClusterSecretStore and
-ExternalSecret, which belong to the rapp-bounded-executor package (CCR-2026-0063
-`delivery.target`).
+CCR-2026-0063 (railiance-platform f3b0c4f) names this script as its single
+seeder. The script does not create the reader policy, the role or the boundary.
+railiance-platform owns those: its credential-change applier creates the
+policy and role, and `scripts/nk_bind_executor_custody.py fence` creates the
+boundary. Nor does it create ClusterSecretStore `openbao-nk-bind-executor-audit`
+or ExternalSecret `sso/bounded-executor-tokens`, which are railiance-platform's
+`manifests/nk-bind-executor-eso.yaml`.
 
 ## Founder runbook — nk-bounded-executor sender
 
 Run these in order. Steps 1 and 2 can run now. Step 3 depends on CCR-2026-0063:
 railiance-platform must have it approved by platform-owner, audit-core-owner and
-net-kingdom-owner, and must have applied its reader policy, role and
-coding-agent boundary entries.
+net-kingdom-owner, must have applied its reader policy and role, and must have
+run `nk_bind_executor_custody.py fence` for the coding-agent boundary entries.
 
 **1. Ingress (NK-WP-0056-T16).** This applies exactly one object. Run the server
 dry-run first, then the apply:
@@ -335,8 +342,9 @@ KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl -n audit-core get netwo
 ```
 
 The expected status is `seeded_pending_sso_delivery`, or `seeded_and_delivered`
-once the rapp package's ExternalSecret exists. The expected probe is
+once railiance-platform's ExternalSecret `sso/bounded-executor-tokens` exists. The expected probe is
 `{"read": 403, "own_tenant": 200, "other_tenant": 403, "other_source": 403}`.
-After the rapp package applies `sso/nk-bind-executor-audit`, rerun step 3 with
+If railiance-platform applies `manifests/nk-bind-executor-eso.yaml` after the
+seed, rerun step 3 with
 `-r2.json`. It writes no custody or registry and confirms the `sso` copy by
 hash.