coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

AUDIT-WP-0018-T04: align seed with settled CCR-2026-0063 (railiance-platform f3b0c4f)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
- sso delivery is ExternalSecret/Secret sso/bounded-executor-tokens key
  audit-core (the Secret the rapp run Job already mounts), not
  nk-bind-executor-audit/audit-token.
- CCR check now also pins the new reader shape (audience openbao, explicit
  max TTL 15m, token_self_lifecycle) and that the CCR names this script as
  its custody procedure and the bounded-executor-tokens delivery.
- Docs/workplan: this script is the single seeder; railiance-platform
  fences the boundary (nk_bind_executor_custody.py fence) and owns
  manifests/nk-bind-executor-eso.yaml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
This commit is contained in:
tegwick 2026-11-04 02:05:18 +01:00
parent 5e0f496caf
commit 3157454b84
4 changed files with 56 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md
View file

@ -141,7 +141,9 @@ state_hub_task_id: "66b495ba-b54a-59db-b5b4-b9c17649b413"
NK-WP-0056-T15 needs a bearer for `nk-bounded-executor`. Audit-core's registry
must hold the bearer, and so must railiance-platform's CCR-2026-0063 custody path
`platform/workloads/net-kingdom/bounded-executor/audit-sender` (`AUDIT_TOKEN`).
ESO projects that path to `sso/nk-bind-executor-audit:audit-token`.
ESO projects that path to `sso/bounded-executor-tokens:audit-core`, the Secret the rapp
run Job already mounts. CCR-2026-0063 was settled in railiance-platform f3b0c4f,
and it names this script as the single seeder.
Done 2026-11-04. The script
`scripts/seed-nk-bounded-executor-sender.py` has a silent wrapper,
@ -182,9 +184,10 @@ Run the runbook steps in order:
the role and the coding-agent boundary entries.
4. **Verify from the receipt.**
`sso` delivery is complete only when rapp-bounded-executor carries the
ClusterSecretStore and the ExternalSecret `nk-bind-executor-audit`, and mounts
key `audit-token`. Today it mounts `bounded-executor-tokens:audit-core`.
`sso` delivery is complete when railiance-platform has applied
`manifests/nk-bind-executor-eso.yaml`. That creates ExternalSecret
`sso/bounded-executor-tokens`, key `audit-core`, which the rapp Job already mounts.
Before step 3, railiance-platform also runs `nk_bind_executor_custody.py fence`.
## Founder decision 2026-10-31