coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ADHOC-2026-11-07: adopt NK-WP-0058-T07 runbook conventions; unstale CCR seed test

Browse source 
One cluster route (NK_KUBECONFIG, default ~/.kube/config-railiance01) and
server-side apply throughout. Fixes the Makefile dry-run defaulting to the
coulombcore kubeconfig. Lane-run scripts take no default and fail closed when
NK_KUBECONFIG is unset. net-kingdom convention lint: 14 findings -> 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 73091@bnt-lap001
Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a
This commit is contained in:
tegwick 2026-11-07 13:25:02 +01:00
parent 782458d327
commit 5649ef90c4
13 changed files with 110 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/bounded-executor-receipts.md
View file

@ -339,15 +339,21 @@ run `nk_bind_executor_custody.py fence` for the coding-agent boundary entries.
dry-run first, then the apply:
```bash
cd /home/worsch/audit-core && python3 -c 'import sys,yaml; d=[x for x in yaml.safe_load_all(open("deploy/networkpolicies.yaml")) if x and x["metadata"]["name"]=="audit-core-nk-bounded-executor-ingress"]; assert len(d)==1; yaml.safe_dump(d[0],sys.stdout)' | KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl apply --dry-run=server -f -
cd /home/worsch/audit-core && python3 -c 'import sys,yaml; d=[x for x in yaml.safe_load_all(open("deploy/networkpolicies.yaml")) if x and x["metadata"]["name"]=="audit-core-nk-bounded-executor-ingress"]; assert len(d)==1; yaml.safe_dump(d[0],sys.stdout)' | KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl apply -f -
cd /home/worsch/audit-core && python3 -c 'import sys,yaml; d=[x for x in yaml.safe_load_all(open("deploy/networkpolicies.yaml")) if x and x["metadata"]["name"]=="audit-core-nk-bounded-executor-ingress"]; assert len(d)==1; yaml.safe_dump(d[0],sys.stdout)' | KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}" kubectl apply --server-side --dry-run=server -f -
cd /home/worsch/audit-core && python3 -c 'import sys,yaml; d=[x for x in yaml.safe_load_all(open("deploy/networkpolicies.yaml")) if x and x["metadata"]["name"]=="audit-core-nk-bounded-executor-ingress"]; assert len(d)==1; yaml.safe_dump(d[0],sys.stdout)' | KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}" kubectl apply --server-side -f -
```
All cluster commands here use the one cluster route (NK-WP-0058-T07):
`NK_KUBECONFIG`, default `~/.kube/config-railiance01`. Every apply is
server-side. The 2026-11-04 apply was client-side, so the live object still
carries a `last-applied-configuration` annotation. A later server-side apply
takes the object over, so nothing needs to be done now.
**2. Read-only preflight** (prints no secrets):
```bash
KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl -n audit-core get configmap audit-core-senders-scope -o jsonpath='{.data.senders-scope\.json}' | python3 -c 'import sys,json; print([e for e in json.load(sys.stdin) if e["name"]=="nk-bounded-executor"])'
KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl -n audit-core get deploy audit-core -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}" kubectl -n audit-core get configmap audit-core-senders-scope -o jsonpath='{.data.senders-scope\.json}' | python3 -c 'import sys,json; print([e for e in json.load(sys.stdin) if e["name"]=="nk-bounded-executor"])'
KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}" kubectl -n audit-core get deploy audit-core -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
bridge status
```
@ -360,7 +366,7 @@ This is one silent command. Read the result from the receipt, not from the
terminal:
```bash
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- /home/worsch/audit-core/scripts/attended-seed-nk-bounded-executor-sender.sh /home/worsch/audit-core/docs/evidence/nk-bounded-executor-sender-seed-r1.json
BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- env NK_KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}" /home/worsch/audit-core/scripts/attended-seed-nk-bounded-executor-sender.sh /home/worsch/audit-core/docs/evidence/nk-bounded-executor-sender-seed-r1.json
```
The receipt is created exclusively. If you rerun, use `-r2.json`. The receiver
@ -370,7 +376,7 @@ restart is part of this step. No separate rollout is needed.
```bash
python3 -c 'import json; r=json.load(open("/home/worsch/audit-core/docs/evidence/nk-bounded-executor-sender-seed-r1.json")); print(r["status"], r.get("error"), r.get("receiver_probe"), r.get("registry_secret_hash_match"), r.get("sso_secret_hash_match"), r["credential_values_emitted"])'
KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl -n audit-core get networkpolicy audit-core-nk-bounded-executor-ingress
KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}" kubectl -n audit-core get networkpolicy audit-core-nk-bounded-executor-ingress
```
The expected status is `seeded_pending_sso_delivery`, or `seeded_and_delivered`