AUDIT-WP-0018-T02 done: nk-bounded-executor sender scope and sso ingress prepared

- deploy/senders-scope.{json,yaml}: nk-bounded-executor (source
  net-kingdom.bounded-executor, tenants [platform], write-only,
  secret_policy reject, load-bearing); inert until a token is seeded
- senders.py: the scope overlay may tighten secret_policy redact->reject,
  never relax it
- networkpolicies.yaml: audit-core-nk-bounded-executor-ingress (sso AND
  app.kubernetes.io/name=bounded-executor, TCP 8080); not applied
- tests on the executor's envelope shape: 202, 200 duplicate, 409, wrong
  source/tenant, secret-shaped step check 400
- T03 unblocked (window bound = admission window.not_after)
- docs: emitter defect: executor AuditCore.emit rejects 202

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

deploy/networkpolicies.yaml

@@ -63,6 +63,33 @@ spec:
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: audit-core-nk-bounded-executor-ingress
+  namespace: audit-core
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: audit-core
+  policyTypes: [Ingress]
+  ingress:
+    # AUDIT-WP-0018-T02. NetKingdom's bounded executor (Job pods run as
+    # ServiceAccount nk-bind-executor, package rapp-bounded-executor). Both
+    # selectors belong to one peer and are therefore ANDed. The whole sso
+    # namespace is NOT admitted: Authelia, LLDAP and KeyCape run there too.
+    # Prepared, not applied: the rollout is founder-run, together with the
+    # nk-bounded-executor registry seed.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: sso
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: bounded-executor
+      ports:
+        - {protocol: TCP, port: 8080}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: audit-core-whitehat-ingress
   namespace: audit-core

deploy/senders-scope.json

@@ -49,5 +49,18 @@
     "heartbeat_classes": {
       "informed-decision.memo.posed": 86400
     }
+  },
+  {
+    "name": "nk-bounded-executor",
+    "sources": [
+      "net-kingdom.bounded-executor"
+    ],
+    "tenants": [
+      "platform"
+    ],
+    "may_write": true,
+    "may_read": false,
+    "secret_policy": "reject",
+    "evidence_kind": "load-bearing"
   }
 ]

deploy/senders-scope.yaml

@@ -7,6 +7,10 @@
 # entry here for a sender with no token yet is inert. That is what makes the
 # approval-engine entry safe to land ahead of its credential.
 #
+# secret_policy may be tightened here (redact -> reject) but never relaxed
+# (AUDIT-WP-0018-T02): nk-bounded-executor receipts are kept by hash, so a
+# secret-shaped field must refuse the event rather than be silently masked.
+#
 # evidence_kind may be raised here (attributive -> load-bearing) but never
 # lowered: a ConfigMap refresh must not be able to drop a source's §9.6
 # atomicity and detection obligations without anyone deciding to.
@@ -71,5 +75,18 @@ data:
         "heartbeat_classes": {
           "informed-decision.memo.posed": 86400
         }
+      },
+      {
+        "name": "nk-bounded-executor",
+        "sources": [
+          "net-kingdom.bounded-executor"
+        ],
+        "tenants": [
+          "platform"
+        ],
+        "may_write": true,
+        "may_read": false,
+        "secret_policy": "reject",
+        "evidence_kind": "load-bearing"
       }
     ]