AUDIT-WP-0018-T05 done: nk-bounded-executor sender and ingress live; workplan finished
Founder ran the runbook 2026-11-04. Read-only re-check 2026-11-07: ingress policy live, image and scope match, seed receipts r1 (refused pre-write), r2 (seeded_pending_sso_delivery), r3 (seeded_and_delivered, sso hash match), expected probe on r2/r3, sso/bounded-executor-tokens SecretSynced. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 73091@bnt-lap001 Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a
This commit is contained in:
parent
3157454b84
commit
782458d327
6 changed files with 119 additions and 8 deletions
|
|
@ -28,7 +28,7 @@
|
|||
| workplan | AUDIT-WP-0015 | blocked | — | workplans/AUDIT-WP-0015-independent-evidence-returns.md |
|
||||
| workplan | AUDIT-WP-0016 | finished | — | workplans/AUDIT-WP-0016-wave2-resource-right-sizing.md |
|
||||
| workplan | AUDIT-WP-0017 | proposed | — | workplans/AUDIT-WP-0017-production-audit-sources-and-correlation.md |
|
||||
| workplan | AUDIT-WP-0018 | active | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md |
|
||||
| workplan | AUDIT-WP-0018 | finished | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md |
|
||||
| task | ADHOC-2026-09-14-T01 | done | — | workplans/ADHOC-2026-09-14.md |
|
||||
| task | ADHOC-2026-09-24-T01 | done | — | workplans/ADHOC-2026-09-24.md |
|
||||
| task | ADHOC-2026-10-15-T01 | done | — | workplans/ADHOC-2026-10-15.md |
|
||||
|
|
@ -116,7 +116,7 @@
|
|||
| task | AUDIT-WP-0018-T02 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md |
|
||||
| task | AUDIT-WP-0018-T03 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md |
|
||||
| task | AUDIT-WP-0018-T04 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md |
|
||||
| task | AUDIT-WP-0018-T05 | wait | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md |
|
||||
| task | AUDIT-WP-0018-T05 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md |
|
||||
| intake | AUDIT-IN-0001 | closed | — | intakes/intakes.md |
|
||||
| intake | AUDIT-IN-0002 | closed | — | intakes/intakes.md |
|
||||
| intake | AUDIT-IN-0003 | closed | — | intakes/intakes.md |
|
||||
|
|
|
|||
|
|
@ -296,6 +296,38 @@ boundary. Nor does it create ClusterSecretStore `openbao-nk-bind-executor-audit`
|
|||
or ExternalSecret `sso/bounded-executor-tokens`, which are railiance-platform's
|
||||
`manifests/nk-bind-executor-eso.yaml`.
|
||||
|
||||
## Status 2026-11-07 — live (AUDIT-WP-0018-T05 done)
|
||||
|
||||
The founder ran the runbook below. The 2026-11-04 status above is superseded.
|
||||
Re-checked read-only on 2026-11-07:
|
||||
|
||||
- **Ingress: live.** The founder applied
|
||||
`audit-core-nk-bounded-executor-ingress` on 2026-11-04 05:59Z, and it matches
|
||||
`deploy/networkpolicies.yaml`. It went in by client-side apply, so it carries
|
||||
a `last-applied-configuration` annotation. See the NK-WP-0058-T07
|
||||
server-side-apply finding.
|
||||
- **Preflight:** the receiver runs `sha256:5f3d01c8…`. The live
|
||||
`nk-bounded-executor` scope entry has write-only access, `secret_policy:
|
||||
reject`, `load-bearing`, and the closing pair `execution.run.started` →
|
||||
`execution.attribution.receipt` within 7200 s.
|
||||
- **Seed:** three receipts.
|
||||
- `docs/evidence/nk-bounded-executor-sender-seed-r1.json`: refused before any
|
||||
write (`token_env_must_be_unset`).
|
||||
- `-r2.json`: `seeded_pending_sso_delivery`. Custody was created at v1, and
|
||||
the registry went from v18 to v19 with the six other senders unchanged.
|
||||
- `-r3.json`: after railiance-platform applied the ESO manifest, the status
|
||||
is `seeded_and_delivered`. Custody was reused and nothing new was written.
|
||||
`sso_secret_hash_match` is `true`.
|
||||
Both r2 and r3 have the expected probe
|
||||
`{"read": 403, "own_tenant": 200, "other_tenant": 403, "other_source": 403}`
|
||||
and `registry_secret_hash_match: true`. No receipt contains a credential
|
||||
value.
|
||||
- **`sso` delivery:** ExternalSecret `sso/bounded-executor-tokens` (store
|
||||
`openbao-nk-bind-executor-audit`) is `SecretSynced`.
|
||||
|
||||
Emission is now NetKingdom's to exercise. Run-receipt detection is armed: the
|
||||
closing pair is live, so a started run with no receipt becomes a finding.
|
||||
|
||||
## Founder runbook — nk-bounded-executor sender
|
||||
|
||||
Run these in order. Steps 1 and 2 can run now. Step 3 depends on CCR-2026-0063:
|
||||
|
|
|
|||
11
docs/evidence/nk-bounded-executor-sender-seed-r1.json
Normal file
11
docs/evidence/nk-bounded-executor-sender-seed-r1.json
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"schema": "audit-core.sender-seed.v1",
|
||||
"sender": "nk-bounded-executor",
|
||||
"ccr": "CCR-2026-0063",
|
||||
"custody_path": "platform/workloads/net-kingdom/bounded-executor/audit-sender",
|
||||
"status": "refused",
|
||||
"credential_values_emitted": false,
|
||||
"started_at": "2026-11-04T22:12:21+00:00",
|
||||
"ccr_sha256": "b81ce3047884ebd5e63e463a34d5d0e34fedd2bbfe6ad10aa4ffe65919f498b7",
|
||||
"error": "token_env_must_be_unset"
|
||||
}
|
||||
29
docs/evidence/nk-bounded-executor-sender-seed-r2.json
Normal file
29
docs/evidence/nk-bounded-executor-sender-seed-r2.json
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"schema": "audit-core.sender-seed.v1",
|
||||
"sender": "nk-bounded-executor",
|
||||
"ccr": "CCR-2026-0063",
|
||||
"custody_path": "platform/workloads/net-kingdom/bounded-executor/audit-sender",
|
||||
"status": "seeded_pending_sso_delivery",
|
||||
"credential_values_emitted": false,
|
||||
"started_at": "2026-11-04T22:14:09+00:00",
|
||||
"ccr_sha256": "b81ce3047884ebd5e63e463a34d5d0e34fedd2bbfe6ad10aa4ffe65919f498b7",
|
||||
"phase": "done",
|
||||
"receiver_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6",
|
||||
"registry_version_before": 18,
|
||||
"other_senders": 6,
|
||||
"custody": "created",
|
||||
"custody_version": 1,
|
||||
"token_sha256_12": "5adf5ae12f0b",
|
||||
"registry": "appended",
|
||||
"registry_version_after": 19,
|
||||
"unchanged_other_senders": true,
|
||||
"registry_secret_hash_match": true,
|
||||
"receiver_probe": {
|
||||
"read": 403,
|
||||
"own_tenant": 200,
|
||||
"other_tenant": 403,
|
||||
"other_source": 403
|
||||
},
|
||||
"sso_secret_hash_match": null,
|
||||
"finished_at": "2026-11-04T22:14:28+00:00"
|
||||
}
|
||||
29
docs/evidence/nk-bounded-executor-sender-seed-r3.json
Normal file
29
docs/evidence/nk-bounded-executor-sender-seed-r3.json
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"schema": "audit-core.sender-seed.v1",
|
||||
"sender": "nk-bounded-executor",
|
||||
"ccr": "CCR-2026-0063",
|
||||
"custody_path": "platform/workloads/net-kingdom/bounded-executor/audit-sender",
|
||||
"status": "seeded_and_delivered",
|
||||
"credential_values_emitted": false,
|
||||
"started_at": "2026-11-04T22:33:29+00:00",
|
||||
"ccr_sha256": "b81ce3047884ebd5e63e463a34d5d0e34fedd2bbfe6ad10aa4ffe65919f498b7",
|
||||
"phase": "done",
|
||||
"receiver_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6",
|
||||
"registry_version_before": 19,
|
||||
"other_senders": 6,
|
||||
"custody": "reused",
|
||||
"custody_version": 1,
|
||||
"token_sha256_12": "5adf5ae12f0b",
|
||||
"registry": "already_present",
|
||||
"registry_version_after": 19,
|
||||
"unchanged_other_senders": true,
|
||||
"registry_secret_hash_match": true,
|
||||
"receiver_probe": {
|
||||
"read": 403,
|
||||
"own_tenant": 200,
|
||||
"other_tenant": 403,
|
||||
"other_source": 403
|
||||
},
|
||||
"sso_secret_hash_match": true,
|
||||
"finished_at": "2026-11-04T22:33:48+00:00"
|
||||
}
|
||||
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Hold bounded-executor execution-attribution receipts"
|
||||
domain: infotech
|
||||
repo: audit-core
|
||||
status: active
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: audit-core
|
||||
topic_slug: audit-evidence-dependencies
|
||||
created: "2026-10-31"
|
||||
updated: "2026-11-04"
|
||||
updated: "2026-11-07"
|
||||
related:
|
||||
- NK-WP-0056
|
||||
- NK-WP-0040
|
||||
|
|
@ -167,11 +167,8 @@ in `deploy/networkpolicies.yaml` match live.
|
|||
|
||||
```task
|
||||
id: AUDIT-WP-0018-T05
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
needs_human: true
|
||||
blocked_on: human
|
||||
blocking_reason: "Founder-run live change; seed step also needs CCR-2026-0063 approved and applied by railiance-platform"
|
||||
state_hub_task_id: "fe4fbf46-0ef0-5773-85f3-9ec8d443ca57"
|
||||
```
|
||||
|
||||
|
|
@ -189,6 +186,19 @@ Run the runbook steps in order:
|
|||
`sso/bounded-executor-tokens`, key `audit-core`, which the rapp Job already mounts.
|
||||
Before step 3, railiance-platform also runs `nk_bind_executor_custody.py fence`.
|
||||
|
||||
Done 2026-11-04 by the founder; verified read-only 2026-11-07.
|
||||
|
||||
- **Ingress:** live since 2026-11-04 05:59Z.
|
||||
- **Preflight:** the image and scope match.
|
||||
- **Seed:** three receipts. r1 refused before any write (token env set). r2
|
||||
`seeded_pending_sso_delivery`: custody v1, registry v18 to v19. r3
|
||||
`seeded_and_delivered`: the `sso` hash matches. r2 and r3 both have the
|
||||
expected probe.
|
||||
- **`sso` delivery:** `sso/bounded-executor-tokens` is `SecretSynced`.
|
||||
|
||||
Evidence: `docs/evidence/nk-bounded-executor-sender-seed-r{1,2,3}.json`.
|
||||
Status: `docs/bounded-executor-receipts.md`, "Status 2026-11-07".
|
||||
|
||||
## Founder decision 2026-10-31
|
||||
|
||||
Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). Founder adopted the `execution.run.started` event plus one receipt per run with an admission-level target/action, `steps[]` detail and labelled `decision_refs`.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue