From 782458d32709a41c8587c0f560011782ecdf1089 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 7 Nov 2026 13:09:17 +0100 Subject: [PATCH] AUDIT-WP-0018-T05 done: nk-bounded-executor sender and ingress live; workplan finished Founder ran the runbook 2026-11-04. Read-only re-check 2026-11-07: ingress policy live, image and scope match, seed receipts r1 (refused pre-write), r2 (seeded_pending_sso_delivery), r3 (seeded_and_delivered, sso hash match), expected probe on r2/r3, sso/bounded-executor-tokens SecretSynced. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 73091@bnt-lap001 Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a --- WORK-RECORDS.md | 4 +-- docs/bounded-executor-receipts.md | 32 +++++++++++++++++++ .../nk-bounded-executor-sender-seed-r1.json | 11 +++++++ .../nk-bounded-executor-sender-seed-r2.json | 29 +++++++++++++++++ .../nk-bounded-executor-sender-seed-r3.json | 29 +++++++++++++++++ ...P-0018-bounded-executor-receipt-custody.md | 22 +++++++++---- 6 files changed, 119 insertions(+), 8 deletions(-) create mode 100644 docs/evidence/nk-bounded-executor-sender-seed-r1.json create mode 100644 docs/evidence/nk-bounded-executor-sender-seed-r2.json create mode 100644 docs/evidence/nk-bounded-executor-sender-seed-r3.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 59a2d60..8d14694 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -28,7 +28,7 @@ | workplan | AUDIT-WP-0015 | blocked | — | workplans/AUDIT-WP-0015-independent-evidence-returns.md | | workplan | AUDIT-WP-0016 | finished | — | workplans/AUDIT-WP-0016-wave2-resource-right-sizing.md | | workplan | AUDIT-WP-0017 | proposed | — | workplans/AUDIT-WP-0017-production-audit-sources-and-correlation.md | -| workplan | AUDIT-WP-0018 | active | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md | +| workplan | AUDIT-WP-0018 | finished | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md | | task | ADHOC-2026-09-14-T01 | done | — | workplans/ADHOC-2026-09-14.md | | task | ADHOC-2026-09-24-T01 | done | — | workplans/ADHOC-2026-09-24.md | | task | ADHOC-2026-10-15-T01 | done | — | workplans/ADHOC-2026-10-15.md | @@ -116,7 +116,7 @@ | task | AUDIT-WP-0018-T02 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md | | task | AUDIT-WP-0018-T03 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md | | task | AUDIT-WP-0018-T04 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md | -| task | AUDIT-WP-0018-T05 | wait | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md | +| task | AUDIT-WP-0018-T05 | done | — | workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md | | intake | AUDIT-IN-0001 | closed | — | intakes/intakes.md | | intake | AUDIT-IN-0002 | closed | — | intakes/intakes.md | | intake | AUDIT-IN-0003 | closed | — | intakes/intakes.md | diff --git a/docs/bounded-executor-receipts.md b/docs/bounded-executor-receipts.md index b1aa8af..e9df179 100644 --- a/docs/bounded-executor-receipts.md +++ b/docs/bounded-executor-receipts.md @@ -296,6 +296,38 @@ boundary. Nor does it create ClusterSecretStore `openbao-nk-bind-executor-audit` or ExternalSecret `sso/bounded-executor-tokens`, which are railiance-platform's `manifests/nk-bind-executor-eso.yaml`. +## Status 2026-11-07 — live (AUDIT-WP-0018-T05 done) + +The founder ran the runbook below. The 2026-11-04 status above is superseded. +Re-checked read-only on 2026-11-07: + +- **Ingress: live.** The founder applied + `audit-core-nk-bounded-executor-ingress` on 2026-11-04 05:59Z, and it matches + `deploy/networkpolicies.yaml`. It went in by client-side apply, so it carries + a `last-applied-configuration` annotation. See the NK-WP-0058-T07 + server-side-apply finding. +- **Preflight:** the receiver runs `sha256:5f3d01c8…`. The live + `nk-bounded-executor` scope entry has write-only access, `secret_policy: + reject`, `load-bearing`, and the closing pair `execution.run.started` → + `execution.attribution.receipt` within 7200 s. +- **Seed:** three receipts. + - `docs/evidence/nk-bounded-executor-sender-seed-r1.json`: refused before any + write (`token_env_must_be_unset`). + - `-r2.json`: `seeded_pending_sso_delivery`. Custody was created at v1, and + the registry went from v18 to v19 with the six other senders unchanged. + - `-r3.json`: after railiance-platform applied the ESO manifest, the status + is `seeded_and_delivered`. Custody was reused and nothing new was written. + `sso_secret_hash_match` is `true`. + Both r2 and r3 have the expected probe + `{"read": 403, "own_tenant": 200, "other_tenant": 403, "other_source": 403}` + and `registry_secret_hash_match: true`. No receipt contains a credential + value. +- **`sso` delivery:** ExternalSecret `sso/bounded-executor-tokens` (store + `openbao-nk-bind-executor-audit`) is `SecretSynced`. + +Emission is now NetKingdom's to exercise. Run-receipt detection is armed: the +closing pair is live, so a started run with no receipt becomes a finding. + ## Founder runbook — nk-bounded-executor sender Run these in order. Steps 1 and 2 can run now. Step 3 depends on CCR-2026-0063: diff --git a/docs/evidence/nk-bounded-executor-sender-seed-r1.json b/docs/evidence/nk-bounded-executor-sender-seed-r1.json new file mode 100644 index 0000000..ed0ba48 --- /dev/null +++ b/docs/evidence/nk-bounded-executor-sender-seed-r1.json @@ -0,0 +1,11 @@ +{ + "schema": "audit-core.sender-seed.v1", + "sender": "nk-bounded-executor", + "ccr": "CCR-2026-0063", + "custody_path": "platform/workloads/net-kingdom/bounded-executor/audit-sender", + "status": "refused", + "credential_values_emitted": false, + "started_at": "2026-11-04T22:12:21+00:00", + "ccr_sha256": "b81ce3047884ebd5e63e463a34d5d0e34fedd2bbfe6ad10aa4ffe65919f498b7", + "error": "token_env_must_be_unset" +} diff --git a/docs/evidence/nk-bounded-executor-sender-seed-r2.json b/docs/evidence/nk-bounded-executor-sender-seed-r2.json new file mode 100644 index 0000000..4e4a04b --- /dev/null +++ b/docs/evidence/nk-bounded-executor-sender-seed-r2.json @@ -0,0 +1,29 @@ +{ + "schema": "audit-core.sender-seed.v1", + "sender": "nk-bounded-executor", + "ccr": "CCR-2026-0063", + "custody_path": "platform/workloads/net-kingdom/bounded-executor/audit-sender", + "status": "seeded_pending_sso_delivery", + "credential_values_emitted": false, + "started_at": "2026-11-04T22:14:09+00:00", + "ccr_sha256": "b81ce3047884ebd5e63e463a34d5d0e34fedd2bbfe6ad10aa4ffe65919f498b7", + "phase": "done", + "receiver_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6", + "registry_version_before": 18, + "other_senders": 6, + "custody": "created", + "custody_version": 1, + "token_sha256_12": "5adf5ae12f0b", + "registry": "appended", + "registry_version_after": 19, + "unchanged_other_senders": true, + "registry_secret_hash_match": true, + "receiver_probe": { + "read": 403, + "own_tenant": 200, + "other_tenant": 403, + "other_source": 403 + }, + "sso_secret_hash_match": null, + "finished_at": "2026-11-04T22:14:28+00:00" +} diff --git a/docs/evidence/nk-bounded-executor-sender-seed-r3.json b/docs/evidence/nk-bounded-executor-sender-seed-r3.json new file mode 100644 index 0000000..7a3a07f --- /dev/null +++ b/docs/evidence/nk-bounded-executor-sender-seed-r3.json @@ -0,0 +1,29 @@ +{ + "schema": "audit-core.sender-seed.v1", + "sender": "nk-bounded-executor", + "ccr": "CCR-2026-0063", + "custody_path": "platform/workloads/net-kingdom/bounded-executor/audit-sender", + "status": "seeded_and_delivered", + "credential_values_emitted": false, + "started_at": "2026-11-04T22:33:29+00:00", + "ccr_sha256": "b81ce3047884ebd5e63e463a34d5d0e34fedd2bbfe6ad10aa4ffe65919f498b7", + "phase": "done", + "receiver_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6", + "registry_version_before": 19, + "other_senders": 6, + "custody": "reused", + "custody_version": 1, + "token_sha256_12": "5adf5ae12f0b", + "registry": "already_present", + "registry_version_after": 19, + "unchanged_other_senders": true, + "registry_secret_hash_match": true, + "receiver_probe": { + "read": 403, + "own_tenant": 200, + "other_tenant": 403, + "other_source": 403 + }, + "sso_secret_hash_match": true, + "finished_at": "2026-11-04T22:33:48+00:00" +} diff --git a/workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md b/workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md index df0295f..d4e45b8 100644 --- a/workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md +++ b/workplans/AUDIT-WP-0018-bounded-executor-receipt-custody.md @@ -4,12 +4,12 @@ type: workplan title: "Hold bounded-executor execution-attribution receipts" domain: infotech repo: audit-core -status: active +status: finished flavor: implementation owner: audit-core topic_slug: audit-evidence-dependencies created: "2026-10-31" -updated: "2026-11-04" +updated: "2026-11-07" related: - NK-WP-0056 - NK-WP-0040 @@ -167,11 +167,8 @@ in `deploy/networkpolicies.yaml` match live. ```task id: AUDIT-WP-0018-T05 -status: wait +status: done priority: high -needs_human: true -blocked_on: human -blocking_reason: "Founder-run live change; seed step also needs CCR-2026-0063 approved and applied by railiance-platform" state_hub_task_id: "fe4fbf46-0ef0-5773-85f3-9ec8d443ca57" ``` @@ -189,6 +186,19 @@ Run the runbook steps in order: `sso/bounded-executor-tokens`, key `audit-core`, which the rapp Job already mounts. Before step 3, railiance-platform also runs `nk_bind_executor_custody.py fence`. +Done 2026-11-04 by the founder; verified read-only 2026-11-07. + +- **Ingress:** live since 2026-11-04 05:59Z. +- **Preflight:** the image and scope match. +- **Seed:** three receipts. r1 refused before any write (token env set). r2 + `seeded_pending_sso_delivery`: custody v1, registry v18 to v19. r3 + `seeded_and_delivered`: the `sso` hash matches. r2 and r3 both have the + expected probe. +- **`sso` delivery:** `sso/bounded-executor-tokens` is `SecretSynced`. + +Evidence: `docs/evidence/nk-bounded-executor-sender-seed-r{1,2,3}.json`. +Status: `docs/bounded-executor-receipts.md`, "Status 2026-11-07". + ## Founder decision 2026-10-31 Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). Founder adopted the `execution.run.started` event plus one receipt per run with an admission-level target/action, `steps[]` detail and labelled `decision_refs`.