AUDIT-WP-0018-T05 done: nk-bounded-executor sender and ingress live; workplan finished

Founder ran the runbook 2026-11-04. Read-only re-check 2026-11-07: ingress
policy live, image and scope match, seed receipts r1 (refused pre-write),
r2 (seeded_pending_sso_delivery), r3 (seeded_and_delivered, sso hash match),
expected probe on r2/r3, sso/bounded-executor-tokens SecretSynced.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 73091@bnt-lap001
Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a

docs/bounded-executor-receipts.md

@@ -296,6 +296,38 @@ boundary. Nor does it create ClusterSecretStore `openbao-nk-bind-executor-audit`
 or ExternalSecret `sso/bounded-executor-tokens`, which are railiance-platform's
 `manifests/nk-bind-executor-eso.yaml`.
 
+## Status 2026-11-07 — live (AUDIT-WP-0018-T05 done)
+
+The founder ran the runbook below. The 2026-11-04 status above is superseded.
+Re-checked read-only on 2026-11-07:
+
+- **Ingress: live.** The founder applied
+  `audit-core-nk-bounded-executor-ingress` on 2026-11-04 05:59Z, and it matches
+  `deploy/networkpolicies.yaml`. It went in by client-side apply, so it carries
+  a `last-applied-configuration` annotation. See the NK-WP-0058-T07
+  server-side-apply finding.
+- **Preflight:** the receiver runs `sha256:5f3d01c8…`. The live
+  `nk-bounded-executor` scope entry has write-only access, `secret_policy:
+  reject`, `load-bearing`, and the closing pair `execution.run.started` →
+  `execution.attribution.receipt` within 7200 s.
+- **Seed:** three receipts.
+  - `docs/evidence/nk-bounded-executor-sender-seed-r1.json`: refused before any
+    write (`token_env_must_be_unset`).
+  - `-r2.json`: `seeded_pending_sso_delivery`. Custody was created at v1, and
+    the registry went from v18 to v19 with the six other senders unchanged.
+  - `-r3.json`: after railiance-platform applied the ESO manifest, the status
+    is `seeded_and_delivered`. Custody was reused and nothing new was written.
+    `sso_secret_hash_match` is `true`.
+  Both r2 and r3 have the expected probe
+  `{"read": 403, "own_tenant": 200, "other_tenant": 403, "other_source": 403}`
+  and `registry_secret_hash_match: true`. No receipt contains a credential
+  value.
+- **`sso` delivery:** ExternalSecret `sso/bounded-executor-tokens` (store
+  `openbao-nk-bind-executor-audit`) is `SecretSynced`.
+
+Emission is now NetKingdom's to exercise. Run-receipt detection is armed: the
+closing pair is live, so a started run with no receipt becomes a finding.
+
 ## Founder runbook — nk-bounded-executor sender
 
 Run these in order. Steps 1 and 2 can run now. Step 3 depends on CCR-2026-0063: