AUDIT-WP-0018-T04: founder-run seed of the nk-bounded-executor bearer; T05 live activation waits

- scripts/seed-nk-bounded-executor-sender.py (+ silent attended wrapper):
  one attended process mints once, writes CCR-2026-0063 custody
  (platform/workloads/net-kingdom/bounded-executor/audit-sender, cas 0) and
  appends the sender to the audit-core registry (cas), syncs
  audit-core-senders and compares by hash, restarts the receiver, probes the
  live scope without writing an event, and checks sso/nk-bind-executor-audit
  by hash when it exists. Receipt only; no value printed or stored.
- Refuses unless CCR-2026-0063 is approved by its three owners, cluster is
  railiance01, receiver image and live scope ConfigMap match, the ingress
  policy exists and the coding-agent boundary covers the custody path.
- tests/test_seed_nk_bounded_executor_sender.py: 16 synthetic tests,
  including the probe run against the real receiver over HTTP.
- docs/bounded-executor-receipts.md: 2026-11-04 live state and founder
  runbook (single-object ingress apply, preflight, seed, verify).
- Read-only check: ingress policy not live; other nine policies match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

docs/bounded-executor-receipts.md

@@ -229,3 +229,114 @@ Released 2026-11-03: receiver `sha256:5f3d01c8…` (built from 2b8c909) and
 the scope ConfigMap carrying `closing_classes` are live on railiance01. The
 detection is inert until the `nk-bounded-executor` token is seeded and the
 executor emits.
+
+## Status 2026-11-04 — what is still needed live (NK-WP-0056-T15/T16)
+
+Checked read-only on 2026-11-04 with the default (limited) identity:
+
+- **Ingress: not live.** `audit-core-nk-bounded-executor-ingress` is the only
+  object in `deploy/networkpolicies.yaml` that is absent on railiance01. The
+  nine other policies in that file match the live specs exactly. The
+  executor's own egress (`sso/bounded-executor`, to `audit-core` pods on 8080) is
+  already live.
+- **Scope ConfigMap:** the limited identity cannot read ConfigMaps in
+  `audit-core`. The release on 2026-11-03 is recorded in 06d0029. The seed
+  script below refuses unless the live entry equals `deploy/senders-scope.json`.
+- **Bearer: not minted.** The registry is OpenBao
+  `platform/workloads/audit-core/senders` (field `senders.json`). ExternalSecret
+  `audit-core/audit-core-senders` projects it into the receiver. The same
+  pattern served tenant-engine and the CCR-2026-0021/0022 senders.
+
+How the token reaches both sides. One founder-run process,
+`scripts/seed-nk-bounded-executor-sender.py`, does the following:
+
+1. It mints one bearer.
+2. It writes the bearer with cas 0 to
+   `platform/workloads/net-kingdom/bounded-executor/audit-sender` (`AUDIT_TOKEN`,
+   `CUSTODY_REQUEST=CCR-2026-0063`).
+3. It appends the `nk-bounded-executor` entry to the registry. The entry is the
+   declared scope plus the token, written with cas on the version read. Every
+   other sender stays byte-equal.
+4. It force-syncs `audit-core-senders` and compares the token by SHA-256 only.
+5. It restarts the receiver.
+6. It proves the bearer without writing an event. Inside the receiver pod, with
+   the bearer on stdin:
+   - a read gets 403 (write-only);
+   - reconciliation for its own source and tenant `platform` gets 200;
+   - tenant `tenant:platform` gets 403;
+   - another source gets 403.
+   An unknown bearer gets 401.
+7. It force-syncs `sso/nk-bind-executor-audit` and compares `audit-token` by
+   hash, but only if that ExternalSecret exists.
+
+The script is silent. The receipt holds versions, booleans and a 12-hex
+fingerprint. A rerun reuses its own custody and writes nothing new. It refuses
+foreign or drifted custody, a sender registered without custody, a token
+collision and a concurrent registry write. Tests:
+`tests/test_seed_nk_bounded_executor_sender.py`.
+
+The script refuses before any write unless all of the following hold:
+
+- CCR-2026-0063 is `approved` or later, with all three owner reviews;
+- the cluster is railiance01 (kube-system UID);
+- the receiver runs the pinned image;
+- the live scope ConfigMap matches;
+- the ingress policy exists;
+- the coding-agent boundary already denies the custody data and metadata paths.
+
+It does not create the reader policy, the role or the boundary
+(railiance-platform). It also does not create the `sso` ClusterSecretStore and
+ExternalSecret, which belong to the rapp-bounded-executor package (CCR-2026-0063
+`delivery.target`).
+
+## Founder runbook — nk-bounded-executor sender
+
+Run these in order. Steps 1 and 2 can run now. Step 3 depends on CCR-2026-0063:
+railiance-platform must have it approved by platform-owner, audit-core-owner and
+net-kingdom-owner, and must have applied its reader policy, role and
+coding-agent boundary entries.
+
+**1. Ingress (NK-WP-0056-T16).** This applies exactly one object. Run the server
+dry-run first, then the apply:
+
+```bash
+cd /home/worsch/audit-core && python3 -c 'import sys,yaml; d=[x for x in yaml.safe_load_all(open("deploy/networkpolicies.yaml")) if x and x["metadata"]["name"]=="audit-core-nk-bounded-executor-ingress"]; assert len(d)==1; yaml.safe_dump(d[0],sys.stdout)' | KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl apply --dry-run=server -f -
+cd /home/worsch/audit-core && python3 -c 'import sys,yaml; d=[x for x in yaml.safe_load_all(open("deploy/networkpolicies.yaml")) if x and x["metadata"]["name"]=="audit-core-nk-bounded-executor-ingress"]; assert len(d)==1; yaml.safe_dump(d[0],sys.stdout)' | KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl apply -f -
+```
+
+**2. Read-only preflight** (prints no secrets):
+
+```bash
+KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl -n audit-core get configmap audit-core-senders-scope -o jsonpath='{.data.senders-scope\.json}' | python3 -c 'import sys,json; print([e for e in json.load(sys.stdin) if e["name"]=="nk-bounded-executor"])'
+KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl -n audit-core get deploy audit-core -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
+bridge status
+```
+
+The image must end in
+`sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6`.
+The `openbao-ui-railiance01` tunnel must be up.
+
+**3. Seed and reload (NK-WP-0056-T15). Needs CCR-2026-0063 approved and applied.**
+This is one silent command. Read the result from the receipt, not from the
+terminal:
+
+```bash
+BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 warden access openbao-platform-admin-login --exec -- /home/worsch/audit-core/scripts/attended-seed-nk-bounded-executor-sender.sh /home/worsch/audit-core/docs/evidence/nk-bounded-executor-sender-seed-r1.json
+```
+
+The receipt is created exclusively. If you rerun, use `-r2.json`. The receiver
+restart is part of this step. No separate rollout is needed.
+
+**4. Verify** (read-only):
+
+```bash
+python3 -c 'import json; r=json.load(open("/home/worsch/audit-core/docs/evidence/nk-bounded-executor-sender-seed-r1.json")); print(r["status"], r.get("error"), r.get("receiver_probe"), r.get("registry_secret_hash_match"), r.get("sso_secret_hash_match"), r["credential_values_emitted"])'
+KUBECONFIG=/home/worsch/.kube/config-railiance01 kubectl -n audit-core get networkpolicy audit-core-nk-bounded-executor-ingress
+```
+
+The expected status is `seeded_pending_sso_delivery`, or `seeded_and_delivered`
+once the rapp package's ExternalSecret exists. The expected probe is
+`{"read": 403, "own_tenant": 200, "other_tenant": 403, "other_source": 403}`.
+After the rapp package applies `sso/nk-bind-executor-audit`, rerun step 3 with
+`-r2.json`. It writes no custody or registry and confirms the `sso` copy by
+hash.