- sso delivery is ExternalSecret/Secret sso/bounded-executor-tokens key
audit-core (the Secret the rapp run Job already mounts), not
nk-bind-executor-audit/audit-token.
- CCR check now also pins the new reader shape (audience openbao, explicit
max TTL 15m, token_self_lifecycle) and that the CCR names this script as
its custody procedure and the bounded-executor-tokens delivery.
- Docs/workplan: this script is the single seeder; railiance-platform
fences the boundary (nk_bind_executor_custody.py fence) and owns
manifests/nk-bind-executor-eso.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
- scripts/seed-nk-bounded-executor-sender.py (+ silent attended wrapper):
one attended process mints once, writes CCR-2026-0063 custody
(platform/workloads/net-kingdom/bounded-executor/audit-sender, cas 0) and
appends the sender to the audit-core registry (cas), syncs
audit-core-senders and compares by hash, restarts the receiver, probes the
live scope without writing an event, and checks sso/nk-bind-executor-audit
by hash when it exists. Receipt only; no value printed or stored.
- Refuses unless CCR-2026-0063 is approved by its three owners, cluster is
railiance01, receiver image and live scope ConfigMap match, the ingress
policy exists and the coding-agent boundary covers the custody path.
- tests/test_seed_nk_bounded_executor_sender.py: 16 synthetic tests,
including the probe run against the real receiver over HTTP.
- docs/bounded-executor-receipts.md: 2026-11-04 live state and founder
runbook (single-object ingress apply, preflight, seed, verify).
- Read-only check: ingress policy not live; other nine policies match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
A sender may declare closing_classes; nk-bounded-executor declares
execution.run.started closed by execution.attribution.receipt within
7200s. GET /v1/stream-findings reports opening_without_closing past the
bound, counted from the receiver's accepted_at plus the heartbeat grace
allowance; a per-run data.window.not_after tightens but never extends.
Identifiers and timing only. The overlay may add or shorten, never
remove, rebind or lengthen. Both backends: 403 passed (1 unrelated
live-catalog env failure).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
Carries the T06 independent full-scope reconciliation reader and the
AUDIT-WP-0018-T02 reject-only secret_policy overlay. No migration beyond
0007; the migration Job needs no rerun. Full suite incl. PostgreSQL
backend: 373 passed (1 unrelated live-catalog env failure).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 482098@bnt-lap001
Assistant-Session: 9643c95a-a398-4f4a-b56a-6119be4e845e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
GET /v1/reconciliation now admits may_read + tenants ["*"] identities for
any source, marked basis: independent_reader. Scoped readers get 403
full_tenant_scope_required; writers keep 403 source_not_allowed. Counts only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
The generated index had drifted from the workplan files. The opt-in lets
the pre-commit hook rebuild WORK-RECORDS.md in the same commit as the
workplan it indexes.
Assistant: grok
Assistant-Session: 01a17f9d-fe9d-7d72-9a22-6304f1a2a790
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows.
Assistant: grok
Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Receiving workplan for the 2026-10-21 node allocation review
(RESOURCE-WP-0008-T03 / CUST-WP-0071-T03). Wave-2 apply is human-gated;
no manifest changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 812331@bnt-lap001
Assistant-Session: 79bd2b91-2b30-4206-83a2-182ad376169b
Updated by fix-consistency on 2026-10-10:
- update .custodian-brief.md for audit-core
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 812331@bnt-lap001
Assistant-Session: 79bd2b91-2b30-4206-83a2-182ad376169b
The §9.6 failure-path release is refused; no new declaration field.
Existing load-bearing completeness_trade refusal already conforms.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 812331@bnt-lap001
Assistant-Session: 79bd2b91-2b30-4206-83a2-182ad376169b
Accept the retained pose envelope and refuse packet, brief, and secret
content. Heartbeat and reconciliation follow the existing load-bearing
class pattern. This does not connect the sink or claim runtime readiness.
Assistant: grok
Assistant-Session: 01a10329-31cb-78d3-b7a3-787a69c89d54
Updated by fix-consistency on 2026-09-24:
- update .custodian-brief.md for audit-core
Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151986@bnt-lap001
Assistant-Session: ccd02b6b-80ae-48e5-8cad-9c8f74d21a67
