- sso delivery is ExternalSecret/Secret sso/bounded-executor-tokens key
audit-core (the Secret the rapp run Job already mounts), not
nk-bind-executor-audit/audit-token.
- CCR check now also pins the new reader shape (audience openbao, explicit
max TTL 15m, token_self_lifecycle) and that the CCR names this script as
its custody procedure and the bounded-executor-tokens delivery.
- Docs/workplan: this script is the single seeder; railiance-platform
fences the boundary (nk_bind_executor_custody.py fence) and owns
manifests/nk-bind-executor-eso.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
- scripts/seed-nk-bounded-executor-sender.py (+ silent attended wrapper):
one attended process mints once, writes CCR-2026-0063 custody
(platform/workloads/net-kingdom/bounded-executor/audit-sender, cas 0) and
appends the sender to the audit-core registry (cas), syncs
audit-core-senders and compares by hash, restarts the receiver, probes the
live scope without writing an event, and checks sso/nk-bind-executor-audit
by hash when it exists. Receipt only; no value printed or stored.
- Refuses unless CCR-2026-0063 is approved by its three owners, cluster is
railiance01, receiver image and live scope ConfigMap match, the ingress
policy exists and the coding-agent boundary covers the custody path.
- tests/test_seed_nk_bounded_executor_sender.py: 16 synthetic tests,
including the probe run against the real receiver over HTTP.
- docs/bounded-executor-receipts.md: 2026-11-04 live state and founder
runbook (single-object ingress apply, preflight, seed, verify).
- Read-only check: ingress policy not live; other nine policies match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
