- sso delivery is ExternalSecret/Secret sso/bounded-executor-tokens key
audit-core (the Secret the rapp run Job already mounts), not
nk-bind-executor-audit/audit-token.
- CCR check now also pins the new reader shape (audience openbao, explicit
max TTL 15m, token_self_lifecycle) and that the CCR names this script as
its custody procedure and the bounded-executor-tokens delivery.
- Docs/workplan: this script is the single seeder; railiance-platform
fences the boundary (nk_bind_executor_custody.py fence) and owns
manifests/nk-bind-executor-eso.yaml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
tegwick
3157454b84