tegwick
5ac637bf5f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
93 lines
3.5 KiB
Markdown
93 lines
3.5 KiB
Markdown
---
|
|
id: AUDIT-WP-0018
|
|
type: workplan
|
|
title: "Hold bounded-executor execution-attribution receipts"
|
|
domain: infotech
|
|
repo: audit-core
|
|
status: ready
|
|
flavor: implementation
|
|
owner: audit-core
|
|
topic_slug: audit-evidence-dependencies
|
|
created: "2026-10-31"
|
|
updated: "2026-10-31"
|
|
related:
|
|
- NK-WP-0056
|
|
- NK-WP-0040
|
|
- AUDIT-WP-0014
|
|
state_hub_workstream_id: "932c94fc-2e7c-55eb-b6d5-70832d3996b5"
|
|
---
|
|
|
|
# AUDIT-WP-0018 — Hold bounded-executor execution-attribution receipts
|
|
|
|
NetKingdom's Bounded Execution Admission v0.1 makes a non-human executor
|
|
(`service:nk-bind-executor`, namespace `sso`) emit one execution-attribution
|
|
receipt per run. Audit-core holds those receipts. The owner answer and the event
|
|
mapping are in `docs/bounded-executor-receipts.md`. Canonical schema validation
|
|
is still AUDIT-WP-0014-T02 and is not duplicated here.
|
|
|
|
## Answer the NK-WP-0056-T02 owner request
|
|
|
|
```task
|
|
id: AUDIT-WP-0018-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "7c1fb849-ddb3-558f-8a50-5c711e2c7b56"
|
|
```
|
|
|
|
Hub message 755cbeed-ecbd-46d9-883e-958fbd88378b. Audit-core accepts custody.
|
|
Each run produces one receipt event that carries the per-step outcomes, check
|
|
results, `reverted` and `budget`. Each run also produces an
|
|
`execution.run.started` event, correlated with the receipt by `run_id`. Event
|
|
ids are deterministic from `run_id`. The proposed `secret_policy` is `reject`.
|
|
NetKingdom has to decide how a singular `target`/`action` relates to per-step
|
|
targets and actions, and has to make `decision_refs` typed.
|
|
|
|
## Prepare sender registration and ingress for the executor
|
|
|
|
```task
|
|
id: AUDIT-WP-0018-T02
|
|
status: wait
|
|
priority: high
|
|
blocking_reason: "NetKingdom must confirm source, event types, tenant binding and the started event; the rapp-* package must name pod labels and ServiceAccount; railiance-platform must route the ESO-projected bearer."
|
|
blocked_on: message-from:net-kingdom
|
|
state_hub_task_id: "3f251d30-e62d-5849-88d9-d033097b4f7d"
|
|
```
|
|
|
|
Prepare the following:
|
|
|
|
- a non-secret registry entry (`nk-bounded-executor`: exact source, exact
|
|
tenants, write only, `secret_policy: reject`, and either `evidence_kind`
|
|
`load-bearing` or `attributive` with a `completeness_trade`);
|
|
- a NetworkPolicy that admits only the executor's pods in `sso`.
|
|
|
|
Then test on synthetic fixtures:
|
|
|
|
- accept on 202;
|
|
- a retry returns a 200 duplicate;
|
|
- a reused `run_id` with a different body is a 409 conflict;
|
|
- wrong source or tenant is refused;
|
|
- a secret-shaped step check is refused with 400.
|
|
|
|
The live registry seed and the rollout are founder-run.
|
|
|
|
## Detect runs that started without a receipt
|
|
|
|
```task
|
|
id: AUDIT-WP-0018-T03
|
|
status: wait
|
|
priority: medium
|
|
blocking_reason: "Depends on NetKingdom adopting the execution.run.started event and stating the admission window bound after which a missing receipt is a finding."
|
|
blocked_on: message-from:net-kingdom
|
|
state_hub_task_id: "ec2cd9b7-be65-5792-b546-ffd0b3937856"
|
|
```
|
|
|
|
Report every `execution.run.started` that has no
|
|
`execution.attribution.receipt` with the same `correlation_id` after the
|
|
declared window. Reuse the existing stream-completeness/cadence surface
|
|
(`docs/stream-completeness.md`, `docs/cadence-registration.md`) instead of
|
|
adding a new monitor. The report is a finding for the verifier and the
|
|
founder. Audit-core does not infer what the run did.
|
|
|
|
## Founder decision 2026-10-31
|
|
|
|
Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). Founder adopted the `execution.run.started` event plus one receipt per run with an admission-level target/action, `steps[]` detail and labelled `decision_refs`.
|