tegwick
876c3f6647
- scripts/seed-nk-bounded-executor-sender.py (+ silent attended wrapper): one attended process mints once, writes CCR-2026-0063 custody (platform/workloads/net-kingdom/bounded-executor/audit-sender, cas 0) and appends the sender to the audit-core registry (cas), syncs audit-core-senders and compares by hash, restarts the receiver, probes the live scope without writing an event, and checks sso/nk-bind-executor-audit by hash when it exists. Receipt only; no value printed or stored. - Refuses unless CCR-2026-0063 is approved by its three owners, cluster is railiance01, receiver image and live scope ConfigMap match, the ingress policy exists and the coding-agent boundary covers the custody path. - tests/test_seed_nk_bounded_executor_sender.py: 16 synthetic tests, including the probe run against the real receiver over HTTP. - docs/bounded-executor-receipts.md: 2026-11-04 live state and founder runbook (single-object ingress apply, preflight, seed, verify). - Read-only check: ingress policy not live; other nine policies match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
12 lines
709 B
Bash
Executable file
12 lines
709 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Silent child for the attended nk-bounded-executor sender seed (AUDIT-WP-0018-T04,
|
|
# NK-WP-0056-T15, CCR-2026-0063). Founder-run under
|
|
# warden access openbao-platform-admin-login --exec -- <this script> <receipt>
|
|
# Results go to the receipt only; any output would fail the warden envelope closed.
|
|
# Inside the lane HOME is the warden envelope, so the kubeconfig default is absolute.
|
|
set -euo pipefail
|
|
receipt="${1:?receipt path required}"
|
|
exec python3 "$(dirname "$0")/seed-nk-bounded-executor-sender.py" \
|
|
--kubeconfig "${RAILIANCE01_KUBECONFIG:-/home/worsch/.kube/config-railiance01}" \
|
|
--confirm 'SEED nk-bounded-executor CCR-2026-0063' \
|
|
--receipt "$receipt" >/dev/null 2>&1
|