tegwick
0ef57537ac
Candidate files: review policy pin v14 (sha256:8911458f...), the nk-bind-executor present_existing registry row (daily limit 10), and an 8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor. The state-hub row is unchanged and outcome_read stays off. The image pin stays at the live f5588f49 because no owner-CI full-service image exists yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md) gates the release on it. Adds a side-effect-free present_existing probe and release tests. Nothing applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
28 lines
591 B
JSON
28 lines
591 B
JSON
{
|
|
"system:serviceaccount:state-hub:state-hub": {
|
|
"submitter_id": "state-hub",
|
|
"memo_classes": [
|
|
"decision-record"
|
|
],
|
|
"review_groups": [
|
|
"net-kingdom-admins"
|
|
],
|
|
"daily_limit": 50
|
|
},
|
|
"system:serviceaccount:sso:nk-bind-executor": {
|
|
"submitter_id": "nk-bind-executor",
|
|
"memo_classes": [
|
|
"bounded-execution"
|
|
],
|
|
"review_groups": [
|
|
"net-kingdom-admins"
|
|
],
|
|
"daily_limit": 10,
|
|
"present_existing": {
|
|
"approval_actor": "service:nk-bind-executor",
|
|
"actions": [
|
|
"bounded-execution"
|
|
]
|
|
}
|
|
}
|
|
}
|