From 03836dd1f8e21636262523cd132136e4d508e131 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 4 Nov 2026 07:10:42 +0100 Subject: [PATCH] NK-WP-0056-T16 done: both owner ingress rules live; netcheck reaches every endpoint Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350 --- WORK-RECORDS.md | 2 +- .../2026-11-04-nk56-t16-owner-ingress/README.md | 15 +++++++++++++++ workplans/NK-WP-0056-bounded-executor-path.md | 7 +++++-- 3 files changed, 21 insertions(+), 3 deletions(-) create mode 100644 docs/evidence/2026-11-04-nk56-t16-owner-ingress/README.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index cdd288a..5ec5194 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -358,7 +358,7 @@ | task | NK-WP-0056-T13 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T14 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T15 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | -| task | NK-WP-0056-T16 | wait | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0056-T16 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T17 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T18 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T19 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | diff --git a/docs/evidence/2026-11-04-nk56-t16-owner-ingress/README.md b/docs/evidence/2026-11-04-nk56-t16-owner-ingress/README.md new file mode 100644 index 0000000..7576f24 --- /dev/null +++ b/docs/evidence/2026-11-04-nk56-t16-owner-ingress/README.md @@ -0,0 +1,15 @@ +# NK-WP-0056-T16: owner ingress for the executor pod, live (2026-11-04) + +Founder-run, guided by claude-code (T06 runbook section 1). Each policy object was applied on its own, server +dry-run first. + +| Step | Result | +| --- | --- | +| approval-engine `approval-engine-bounded-executor` (source `e9e9f93`) | created. Read back: only `sso` pods labelled `app.kubernetes.io/name=bounded-executor`, TCP 8080 (one ANDed peer) | +| audit-core `audit-core-nk-bounded-executor-ingress` (source `7728fde`) | created | +| audit-core live scope ConfigMap | `nk-bounded-executor`: source `net-kingdom.bounded-executor`, tenants `[platform]`, write-only, `reject`, load-bearing, closing class within 7200 s | +| audit-core receiver image | `sha256:5f3d01c8…71a6` (AUDIT-WP-0018-T03 release) | +| rapp `make netcheck` (image `2926d7d9`, executor labels, no token) | t=0: all refused (k3s applies NetworkPolicy about 3 s after pod start, known since T10); from t=3.1 s to 43.3 s, 14 rows, all `openbao_health` 200, `approval_engine_health` 200, `audit_core_health` 200, `informed_decision_tcp` ok, `keycape_tcp` ok, `authelia_tcp` ok | + +Network admission is not authority. The executor still needs its KeyCape token (approval-engine) and its sender +bearer (audit-core): T06 sections 3 and 4. diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 417daa7..040119b 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -880,10 +880,9 @@ audit-core accepts the `started` event and the receipt only from a registered se ```task id: NK-WP-0056-T16 -status: wait +status: done priority: medium assignee: claude-code -blocked_on: human depends_on: [NK-WP-0056-T10] state_hub_task_id: "a08c6b82-be3f-5dca-82f7-b2a0ced6b335" ``` @@ -902,6 +901,10 @@ executor pod. - Founder steps: T06 runbook (`sso-mfa/k8s/bounded-executor/T06-PILOT-RUNBOOK.md`) section 1. Each object is applied on its own, because live approval-engine has a policy that its file lacks. +**Done 2026-11-04** ([evidence](../docs/evidence/2026-11-04-nk56-t16-owner-ingress/README.md)). The founder applied +both rules. `make netcheck` from an executor-labelled pod reaches approval-engine and audit-core (`/healthz` 200), +informed-decision:8081, OpenBao, KeyCape and Authelia from 3 s on. + ## Founder approval path at aal2 ```task