coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Agent status token: 12 h (founder decision 65d8aed4, exception to SI-14 for nk-agent-status)
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 1m30s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
make agent-status-token requests --duration=12h and prints the real expiry from the token's exp claim
(tools/agent-status/token_expiry.py, never the token), since the API server may cap a duration.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 08:02:40 +01:00
parent 619a359072
commit 06291a97da
6 changed files with 87 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/proposals/2026-11-06-nk58-t05-agent-status-grant/README.md
View file

@ -54,7 +54,8 @@ need, and the agent would still act as ops-mason.
literal secret values (only file paths, references and URLs). `tools/contract-tests/tests/test_agent_status_grant.py`
keeps it that way and keeps the grant read-only and narrow.
**Tokens:** at most 1 hour (SI-14), minted by the founder once per working session. This is read-only, so it isn't a
**Tokens:** 12 hours since 2026-11-06, minted by the founder once per working day. That is an exception to SI-14's
60-minute cap for this read-only identity only (founder decision `65d8aed4`). This is read-only, so it isn't a
warden lane: `make agent-status-token` (founder steps below).
The agent's kubeconfig `~/.kube/config-agent-status` names the cluster and `tokenFile: ~/.kube/nk-agent-status.token`.
@ -97,8 +98,8 @@ strategy, prune and force off. From `~/railiance-platform` after `git pull --ff-
kubectl --kubeconfig $A config use-context nk-agent-status >/dev/null && chmod 600 $A && echo agent-kubeconfig-ok
```
3. **Each working session:** `make agent-status-token` mints a 1 h token into `~/.kube/nk-agent-status.token`
(mode 600) and prints one line.
3. **Each working day:** `make agent-status-token` mints a 12 h token into `~/.kube/nk-agent-status.token`
(mode 600) and prints its real expiry, read from the token's `exp` claim. The API server may cap a duration.
The agent then verifies with `kubectl --kubeconfig ~/.kube/config-agent-status auth can-i --list` and the two
negative checks: Secrets and pod logs in `sso` answer `no`.