NK-WP-0056-T13 (part): rapp-bounded-executor reshaped to one Job per admission

Local rapp repo (c9184ba): ceiling copy, egress-only NetworkPolicy, per-admission
Job renderer with refusals, 12 tests, rmgr validate ok. Limited-identity server
dry run admits SA and NetworkPolicy; RBAC and Job dry run is founder-run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

workplans/NK-WP-0056-bounded-executor-path.md

@@ -545,14 +545,47 @@ manifest check, and nothing is applied.
 - `.forgejo/workflows/bounded-executor-image.yaml`, and the executor tests are in `identity-journeys.yaml`;
 - the pilot example pins the executed files (`executor.py`, `operations.py`, `journey.py`). 35 tests.
 
+**2026-10-31, rapp reshaped.** `~/rapp-bounded-executor` is a local git repo (`c9184ba`, no remote yet):
+
+- Standing objects in `sso`:
+  - `manifests/rbac.yaml`, a byte-identical copy of `sso-mfa/k8s/bounded-executor/rbac.yaml`. A test fails on
+    drift; `make ceiling-sync` copies it.
+  - `manifests/networkpolicy.yaml`: no ingress. Egress only to DNS, the API server (node `/32`, 6443), LLDAP 17170,
+    KeyCape 8080, Authelia 9091, OpenBao 8200, approval-engine 8080 and audit-core 8080.
+  - No Namespace, Deployment, Service, probes or database.
+- `templates/job.yaml` and `tools/render_job.py` render one ConfigMap (admission + config) and one Job per admission,
+  named `bounded-executor-<id>`:
+  - `make run` uses `kubectl create`, so a second run of the same admission fails;
+  - `backoffLimit: 0`; `activeDeadlineSeconds` = min(budget + 300 s, time left in the window);
+  - projected SA token, no automount;
+  - approval-engine and audit-core bearers come from an ESO Secret `bounded-executor-tokens`;
+  - the renderer refuses a placeholder digest, a window that is not open, another executor, secret-like config
+    keys and token paths that differ from the mounts.
+- `declarations/rapp.yaml` names no database. `rmgr rapp validate` passes. 12 tests.
+- `docs/runtime-contract.md` and `docs/platform-handoffs.md` list what must exist before T06.
+
+Server dry run with the limited `ops-mason-builder` identity:
+
+- ServiceAccount and NetworkPolicy: admitted.
+- Role, RoleBinding and the per-admission ConfigMap and Job: `Forbidden` for that identity, so the founder runs them.
+- The SSH path (`kubectl` on railiance01) can't read the k3s kubeconfig. The Makefile therefore takes
+  `KUBECTL=...`.
+
 Left:
 
-- `rmgr rapp wrap` created local drafts in `~/rapp-bounded-executor` (not a git repo yet, no remote). Its
-  rapp-postgres consumer, Postgres handoff and generic `image.yaml` were removed: the executor has no database.
-- The drafts still need reshaping to the decisions: one Job per admission in `sso`; no namespace, Deployment,
-  Service or probes; the T03 ServiceAccount, Role and RoleBinding; an egress-only NetworkPolicy; the job
-  template's render; tests; `runtime_dependencies` without the database engine.
-- Then `git init` and commit, and the founder creates the Forgejo remote.
+- Founder: the full server dry run with the admin kubeconfig. Nothing is created:
+
+  ```bash
+  cd ~/rapp-bounded-executor
+  K="kubectl --kubeconfig $HOME/.kube/config-railiance01"
+  make server-dry-run KUBECTL="$K"
+  make server-dry-run-job KUBECTL="$K" NOW=2026-11-03T09:05:00Z IMAGE_DIGEST=sha256:$(printf 'ab%.0s' {1..32}) \
+    ADMISSION=$HOME/net-kingdom/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml \
+    APPROVAL_ID=apr-synthetic-1 CONFIG=examples/config.pilot.json
+  ```
+
+- Confirm that the image workflow's first run passed (not checked from here), then `rmgr rapp pin-image`.
+- Founder: create the Forgejo remote `coulomb/rapp-bounded-executor` and push.
 
 ## Pilot: unattended bind rotation under one admission