coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T19: executor image re-pinned (rapp 3ddacfc); founder: no required_assurance at request
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
This commit is contained in:
tegwick 2026-11-04 01:04:05 +01:00
parent 66dc397193
commit 1d4b7e84d7
2 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md
View file

@ -59,10 +59,9 @@ refusals.
## Consequences
- **The pinned executor image needs rebuilding.** The image pinned in the rapp by T18 (`c67cb044`, `b90951a`) has the
defect. It must be rebuilt from `625ad65` or later and re-pinned before T06.
- **Open for the founder.** approval-engine accepts an aal1 human entry unless the approval declares
`required_assurance` (APPROVAL-WP-0007-T01). Today the executor is the only aal2 guard. The request phase could
declare `required_assurance: {"level": "aal2"}` so approval-engine also enforces the floor at approve and consume
time. That needs the deployed approval-engine to be at schema v7 or later, and a check that informed-decision's
present_existing accepts the field.
- **Image re-pinned (2026-11-04).** The image built for `66dc397`, `sha256:3aa2bcce…500d8a`, is pinned in the rapp
(`3ddacfc`). Its 7 executed files are byte-identical to the repo, and the `provider` test job passed. It replaces
T21's `e0b9bf6c`, which had the defect.
- **Founder decision (2026-11-04): no `required_assurance` at request.** approval-engine supports a level per
approval: no floor by default, with an optional `required_assurance` floor. This decision does not need
approval-engine to require aal2. The executor still enforces the admission's aal2 (BEA-C4).

11
workplans/NK-WP-0056-bounded-executor-path.md
View file

@ -828,11 +828,14 @@ approving, and an aal1 entry.
would have refused every real founder approval. Fixed in `625ad65` (`entry_is_aal2`). The request-phase tests no
longer expire with the example window.
Follow-ups:
Follow-ups, both settled 2026-11-04:
- rebuild the executor image from `625ad65` and re-pin it in the rapp (T18's `c67cb044` has the defect);
- founder decision: should the request phase also declare `required_assurance: aal2`, so approval-engine enforces
the floor?
- **Image.** The image built for `66dc397` is `sha256:3aa2bcce…500d8a`. The `provider` job (executor tests) passed,
and the 7 executed files are byte-identical to the repo. It is pinned in the rapp (`3ddacfc`), replacing T21's
`e0b9bf6c`, which had the defect.
- **Founder decision: no `required_assurance` at request.** approval-engine's rigidity is per approval: no floor by
default, with an optional `required_assurance` level. This decision does not need approval-engine to require aal2.
The admission's own aal2 (BEA-C4) is still enforced by the executor.
## Executor audit sender