From 2058036650e876872652ad12bc8d1d488fd5c005 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 20:54:55 +0100 Subject: [PATCH] NK-WP-0056: split T06 prerequisites into T14-T17 (founder decision 2026-10-31) T14 executor approval identity and request phase (KeyCape client, OpenBao lane, create-then-consume), T15 audit sender (schema, credential lane, registry), T16 owner ingress, T17 founder aal2 approval path. T06 depends on all four. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- WORK-RECORDS.md | 4 + workplans/NK-WP-0056-bounded-executor-path.md | 90 ++++++++++++++++++- 2 files changed, 93 insertions(+), 1 deletion(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index bc3a20d..48544fe 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -356,6 +356,10 @@ | task | NK-WP-0056-T11 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T12 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T13 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0056-T14 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0056-T15 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0056-T16 | wait | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0056-T17 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index d2d3872..afaa35d 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -694,6 +694,94 @@ Follow-up 2026-10-31 for T10/T06 reachability: - audit-core has no ingress from `sso`. - Both owners were asked for pod-scoped rules; see the rapp's `docs/platform-handoffs.md`. +## Executor approval identity and request phase + +```task +id: NK-WP-0056-T14 +status: todo +priority: high +assignee: claude-code +depends_on: [NK-WP-0056-T13] +``` + +approval-engine only accepts an approval request whose `binding.actor` equals the caller's KeyCape token subject +(approval-engine `docs/bounded-execution-admission-carrier.md`). The executor therefore files its own request, the +founder approves it, and the executor then consumes it. Needed: + +- KeyCape confidential client `nk-bind-executor-approval`: + - `client_credentials` grant, audience `approval-engine`; + - scopes `approval:create`, `approval:read` and `approval:consume`; + - subject `service:nk-bind-executor`, tenant `tenant:platform`, tokens of at most 15m; + - prepared as a security case and client file, like the T09 journey client. +- Its client secret in OpenBao, through a railiance-platform CCR with a third executor read role (one role per + lane), instead of a stored bearer. +- Executor code: + - a fresh token exchange per approval call (as secrets-engine does); + - a `request` phase that creates the approval (`action: bounded-execution`, target admission id and digest, + `human_control: true`, `pdp_path: false`) and prints its id; + - the existing run phase then consumes it. + +**Done when:** + +- the client and the CCR are prepared; +- the request phase is tested against approval-engine's real source with synthetic KeyCape keys (the + secrets-engine exercise pattern); +- nothing is applied without founder approval. + +## Executor audit sender + +```task +id: NK-WP-0056-T15 +status: todo +priority: high +assignee: claude-code +depends_on: [NK-WP-0056-T13] +``` + +audit-core accepts the `started` event and the receipt only from a registered sender (AUDIT-WP-0018-T02). Needed: + +- the versioned receipt schema, validator and fixtures (NK-WP-0040-T02 scope); +- the sender credential's custody, preferably an OpenBao read role for the executor rather than an ESO Secret; +- audit-core's registry entry and ingress rule. Facts sent 2026-10-31 (hub `ed03ba30`). + +**Done when:** a synthetic run's events are accepted by audit-core's real ingestion (202, duplicate 200, conflict +409, wrong source refused), and the live seed is prepared for the founder. + +## Owner ingress for the executor pod + +```task +id: NK-WP-0056-T16 +status: wait +priority: medium +assignee: claude-code +blocked_on: message-from:approval-engine +depends_on: [NK-WP-0056-T10] +``` + +approval-engine (hub `39a3bffa`) and audit-core (hub `deea5bf8`, `ed03ba30`) each admit only namespace `sso` with +pod label `app.kubernetes.io/name=bounded-executor` on 8080. Our side: the rapp's egress policy and `make netcheck`. + +**Done when:** both rules are live and `make netcheck` (extended to both endpoints) shows them reachable from an +executor pod. + +## Founder approval path at aal2 + +```task +id: NK-WP-0056-T17 +status: todo +priority: high +assignee: claude-code +depends_on: [NK-WP-0056-T10] +``` + +The founder must add a human approval entry with an `aal2` token carrying `approval:approve` for audience +`approval-engine`. approval-engine names `informed-decision` as the approver surface. + +Find out whether that path exists and is usable today, and what a founder approval of one admission looks like end +to end. Then name the missing pieces and their owners. + +**Done when:** the approval path is described with evidence (works today, or what is missing and who owns it). + ## Pilot: unattended bind rotation under one admission ```task @@ -703,7 +791,7 @@ priority: high assignee: claude-code needs_human: true intervention_note: "Founder signs the admission for the single live pilot rotation." -depends_on: [NK-WP-0056-T01, NK-WP-0056-T03, NK-WP-0056-T04, NK-WP-0056-T05, NK-WP-0056-T10, NK-WP-0056-T13] +depends_on: [NK-WP-0056-T01, NK-WP-0056-T03, NK-WP-0056-T04, NK-WP-0056-T05, NK-WP-0056-T10, NK-WP-0056-T13, NK-WP-0056-T14, NK-WP-0056-T15, NK-WP-0056-T16, NK-WP-0056-T17] state_hub_task_id: "6c3939f8-23a9-5f70-a3b1-94f4b291706b" ```