coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T10: examples re-pinned at 1cdc18f; gaps fixed, what is left
All checks were successful
Build and Publish bounded-executor / build-and-push (push) Successful in 6s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Identity provider journey acceptance / provider (push) Successful in 38s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-10-31 19:02:09 +01:00
parent 1cdc18f75f
commit 4815c58dce
6 changed files with 38 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/NK-WP-0056-bounded-executor-path.md
View file

@ -412,7 +412,7 @@ against a deliberately broken bind on a synthetic directory (T08).
- Done: the `sso` ingress rules for executor pods were applied by the founder and read back live.
- Done: railiance-platform CCR-2026-0059 drafted (`c9b68ea`, `proposed`). It is the journey read with its own role,
`net-kingdom-bind-executor-syn-journey-read`. It widens CCR-2026-0057 and proposes a standing reader.
`net-kingdom-bind-executor-syn-journey-read`. It widens CCR-2026-0057; standing reader (founder decision).
- Two executor gaps found while drafting it:
1. **Two roles.** The executor logs in to OpenBao once (`openbao.k8s_role`) and reads the bind and the journey with
that token. railiance-platform keeps one role per lane and never combines policies, so the executor needs a
@ -422,6 +422,28 @@ against a deliberately broken bind on a synthetic directory (T08).
to it.
- Both need an executor change, a new image and a new pin.
**2026-10-31, gaps fixed** ([evidence](../docs/evidence/2026-10-31-nk56-t10-openbao-lanes/README.md)):
- `1cdc18f`: one OpenBao client per lane, and one role for both lanes is refused.
- Every login is revoked at exit, also when setup fails.
- A third gap was found and fixed: the 15m token is shorter than the 20m budget, so clients now log in again before
the lease ends, re-reading the rotating JWT.
- Synthetic pilot with per-lane tokens: completed and reverted, `all_met`. Examples re-pinned.
- rapp `368fee4`:
- a second projected token with audience `openbao`;
- the config names both CCR roles;
- the renderer refuses other roles and the API token;
- tests tie the roles to the platform CCRs.
- The founder chose a standing journey reader. CCR-2026-0059 records it (railiance-platform `98a8b08`).
Left:
- the image for the new commit, and its pin in the rapp;
- founder approval of CCR-2026-0059;
- `make deploy` of the standing objects, then `confirm-binding`;
- applying the policy and roles (platform-admin);
- the approval-engine and audit-core replies and the token Secret.
## Executor runtime: core runner
```task