NK-WP-0058-T05 done: agent status identity live and verified (can-i exactly the grant, refusals hold)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

WORK-RECORDS.md

@@ -374,7 +374,7 @@
 | task | NK-WP-0058-T02 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T03 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
-| task | NK-WP-0058-T05 | wait | — | workplans/NK-WP-0058-bounded-execution-operability.md |
+| task | NK-WP-0058-T05 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |

docs/evidence/2026-11-06-nk58-t05-agent-status/README.md

@@ -0,0 +1,48 @@
+# NK-WP-0058-T05: the agent's read-only status identity, live and verified (2026-11-06)
+
+Founder decision `4af1ec01`: option A with 1 h tokens. The add-on is railiance-platform
+`argocd/platform-addons/nk-agent-status/` (`4e60f69`), applied by its manual, pinned Application (`2e1ca67`).
+
+## Founder steps (attended)
+
+| Step | Result |
+| --- | --- |
+| `KUBECTL_ROUTE=founder-sudo make argocd-pin-drift` | three differences: `nk-agent-status` absent (expected), plus `bao-notice` and `informed-decision`, which are unrelated and untouched |
+| Selective root sync: `railiance-apps-root` at `2e1ca67`, `resources` = the `nk-agent-status` Application only, prune and force off | the Application was created |
+| Child sync: `nk-agent-status` at `4e60f69`, prune and force off | `Synced Healthy 4e60f69f93bf…` |
+| Agent kubeconfig `~/.kube/config-agent-status` (CA and a token-file pointer, mode 600) | `agent-kubeconfig-ok` |
+| `make agent-status-token` | `agent-status-token: valid 1h` |
+
+## Agent verification, with the agent kubeconfig only
+
+- **Identity:** `system:serviceaccount:sso:nk-agent-status`. The groups are `system:serviceaccounts`,
+  `system:serviceaccounts:sso` and `system:authenticated`; no `system:masters`.
+- **`auth can-i --list`:**
+  - `sso`: get, list and watch on pods, `deployments.apps`, `jobs.batch` and `externalsecrets.external-secrets.io`;
+  - `informed-decision`: get on configmaps `[informed-decision-workload-registry]`;
+  - `argocd`: get on `applications.argoproj.io` `[informed-decision]`;
+  - `default`: nothing beyond self-review.
+
+  No Secrets rule anywhere.
+- **Refusals,** all `no`:
+  - pod logs and pod exec in `sso`;
+  - patch on deployments and delete on jobs in `sso`;
+  - list on configmaps, and get on `kube-root-ca.crt`, in `informed-decision`;
+  - get on `applications/nk-agent-status` in `argocd`;
+  - get on pods in `openbao` and `default`.
+- **Reads that work:**
+  - Job completion for `bounded-executor-bea-2026-0002` (failed) and `-0003` (succeeded);
+  - KeyCape and Authelia rollouts (1/1);
+  - all `sso` ExternalSecrets `Ready=True`, including `bounded-executor-tokens` and
+    `keycape-nk-bind-executor-approval-client`;
+  - the live routing (`net-kingdom-admins` to `uid=admin,…`);
+  - the informed-decision Application's pin and sync state.
+
+The receipt holds names, conditions and counts only; no token and no value was printed.
+
+## What the first reads showed
+
+The live informed-decision Application still pins `005709a` and reports `OutOfSync`, while git pins `77161fe` and
+the live routing ConfigMap already routes to `admin`. So live state is ahead of the Application's pin: the drift
+that contract row O1 describes, now visible to the agent without asking the founder. It is reported to
+railiance-platform, which owns the pin.

workplans/NK-WP-0058-bounded-execution-operability.md

@@ -430,14 +430,11 @@ make four commands plus the approval. `close` is for emergencies.
 
 ```task
 id: NK-WP-0058-T05
-status: wait
+status: done
 priority: medium
 assignee: claude-code
 needs_human: true
-blocked_on: human
-blocking_reason: "Add-on in railiance-platform (4e60f69, 2e1ca67); waits for the founder's Argo sync, agent kubeconfig and first token."
 decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984"
-intervention_note: "Founder runs the steps in docs/proposals/2026-11-06-nk58-t05-agent-status-grant/README.md; then the agent verifies with can-i."
 depends_on: [NK-WP-0058-T10]
 state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
 ```
@@ -481,6 +478,18 @@ net-kingdom's copy of the grant is deleted: its contract test reads the platform
 - the agent kubeconfig, once;
 - `make agent-status-token`.
 
+**Done 2026-11-06** ([evidence](../docs/evidence/2026-11-06-nk58-t05-agent-status/README.md)).
+
+- **Applied:** the founder ran a selective root sync and the child sync (`Synced Healthy 4e60f69f`), built the agent
+  kubeconfig and minted the first 1 h token.
+- **Verified with the agent identity** `system:serviceaccount:sso:nk-agent-status`:
+  - `can-i --list` is exactly the grant;
+  - Secrets, pod logs, exec, writes, other objects and other namespaces are refused;
+  - Job, rollout and ExternalSecret status, the live routing, and the informed-decision Application state are
+    readable.
+- **The first reads showed O1 live:** the informed-decision Application pins `005709a` and is `OutOfSync` with git
+  (`77161fe`). That is reported to railiance-platform.
+
 Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers:
 
 - the status and conditions of Jobs, pods, ExternalSecrets and Deployments;