diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index c35b576..47f74a5 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -374,7 +374,7 @@ | task | NK-WP-0058-T02 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T03 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | -| task | NK-WP-0058-T05 | wait | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| task | NK-WP-0058-T05 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | diff --git a/docs/evidence/2026-11-06-nk58-t05-agent-status/README.md b/docs/evidence/2026-11-06-nk58-t05-agent-status/README.md new file mode 100644 index 0000000..f06d3a7 --- /dev/null +++ b/docs/evidence/2026-11-06-nk58-t05-agent-status/README.md @@ -0,0 +1,48 @@ +# NK-WP-0058-T05: the agent's read-only status identity, live and verified (2026-11-06) + +Founder decision `4af1ec01`: option A with 1 h tokens. The add-on is railiance-platform +`argocd/platform-addons/nk-agent-status/` (`4e60f69`), applied by its manual, pinned Application (`2e1ca67`). + +## Founder steps (attended) + +| Step | Result | +| --- | --- | +| `KUBECTL_ROUTE=founder-sudo make argocd-pin-drift` | three differences: `nk-agent-status` absent (expected), plus `bao-notice` and `informed-decision`, which are unrelated and untouched | +| Selective root sync: `railiance-apps-root` at `2e1ca67`, `resources` = the `nk-agent-status` Application only, prune and force off | the Application was created | +| Child sync: `nk-agent-status` at `4e60f69`, prune and force off | `Synced Healthy 4e60f69f93bf…` | +| Agent kubeconfig `~/.kube/config-agent-status` (CA and a token-file pointer, mode 600) | `agent-kubeconfig-ok` | +| `make agent-status-token` | `agent-status-token: valid 1h` | + +## Agent verification, with the agent kubeconfig only + +- **Identity:** `system:serviceaccount:sso:nk-agent-status`. The groups are `system:serviceaccounts`, + `system:serviceaccounts:sso` and `system:authenticated`; no `system:masters`. +- **`auth can-i --list`:** + - `sso`: get, list and watch on pods, `deployments.apps`, `jobs.batch` and `externalsecrets.external-secrets.io`; + - `informed-decision`: get on configmaps `[informed-decision-workload-registry]`; + - `argocd`: get on `applications.argoproj.io` `[informed-decision]`; + - `default`: nothing beyond self-review. + + No Secrets rule anywhere. +- **Refusals,** all `no`: + - pod logs and pod exec in `sso`; + - patch on deployments and delete on jobs in `sso`; + - list on configmaps, and get on `kube-root-ca.crt`, in `informed-decision`; + - get on `applications/nk-agent-status` in `argocd`; + - get on pods in `openbao` and `default`. +- **Reads that work:** + - Job completion for `bounded-executor-bea-2026-0002` (failed) and `-0003` (succeeded); + - KeyCape and Authelia rollouts (1/1); + - all `sso` ExternalSecrets `Ready=True`, including `bounded-executor-tokens` and + `keycape-nk-bind-executor-approval-client`; + - the live routing (`net-kingdom-admins` to `uid=admin,…`); + - the informed-decision Application's pin and sync state. + +The receipt holds names, conditions and counts only; no token and no value was printed. + +## What the first reads showed + +The live informed-decision Application still pins `005709a` and reports `OutOfSync`, while git pins `77161fe` and +the live routing ConfigMap already routes to `admin`. So live state is ahead of the Application's pin: the drift +that contract row O1 describes, now visible to the agent without asking the founder. It is reported to +railiance-platform, which owns the pin. diff --git a/workplans/NK-WP-0058-bounded-execution-operability.md b/workplans/NK-WP-0058-bounded-execution-operability.md index de879c4..750399a 100644 --- a/workplans/NK-WP-0058-bounded-execution-operability.md +++ b/workplans/NK-WP-0058-bounded-execution-operability.md @@ -430,14 +430,11 @@ make four commands plus the approval. `close` is for emergencies. ```task id: NK-WP-0058-T05 -status: wait +status: done priority: medium assignee: claude-code needs_human: true -blocked_on: human -blocking_reason: "Add-on in railiance-platform (4e60f69, 2e1ca67); waits for the founder's Argo sync, agent kubeconfig and first token." decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984" -intervention_note: "Founder runs the steps in docs/proposals/2026-11-06-nk58-t05-agent-status-grant/README.md; then the agent verifies with can-i." depends_on: [NK-WP-0058-T10] state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59" ``` @@ -481,6 +478,18 @@ net-kingdom's copy of the grant is deleted: its contract test reads the platform - the agent kubeconfig, once; - `make agent-status-token`. +**Done 2026-11-06** ([evidence](../docs/evidence/2026-11-06-nk58-t05-agent-status/README.md)). + +- **Applied:** the founder ran a selective root sync and the child sync (`Synced Healthy 4e60f69f`), built the agent + kubeconfig and minted the first 1 h token. +- **Verified with the agent identity** `system:serviceaccount:sso:nk-agent-status`: + - `can-i --list` is exactly the grant; + - Secrets, pod logs, exec, writes, other objects and other namespaces are refused; + - Job, rollout and ExternalSecret status, the live routing, and the informed-decision Application state are + readable. +- **The first reads showed O1 live:** the informed-decision Application pins `005709a` and is `OutOfSync` with git + (`77161fe`). That is reported to railiance-platform. + Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers: - the status and conditions of Jobs, pods, ExternalSecrets and Deployments;