NK-WP-0058-T05 done: agent status identity live and verified (can-i exactly the grant, refusals hold)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

docs/evidence/2026-11-06-nk58-t05-agent-status/README.md

@@ -0,0 +1,48 @@
+# NK-WP-0058-T05: the agent's read-only status identity, live and verified (2026-11-06)
+
+Founder decision `4af1ec01`: option A with 1 h tokens. The add-on is railiance-platform
+`argocd/platform-addons/nk-agent-status/` (`4e60f69`), applied by its manual, pinned Application (`2e1ca67`).
+
+## Founder steps (attended)
+
+| Step | Result |
+| --- | --- |
+| `KUBECTL_ROUTE=founder-sudo make argocd-pin-drift` | three differences: `nk-agent-status` absent (expected), plus `bao-notice` and `informed-decision`, which are unrelated and untouched |
+| Selective root sync: `railiance-apps-root` at `2e1ca67`, `resources` = the `nk-agent-status` Application only, prune and force off | the Application was created |
+| Child sync: `nk-agent-status` at `4e60f69`, prune and force off | `Synced Healthy 4e60f69f93bf…` |
+| Agent kubeconfig `~/.kube/config-agent-status` (CA and a token-file pointer, mode 600) | `agent-kubeconfig-ok` |
+| `make agent-status-token` | `agent-status-token: valid 1h` |
+
+## Agent verification, with the agent kubeconfig only
+
+- **Identity:** `system:serviceaccount:sso:nk-agent-status`. The groups are `system:serviceaccounts`,
+  `system:serviceaccounts:sso` and `system:authenticated`; no `system:masters`.
+- **`auth can-i --list`:**
+  - `sso`: get, list and watch on pods, `deployments.apps`, `jobs.batch` and `externalsecrets.external-secrets.io`;
+  - `informed-decision`: get on configmaps `[informed-decision-workload-registry]`;
+  - `argocd`: get on `applications.argoproj.io` `[informed-decision]`;
+  - `default`: nothing beyond self-review.
+
+  No Secrets rule anywhere.
+- **Refusals,** all `no`:
+  - pod logs and pod exec in `sso`;
+  - patch on deployments and delete on jobs in `sso`;
+  - list on configmaps, and get on `kube-root-ca.crt`, in `informed-decision`;
+  - get on `applications/nk-agent-status` in `argocd`;
+  - get on pods in `openbao` and `default`.
+- **Reads that work:**
+  - Job completion for `bounded-executor-bea-2026-0002` (failed) and `-0003` (succeeded);
+  - KeyCape and Authelia rollouts (1/1);
+  - all `sso` ExternalSecrets `Ready=True`, including `bounded-executor-tokens` and
+    `keycape-nk-bind-executor-approval-client`;
+  - the live routing (`net-kingdom-admins` to `uid=admin,…`);
+  - the informed-decision Application's pin and sync state.
+
+The receipt holds names, conditions and counts only; no token and no value was printed.
+
+## What the first reads showed
+
+The live informed-decision Application still pins `005709a` and reports `OutOfSync`, while git pins `77161fe` and
+the live routing ConfigMap already routes to `admin`. So live state is ahead of the Application's pin: the drift
+that contract row O1 describes, now visible to the agent without asking the founder. It is reported to
+railiance-platform, which owns the pin.