NK-WP-0058-T05 done: agent status identity live and verified (can-i exactly the grant, refusals hold)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

workplans/NK-WP-0058-bounded-execution-operability.md

@@ -430,14 +430,11 @@ make four commands plus the approval. `close` is for emergencies.
 
 ```task
 id: NK-WP-0058-T05
-status: wait
+status: done
 priority: medium
 assignee: claude-code
 needs_human: true
-blocked_on: human
-blocking_reason: "Add-on in railiance-platform (4e60f69, 2e1ca67); waits for the founder's Argo sync, agent kubeconfig and first token."
 decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984"
-intervention_note: "Founder runs the steps in docs/proposals/2026-11-06-nk58-t05-agent-status-grant/README.md; then the agent verifies with can-i."
 depends_on: [NK-WP-0058-T10]
 state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
 ```
@@ -481,6 +478,18 @@ net-kingdom's copy of the grant is deleted: its contract test reads the platform
 - the agent kubeconfig, once;
 - `make agent-status-token`.
 
+**Done 2026-11-06** ([evidence](../docs/evidence/2026-11-06-nk58-t05-agent-status/README.md)).
+
+- **Applied:** the founder ran a selective root sync and the child sync (`Synced Healthy 4e60f69f`), built the agent
+  kubeconfig and minted the first 1 h token.
+- **Verified with the agent identity** `system:serviceaccount:sso:nk-agent-status`:
+  - `can-i --list` is exactly the grant;
+  - Secrets, pod logs, exec, writes, other objects and other namespaces are refused;
+  - Job, rollout and ExternalSecret status, the live routing, and the informed-decision Application state are
+    readable.
+- **The first reads showed O1 live:** the informed-decision Application pins `005709a` and is `OutOfSync` with git
+  (`77161fe`). That is reported to railiance-platform.
+
 Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers:
 
 - the status and conditions of Jobs, pods, ExternalSecrets and Deployments;