coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T18 done (image c67cb044 pinned); T20 type r2 and T21 memo submission from owner reviews
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-10-31 23:20:22 +01:00
parent 7bd6033b16
commit 620f558f18
2 changed files with 79 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -360,8 +360,10 @@
| task | NK-WP-0056-T15 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T16 | wait | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T17 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T18 | progress | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T18 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T19 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T20 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T21 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
| intake | NET-IN-0001 | open | — | intakes/intakes.md |

80
workplans/NK-WP-0056-bounded-executor-path.md
View file

@ -757,7 +757,7 @@ Next:
```task
id: NK-WP-0056-T18
status: progress
status: done
priority: high
assignee: claude-code
depends_on: [NK-WP-0056-T14]
@ -797,8 +797,9 @@ Presenting the approval to the founder follows the alignment review's "present a
- the run Job mounts only the audit-core bearer;
- `make request` adds a request Job.
Left: the image and its pin. A live request also needs the KeyCape client (T14 type acknowledged, then the case
live) and informed-decision's `present_existing`.
**Done 2026-10-31.** The image `sha256:c67cb04485ee53b910c2443f43eada0e80273ea879de6853e120a32415194a04`
(`7bd6033`) has executed files byte-identical to the repo. It is pinned in the rapp (`b90951a`). A live request
also needs T20 and T21.
## Executor approval exercise against the real services
@ -891,6 +892,77 @@ Options:
Founder decision needed before T14.
## Service-client type revision r2 from the owner reviews
```task
id: NK-WP-0056-T20
status: todo
priority: high
assignee: claude-code
depends_on: [NK-WP-0056-T14]
```
The 2026-10-31 reviews of `oidc-service-client` 0.1:
- ops-mason: `ops-mason` `3c69a25`;
- ops-warden: `ops-warden` `95d31c3`, `history/2026-10-31-oidc-service-client-follow-through-review.md`;
- key-cape: `key-cape` `655d8d3`, `docs/oidc-service-client-type-review.md`;
- railiance-platform: `railiance-platform` `6858bef`, `docs/credential-lane-designs/oidc-service-client-review.md`.
They ask for these changes before the founder acknowledges the type:
- The ESO role gets `audience: openbao` and `token_explicit_max_ttl`; the ESO policy gets `lookup-self` and
`revoke-self`.
- The consumer role name must differ from its policy name: `keycape-{client_id}-{consuming_service}-workload-kv-read`.
- Refuse the `default` ServiceAccount and the `external-secrets` and `openbao` namespaces.
- **Same namespace:** KeyCape's ESO target sits in `sso`, the consumer's namespace. Add the verification
`consumer-cannot-read-delivered-secret` (an RBAC can-i denial) and correct the README.
- An excess scope is refused with `invalid_profile_usage`, not `invalid_scope` (key-cape R3).
- **Rotation:** the mint step only creates. Rotation is an attended platform-admin write, then an ESO refresh, then
a KeyCape restart (railiance-platform R5, ops-warden R5, key-cape R5).
- The catalog entry body gets the fields ops-warden R6 asks for.
- The `custody-allowed-to-consumer` wording must mention the two self-lifecycle grants.
- One restart per case: bind-env and register-client in one rollout (key-cape R4).
- Open questions:
- the workload name, `bounded-executor` or `net-kingdom-bind-executor` (ops-mason R9);
- `consumer_owner_repo` as `rapp-bounded-executor` (ops-warden R10);
- an independent claims check (ops-warden R8).
Per-case CCRs are still required. railiance-platform drafted CCR-2026-0060 (KeyCape ESO reader) and CCR-2026-0061
(the executor's reader). The broker must admit the type after acknowledgement (railiance-platform R1, ops-warden
R1).
**Done when:** the type is at r2 with tests green, the memo r2 is validated, and the CCR names agree with the type.
## Executor submits its admission memo to informed-decision
```task
id: NK-WP-0056-T21
status: todo
priority: high
assignee: claude-code
depends_on: [NK-WP-0056-T18]
```
informed-decision built `present_existing` (`0e66a33`, INFD-WP-0010). The executor submits a memo through
`/v1/memos` that pins `approval_id` and the binding digest and carries the admission YAML as its packet.
informed-decision checks the approval by GET and presents it to the founder.
Needed:
- a projected token with audience `informed-decision-intake` in the request Job;
- a NetworkPolicy path to informed-decision's private listener on 8081;
- the request phase submitting the memo after creating the approval.
Outside net-kingdom:
- access-engine: review policy v13 hard-codes the requester `informed-decision`;
- key-cape: the informed-decision requester client needs `approval:read`;
- informed-decision: its registry entry and release (INFD-WP-0010-T02).
**Done when:** the request phase files the approval and the memo, tested against informed-decision's real intake
validator.
## Pilot: unattended bind rotation under one admission
```task
@ -900,7 +972,7 @@ priority: high
assignee: claude-code
needs_human: true
intervention_note: "Founder signs the admission for the single live pilot rotation."
depends_on: [NK-WP-0056-T01, NK-WP-0056-T03, NK-WP-0056-T04, NK-WP-0056-T05, NK-WP-0056-T10, NK-WP-0056-T13, NK-WP-0056-T14, NK-WP-0056-T15, NK-WP-0056-T16, NK-WP-0056-T17, NK-WP-0056-T18, NK-WP-0056-T19]
depends_on: [NK-WP-0056-T01, NK-WP-0056-T03, NK-WP-0056-T04, NK-WP-0056-T05, NK-WP-0056-T10, NK-WP-0056-T13, NK-WP-0056-T14, NK-WP-0056-T15, NK-WP-0056-T16, NK-WP-0056-T17, NK-WP-0056-T18, NK-WP-0056-T19, NK-WP-0056-T20, NK-WP-0056-T21]
state_hub_task_id: "6c3939f8-23a9-5f70-a3b1-94f4b291706b"
```