NK-WP-0058 finished: T06 done, window watch live (09:40Z run ok); all eleven tasks done

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

WORK-RECORDS.md

@@ -56,7 +56,7 @@
 | workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | workplan | NK-WP-0056 | finished | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
-| workplan | NK-WP-0058 | active | — | workplans/NK-WP-0058-bounded-execution-operability.md |
+| workplan | NK-WP-0058 | finished | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
@@ -377,7 +377,7 @@
 | task | NK-WP-0058-T03 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T05 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
-| task | NK-WP-0058-T06 | wait | — | workplans/NK-WP-0058-bounded-execution-operability.md |
+| task | NK-WP-0058-T06 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T08 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T09 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |

docs/evidence/2026-11-06-nk58-t06-window-watch/README.md

@@ -0,0 +1,41 @@
+# NK-WP-0058-T06: the write-role window is watched without human memory (2026-11-06)
+
+**Result:** a CronJob in `sso` checks every 10 minutes whether CCR-2026-0058's write role
+`net-kingdom-bind-executor-svc-authelia-write` exists while no bounded-executor run Job is active or recent. In mode
+`flag` the watch Job then fails, which the agent's status identity sees. Contract row O5.
+
+| Piece | Where |
+| --- | --- |
+| Rule and modes | net-kingdom `bounded-executor/window_watch.py` (`c63aa39`; endpoint wait `b477323`), 10 stub tests |
+| CronJob, ServiceAccount `sso/nk-window-watch`, Role (list Jobs only) | rapp-bounded-executor `manifests/window-watch.yaml` (`df61bd0`), `make deploy-window-watch` |
+| Image | `sha256:d8112ccb37f2…` (tag `main-b477323`); executor files verified byte-identical to `b477323`; pinned in rapp `b36733a` |
+| OpenBao role and policy | railiance-platform CCR-2026-0064 (`b142131`; lane fix `6953005`; records `de06f49`). New request type `auth-role-presence-watch` with lane `scripts/auth_role_watch_lane.py`; generated policy: `read` on the watched role path only, plus token self-lifecycle |
+| Contract tests | `tools/contract-tests/tests/test_window_watch_contract.py` (watcher and CCR agree), railiance-platform `tests/test_auth_role_watch_lane.py`, rapp packaging tests |
+
+## Founder steps (attended)
+
+- CCR-2026-0064 approved as platform-owner and net-kingdom-owner.
+- `make deploy-window-watch` created the ServiceAccount, Role, RoleBinding and CronJob.
+- Binding confirmed for uid `180a2463-…`. The first entry named no uid; the second corrects it.
+- `applier-apply` through the warden platform-admin lane: `exit=0`, status `applied`.
+- After the endpoint fix: `make deploy-window-watch` again with the new image.
+
+## Runs, read by the agent as `sso/nk-agent-status`
+
+| Run | Image | Result |
+| --- | --- | --- |
+| 09:20Z | `6e364fd9…` | exit 5, before the OpenBao role existed |
+| 09:30Z | `6e364fd9…` | exit 5, `URLError` (the founder read the log line): the new pod's NetworkPolicy was not yet live, and the watcher did not wait |
+| 09:40Z | `d8112ccb…` | **exit 0, Succeeded:** in mode `flag` this is `ok`. It logged in with its own role, read the watched role path (absent) and listed the run Jobs |
+
+## Problems met on the way, all fixed
+
+- **The lane's dry-run payload** lacked `source` and `body` for `policy_write`, so `render_applier_dry_run`
+  crashed. Fixed, with a test that renders through the CLI. `approve --record-state-hub` no longer assumes KV fields.
+- **The watcher made its first call without waiting for the network.** It now waits up to 30 s per endpoint and
+  names an unreachable one.
+
+## Not covered
+
+- A live positive flag, a real stale window, was not provoked. The flag and close paths are tested on stubs.
+- Mode `close` (delete) needs its own founder and platform-owner decision and a CCR amendment.

workplans/NK-WP-0058-bounded-execution-operability.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Bounded execution operability: clear boundaries, lean interfaces, transparent diagnostics"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 flavor: implementation
 owner: claude
 topic_slug: netkingdom
@@ -507,11 +507,9 @@ to ask the founder for on 2026-11-04/05 is then readable, or explicitly founder-
 
 ```task
 id: NK-WP-0058-T06
-status: wait
+status: done
 priority: medium
 assignee: claude-code
-blocked_on: message-from:railiance-platform
-blocking_reason: "CCR-2026-0064 drafted (railiance-platform b142131, proposed): founder approval, deploy-window-watch, binding confirmation and the delegated apply."
 depends_on: [NK-WP-0058-T09]
 state_hub_task_id: "6a4c7413-0675-5a06-b471-5f849ce0c721"
 ```
@@ -550,6 +548,16 @@ The open check from 2026-11-05 on the overnight window is T11.
 
   Then the agent verifies the watch Jobs.
 
+**Done 2026-11-06** ([evidence](../docs/evidence/2026-11-06-nk58-t06-window-watch/README.md)).
+
+- **Applied:** the founder approved and applied CCR-2026-0064 and deployed the watch.
+- **First runs:** the first two exited 5, the second with `URLError`, because the watcher did not wait for the new
+  pod's NetworkPolicy. Fixed in `b477323`; image `d8112ccb` is pinned in rapp `b36733a`.
+- **Verified:** the 09:40Z run Succeeded with exit 0 (`ok` in flag mode), read by the agent's status identity.
+- **Now:** an unclosed window is flagged every 10 minutes without human memory.
+- **Not provoked live:** a real stale window. The flag and close paths are stub-tested.
+- **Close mode:** needs its own decision.
+
 ### Runbook and tooling conventions
 
 ```task