From 6c74d2890fb3cdb4849c4a84749fa8dca0564392 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 6 Nov 2026 10:40:51 +0100 Subject: [PATCH] NK-WP-0058 finished: T06 done, window watch live (09:40Z run ok); all eleven tasks done Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0 --- WORK-RECORDS.md | 4 +- .../README.md | 41 +++++++++++++++++++ ...K-WP-0058-bounded-execution-operability.md | 16 ++++++-- 3 files changed, 55 insertions(+), 6 deletions(-) create mode 100644 docs/evidence/2026-11-06-nk58-t06-window-watch/README.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 736e1d4..094eecc 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -56,7 +56,7 @@ | workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | workplan | NK-WP-0056 | finished | — | workplans/NK-WP-0056-bounded-executor-path.md | | workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | -| workplan | NK-WP-0058 | active | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| workplan | NK-WP-0058 | finished | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -377,7 +377,7 @@ | task | NK-WP-0058-T03 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T05 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | -| task | NK-WP-0058-T06 | wait | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| task | NK-WP-0058-T06 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T08 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T09 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | diff --git a/docs/evidence/2026-11-06-nk58-t06-window-watch/README.md b/docs/evidence/2026-11-06-nk58-t06-window-watch/README.md new file mode 100644 index 0000000..49f7f1f --- /dev/null +++ b/docs/evidence/2026-11-06-nk58-t06-window-watch/README.md @@ -0,0 +1,41 @@ +# NK-WP-0058-T06: the write-role window is watched without human memory (2026-11-06) + +**Result:** a CronJob in `sso` checks every 10 minutes whether CCR-2026-0058's write role +`net-kingdom-bind-executor-svc-authelia-write` exists while no bounded-executor run Job is active or recent. In mode +`flag` the watch Job then fails, which the agent's status identity sees. Contract row O5. + +| Piece | Where | +| --- | --- | +| Rule and modes | net-kingdom `bounded-executor/window_watch.py` (`c63aa39`; endpoint wait `b477323`), 10 stub tests | +| CronJob, ServiceAccount `sso/nk-window-watch`, Role (list Jobs only) | rapp-bounded-executor `manifests/window-watch.yaml` (`df61bd0`), `make deploy-window-watch` | +| Image | `sha256:d8112ccb37f2…` (tag `main-b477323`); executor files verified byte-identical to `b477323`; pinned in rapp `b36733a` | +| OpenBao role and policy | railiance-platform CCR-2026-0064 (`b142131`; lane fix `6953005`; records `de06f49`). New request type `auth-role-presence-watch` with lane `scripts/auth_role_watch_lane.py`; generated policy: `read` on the watched role path only, plus token self-lifecycle | +| Contract tests | `tools/contract-tests/tests/test_window_watch_contract.py` (watcher and CCR agree), railiance-platform `tests/test_auth_role_watch_lane.py`, rapp packaging tests | + +## Founder steps (attended) + +- CCR-2026-0064 approved as platform-owner and net-kingdom-owner. +- `make deploy-window-watch` created the ServiceAccount, Role, RoleBinding and CronJob. +- Binding confirmed for uid `180a2463-…`. The first entry named no uid; the second corrects it. +- `applier-apply` through the warden platform-admin lane: `exit=0`, status `applied`. +- After the endpoint fix: `make deploy-window-watch` again with the new image. + +## Runs, read by the agent as `sso/nk-agent-status` + +| Run | Image | Result | +| --- | --- | --- | +| 09:20Z | `6e364fd9…` | exit 5, before the OpenBao role existed | +| 09:30Z | `6e364fd9…` | exit 5, `URLError` (the founder read the log line): the new pod's NetworkPolicy was not yet live, and the watcher did not wait | +| 09:40Z | `d8112ccb…` | **exit 0, Succeeded:** in mode `flag` this is `ok`. It logged in with its own role, read the watched role path (absent) and listed the run Jobs | + +## Problems met on the way, all fixed + +- **The lane's dry-run payload** lacked `source` and `body` for `policy_write`, so `render_applier_dry_run` + crashed. Fixed, with a test that renders through the CLI. `approve --record-state-hub` no longer assumes KV fields. +- **The watcher made its first call without waiting for the network.** It now waits up to 30 s per endpoint and + names an unreachable one. + +## Not covered + +- A live positive flag, a real stale window, was not provoked. The flag and close paths are tested on stubs. +- Mode `close` (delete) needs its own founder and platform-owner decision and a CCR amendment. diff --git a/workplans/NK-WP-0058-bounded-execution-operability.md b/workplans/NK-WP-0058-bounded-execution-operability.md index 4cee72a..7ca0bd1 100644 --- a/workplans/NK-WP-0058-bounded-execution-operability.md +++ b/workplans/NK-WP-0058-bounded-execution-operability.md @@ -4,7 +4,7 @@ type: workplan title: "Bounded execution operability: clear boundaries, lean interfaces, transparent diagnostics" domain: infotech repo: net-kingdom -status: active +status: finished flavor: implementation owner: claude topic_slug: netkingdom @@ -507,11 +507,9 @@ to ask the founder for on 2026-11-04/05 is then readable, or explicitly founder- ```task id: NK-WP-0058-T06 -status: wait +status: done priority: medium assignee: claude-code -blocked_on: message-from:railiance-platform -blocking_reason: "CCR-2026-0064 drafted (railiance-platform b142131, proposed): founder approval, deploy-window-watch, binding confirmation and the delegated apply." depends_on: [NK-WP-0058-T09] state_hub_task_id: "6a4c7413-0675-5a06-b471-5f849ce0c721" ``` @@ -550,6 +548,16 @@ The open check from 2026-11-05 on the overnight window is T11. Then the agent verifies the watch Jobs. +**Done 2026-11-06** ([evidence](../docs/evidence/2026-11-06-nk58-t06-window-watch/README.md)). + +- **Applied:** the founder approved and applied CCR-2026-0064 and deployed the watch. +- **First runs:** the first two exited 5, the second with `URLError`, because the watcher did not wait for the new + pod's NetworkPolicy. Fixed in `b477323`; image `d8112ccb` is pinned in rapp `b36733a`. +- **Verified:** the 09:40Z run Succeeded with exit 0 (`ok` in flag mode), read by the agent's status identity. +- **Now:** an unclosed window is flagged every 10 minutes without human memory. +- **Not provoked live:** a real stale window. The flag and close paths are stub-tested. +- **Close mode:** needs its own decision. + ### Runbook and tooling conventions ```task