NK-WP-0058 finished: T06 done, window watch live (09:40Z run ok); all eleven tasks done

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

docs/evidence/2026-11-06-nk58-t06-window-watch/README.md

@@ -0,0 +1,41 @@
+# NK-WP-0058-T06: the write-role window is watched without human memory (2026-11-06)
+
+**Result:** a CronJob in `sso` checks every 10 minutes whether CCR-2026-0058's write role
+`net-kingdom-bind-executor-svc-authelia-write` exists while no bounded-executor run Job is active or recent. In mode
+`flag` the watch Job then fails, which the agent's status identity sees. Contract row O5.
+
+| Piece | Where |
+| --- | --- |
+| Rule and modes | net-kingdom `bounded-executor/window_watch.py` (`c63aa39`; endpoint wait `b477323`), 10 stub tests |
+| CronJob, ServiceAccount `sso/nk-window-watch`, Role (list Jobs only) | rapp-bounded-executor `manifests/window-watch.yaml` (`df61bd0`), `make deploy-window-watch` |
+| Image | `sha256:d8112ccb37f2…` (tag `main-b477323`); executor files verified byte-identical to `b477323`; pinned in rapp `b36733a` |
+| OpenBao role and policy | railiance-platform CCR-2026-0064 (`b142131`; lane fix `6953005`; records `de06f49`). New request type `auth-role-presence-watch` with lane `scripts/auth_role_watch_lane.py`; generated policy: `read` on the watched role path only, plus token self-lifecycle |
+| Contract tests | `tools/contract-tests/tests/test_window_watch_contract.py` (watcher and CCR agree), railiance-platform `tests/test_auth_role_watch_lane.py`, rapp packaging tests |
+
+## Founder steps (attended)
+
+- CCR-2026-0064 approved as platform-owner and net-kingdom-owner.
+- `make deploy-window-watch` created the ServiceAccount, Role, RoleBinding and CronJob.
+- Binding confirmed for uid `180a2463-…`. The first entry named no uid; the second corrects it.
+- `applier-apply` through the warden platform-admin lane: `exit=0`, status `applied`.
+- After the endpoint fix: `make deploy-window-watch` again with the new image.
+
+## Runs, read by the agent as `sso/nk-agent-status`
+
+| Run | Image | Result |
+| --- | --- | --- |
+| 09:20Z | `6e364fd9…` | exit 5, before the OpenBao role existed |
+| 09:30Z | `6e364fd9…` | exit 5, `URLError` (the founder read the log line): the new pod's NetworkPolicy was not yet live, and the watcher did not wait |
+| 09:40Z | `d8112ccb…` | **exit 0, Succeeded:** in mode `flag` this is `ok`. It logged in with its own role, read the watched role path (absent) and listed the run Jobs |
+
+## Problems met on the way, all fixed
+
+- **The lane's dry-run payload** lacked `source` and `body` for `policy_write`, so `render_applier_dry_run`
+  crashed. Fixed, with a test that renders through the CLI. `approve --record-state-hub` no longer assumes KV fields.
+- **The watcher made its first call without waiting for the network.** It now waits up to 30 s per endpoint and
+  names an unreachable one.
+
+## Not covered
+
+- A live positive flag, a real stale window, was not provoked. The flag and close paths are tested on stubs.
+- Mode `close` (delete) needs its own founder and platform-owner decision and a CCR amendment.