NK-WP-0056-T10: prerequisites; CCR-2026-0059 drafted; two executor gaps recorded

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

workplans/NK-WP-0056-bounded-executor-path.md

@@ -408,6 +408,20 @@ check between consumers; failure triggers the revert path.
 **Done when:** the journey runs unattended against live with no person involved, and fails closed
 against a deliberately broken bind on a synthetic directory (T08).
 
+**2026-10-31, prerequisites:**
+
+- Done: the `sso` ingress rules for executor pods were applied by the founder and read back live.
+- Done: railiance-platform CCR-2026-0059 drafted (`c9b68ea`, `proposed`). It is the journey read with its own role,
+  `net-kingdom-bind-executor-syn-journey-read`. It widens CCR-2026-0057 and proposes a standing reader.
+- Two executor gaps found while drafting it:
+  1. **Two roles.** The executor logs in to OpenBao once (`openbao.k8s_role`) and reads the bind and the journey with
+     that token. railiance-platform keeps one role per lane and never combines policies, so the executor needs a
+     second login for the journey read: a `journey.k8s_role` and its own `OpenBao` client, revoked like the first.
+  2. **Audience.** CCR-2026-0058 and CCR-2026-0059 bind audience `openbao`. The rapp Job projects only the default
+     API-audience token, so it also needs an `openbao`-audience projected token, and `openbao.jwt_file` must point
+     to it.
+- Both need an executor change, a new image and a new pin.
+
 ## Executor runtime: core runner
 
 ```task