From 74599a583dd95f0a910774346aed451d74637376 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 18:49:00 +0100 Subject: [PATCH] NK-WP-0056-T10: prerequisites; CCR-2026-0059 drafted; two executor gaps recorded Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- workplans/NK-WP-0056-bounded-executor-path.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 214dc2b..39b7dd3 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -408,6 +408,20 @@ check between consumers; failure triggers the revert path. **Done when:** the journey runs unattended against live with no person involved, and fails closed against a deliberately broken bind on a synthetic directory (T08). +**2026-10-31, prerequisites:** + +- Done: the `sso` ingress rules for executor pods were applied by the founder and read back live. +- Done: railiance-platform CCR-2026-0059 drafted (`c9b68ea`, `proposed`). It is the journey read with its own role, + `net-kingdom-bind-executor-syn-journey-read`. It widens CCR-2026-0057 and proposes a standing reader. +- Two executor gaps found while drafting it: + 1. **Two roles.** The executor logs in to OpenBao once (`openbao.k8s_role`) and reads the bind and the journey with + that token. railiance-platform keeps one role per lane and never combines policies, so the executor needs a + second login for the journey read: a `journey.k8s_role` and its own `OpenBao` client, revoked like the first. + 2. **Audience.** CCR-2026-0058 and CCR-2026-0059 bind audience `openbao`. The rapp Job projects only the default + API-audience token, so it also needs an `openbao`-audience projected token, and `openbao.jwt_file` must point + to it. +- Both need an executor change, a new image and a new pin. + ## Executor runtime: core runner ```task