coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058: route owner decisions; E3 and C3 already answered by their owners; NK-WP-0057-T01 gets E5/C7, E2, E7
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-05 23:19:25 +01:00
parent e1561c09ee
commit 7cf210e126
2 changed files with 35 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/NK-WP-0057-decision-routing-by-responsibility.md
View file

@ -89,6 +89,27 @@ Cover at least:
For the bounded-execution path, start from the NK-WP-0058 contract table (NK-WP-0058-T01, T09, T10) instead of
inventorying it again. Its rows marked "needs an owner decision" are inputs here.
**Inputs routed from NK-WP-0058 (2026-11-05).** All are in `docs/bounded-execution-contract-table.md`:
- **E5 + C7, approver and routing.** The approver is defined in four places: the admission's `approvers`, the
rapp's `approver_subjects`, informed-decision's `review-groups.json`, and KeyCape's `sub` format. Nothing checks
that they agree. access-engine policy v14 lists a memo only to its `review_recipient`, so informed-decision's
routing table decides who can approve, without the admission seeing it. This cost the 2026-11-04 window. The
interim check is NK-WP-0058-T03.
- **E2, KeyCape client registration.** ADR-0015 moves runtime packages to `rapp-*`, but there is no KeyCape rapp,
so client registration (env binding and `keycape-client.py apply`) runs from net-kingdom's reference manifests.
Who owns it: net-kingdom, key-cape, or a new rapp?
- **E7, `sso` runtime owners.** `docs/responsibility-map.md` names no runtime owner for LLDAP, Authelia or KeyCape
in `sso`. SCOPE calls `sso-mfa/k8s/` "migration inputs, not blanket authority".
Routed to their owners instead (NK-WP-0058 records the message ids):
- C1 and O1 to railiance-platform;
- O2 to ops-warden;
- C6 to informed-decision and access-engine.
E3 was already answered by approval-engine on 2026-10-31. C3 is tracked in ops-mason MASON-WP-0010-T03.
**Done when:** an inventory table with sources, and the list of routing points in use today (file, owner, what it
decides), is in `docs/proposals/`.