diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8cd58cd..31cda20 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -53,7 +53,7 @@ | workplan | NK-WP-0053 | finished | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md | | workplan | NK-WP-0054 | active | — | workplans/NK-WP-0054-service-identity-policy.md | | workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md | -| workplan | NK-WP-0056 | proposed | — | workplans/NK-WP-0056-bounded-executor-path.md | +| workplan | NK-WP-0056 | finished | — | workplans/NK-WP-0056-bounded-executor-path.md | | workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | @@ -349,8 +349,8 @@ | task | NK-WP-0056-T03 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T04 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T05 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | -| task | NK-WP-0056-T06 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md | -| task | NK-WP-0056-T07 | wait | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0056-T06 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0056-T07 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T08 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T09 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T10 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | diff --git a/docs/evidence/2026-11-04-nk56-t06-pilot/09-window-close-late.json b/docs/evidence/2026-11-04-nk56-t06-pilot/09-window-close-late.json new file mode 100644 index 0000000..4512570 --- /dev/null +++ b/docs/evidence/2026-11-04-nk56-t06-pilot/09-window-close-late.json @@ -0,0 +1,10 @@ +{ + "action": "window-close", + "admission": "BEA-2026-0002", + "phase": "done", + "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828", + "status": "window_closed", + "values_recorded": false, + "write_role_absent": true, + "write_role_was_present": true +} diff --git a/docs/evidence/2026-11-05-nk56-t06-pilot/01-window-open.json b/docs/evidence/2026-11-05-nk56-t06-pilot/01-window-open.json new file mode 100644 index 0000000..462c9cc --- /dev/null +++ b/docs/evidence/2026-11-05-nk56-t06-pilot/01-window-open.json @@ -0,0 +1,14 @@ +{ + "action": "window-open", + "admission": "BEA-2026-0003", + "admission_digest": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721", + "phase": "preconditions", + "reason": "write_role_already_open", + "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828", + "status": "failed", + "values_recorded": false, + "window": { + "not_after": "2026-11-05T10:20:00Z", + "not_before": "2026-11-05T08:20:00Z" + } +} diff --git a/docs/evidence/2026-11-05-nk56-t06-pilot/02-window-open.json b/docs/evidence/2026-11-05-nk56-t06-pilot/02-window-open.json new file mode 100644 index 0000000..d9de067 --- /dev/null +++ b/docs/evidence/2026-11-05-nk56-t06-pilot/02-window-open.json @@ -0,0 +1,24 @@ +{ + "action": "window-open", + "admission": "BEA-2026-0003", + "admission_digest": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721", + "ccr_sha256": { + "journey": "4c956f58248e12c631d3990aee0d287f2e11be72f7c6023bfa02d049d2143a98", + "write": "f4d75c3e1b931d07a094e07c1d77e328b040ffcf08a30e41e5681c093498917b" + }, + "close_by": "2026-11-05T10:20:00Z", + "exact_role": true, + "phase": "done", + "source_ccrs": { + "journey": "CCR-2026-0059", + "write": "CCR-2026-0058" + }, + "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828", + "status": "window_opened", + "values_recorded": false, + "window": { + "not_after": "2026-11-05T10:20:00Z", + "not_before": "2026-11-05T08:20:00Z" + }, + "write_role_created": true +} diff --git a/docs/evidence/2026-11-05-nk56-t06-pilot/03-result.json b/docs/evidence/2026-11-05-nk56-t06-pilot/03-result.json new file mode 100644 index 0000000..1808f5f --- /dev/null +++ b/docs/evidence/2026-11-05-nk56-t06-pilot/03-result.json @@ -0,0 +1,121 @@ +{ + "outcome": "completed", + "receipt": { + "correlation_id": "eae561c3-9a1d-4068-93fa-167a023ae127", + "data": { + "action": "bounded-execution", + "artifact_digest": "sha256:4c44e122804cb25252785e961818c485101f3ec4083bef25f2bee8d4f71a5678", + "attempts": 1, + "budget": { + "limit": { + "attempts": 2, + "wall_time_seconds": 1200 + }, + "used": { + "attempts": 1, + "wall_time_seconds": 30.513 + } + }, + "decision_refs": [ + { + "label": "admission", + "ref": "BEA-2026-0003" + }, + { + "label": "admission_digest", + "ref": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721" + }, + { + "label": "approval", + "ref": "5c91717a-cfa7-478b-978e-51560cd595b9" + } + ], + "environment": "PRODUCTION", + "executing_workload": "service:nk-bind-executor", + "initiator": { + "iss": "https://kc.coulomb.social", + "role": "approver", + "sub": "uid=admin,ou=people,dc=netkingdom,dc=local" + }, + "outcome": "completed", + "pdp": "not-evaluated", + "receipt_version": "0.1", + "reverted": false, + "run_id": "eae561c3-9a1d-4068-93fa-167a023ae127", + "runtime_principal": "system:serviceaccount:sso:nk-bind-executor", + "source_commit": "c2a0f2f4e049", + "steps": [ + { + "checks": [ + { + "id": "kv-advanced", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "generate", + "kind": "step", + "operation": "openbao.kv.write-next-version", + "outcome": "done", + "target": "openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia" + }, + { + "checks": [ + { + "id": "bind-signs-in", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "set-directory", + "kind": "step", + "operation": "lldap.user.change-own-password-from-kv", + "outcome": "done", + "target": "lldap:svc-authelia" + }, + { + "checks": [ + { + "id": "eso-synced", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "deliver", + "kind": "step", + "operation": "eso.force-sync", + "outcome": "done", + "target": "k8s:sso/externalsecret/authelia-secrets" + }, + { + "checks": [ + { + "id": "synthetic-journey", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "restart", + "kind": "step", + "operation": "k8s.rollout-restart", + "outcome": "done", + "target": "k8s:sso/deployment/authelia" + } + ], + "target": "admission:BEA-2026-0003", + "tenant": "platform", + "time_interval": { + "clock_source": "system-utc", + "end": "2026-11-05T08:30:42Z", + "start": "2026-11-05T08:30:11Z" + } + }, + "id": "run:eae561c3-9a1d-4068-93fa-167a023ae127:receipt", + "occurred_at": "2026-11-05T08:30:42+00:00", + "source": "net-kingdom.bounded-executor", + "subject": "admission:BEA-2026-0003", + "tenant": "platform", + "type": "execution.attribution.receipt" + }, + "run_id": "eae561c3-9a1d-4068-93fa-167a023ae127" +} diff --git a/docs/evidence/2026-11-05-nk56-t06-pilot/04-window-close.json b/docs/evidence/2026-11-05-nk56-t06-pilot/04-window-close.json new file mode 100644 index 0000000..36847aa --- /dev/null +++ b/docs/evidence/2026-11-05-nk56-t06-pilot/04-window-close.json @@ -0,0 +1,10 @@ +{ + "action": "window-close", + "admission": "BEA-2026-0003", + "phase": "done", + "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828", + "status": "window_closed", + "values_recorded": false, + "write_role_absent": true, + "write_role_was_present": true +} diff --git a/docs/evidence/2026-11-05-nk56-t06-pilot/README.md b/docs/evidence/2026-11-05-nk56-t06-pilot/README.md new file mode 100644 index 0000000..9426727 --- /dev/null +++ b/docs/evidence/2026-11-05-nk56-t06-pilot/README.md @@ -0,0 +1,35 @@ +# NK-WP-0056-T06: live pilot, unattended bind rotation under one admission (2026-11-05) + +**Completed.** The bounded executor rotated `svc-authelia`'s LLDAP bind in production under admission +`BEA-2026-0003`. The founder's only act in the run was the approval: `admin`, aal2 with OTP, in informed-decision. + +| Item | Value | +| --- | --- | +| Admission | `admissions/BEA-2026-0003.yaml`, digest `sha256:917ad448…1721`, window 08:20Z–10:20Z, pins at `c2a0f2f` | +| Image | `sha256:5f5df866…8a92` (rapp `3ecd462`) | +| Approval | `5c91717a-cfa7-478b-978e-51560cd595b9`, filed by `service:nk-bind-executor` with its own KeyCape client, presented as memo `bea-2026-0003-5c91717a`, approved by `uid=admin,ou=people,dc=netkingdom,dc=local` | +| Write-role window | opened `02-window-open.json`, closed `04-window-close.json` (`write_role_was_present: true`, now absent). `01` is a refused open: the role was still present from the night before (see below) | +| Run `eae561c3-9a1d-4068-93fa-167a023ae127` | `completed`; 08:30:11Z–08:30:42Z (30.5 s of 1200 s); 1 of 2 attempts; no revert | +| Steps (each with its check) | `generate` (`kv-advanced` pass), `set-directory` (`bind-signs-in` pass), `deliver` (`eso-synced` pass), `restart` (`synthetic-journey` pass at aal2) | +| Custody | started event and receipt accepted by audit-core: the run reports neither `audit_unavailable` nor `receipt_not_in_custody` | +| Receipt | [`receipt-event.json`](receipt-event.json): valid against schema v0.1 (EAR-1..9). `initiator.iss` is `https://kc.coulomb.social`, `initiator.sub` is admin | +| Posture feedback (T07) | [`posture-feedback-report.json`](posture-feedback-report.json): the receipt read through section 4a, `ok`, no findings (a clean run raises none) | +| Values | none in any file: the result names operations, outcomes and check results only | + +## Incident: write role open overnight + +The last diagnostic of the first attempt opened BEA-2026-0002's window at about 23:20Z +(`2026-11-04-nk56-t06-pilot/07-window-open-diag.json`). The final close never ran, so the role stayed until +08:24Z, when `09-window-close-late.json` closed it. + +- **Exposure:** only `sso/nk-bind-executor` (audience `openbao`) could log in, with tokens of at most 15 minutes, + and no executor Job or diagnostic ran in that time. +- **Remedy:** `sso-mfa/k8s/bounded-executor/pilot-run.sh` now opens the window, runs, and closes it from an EXIT trap, + so a failed or interrupted run never leaves it open (`e181fb0`, wait fixed in `216a5db`). +- **Not yet done:** confirming "no login" from OpenBao's audit log. That would need the audit device and a reviewed + read, and it remains open. + +## Still open for oidc-service-client + +`excess-scope-refused` (KeyCape answers `invalid_profile_usage` to a scope outside the list) is proven against the +pinned KeyCape image in T19, not yet against live KeyCape. The case stays `materialized` until that live check. diff --git a/docs/evidence/2026-11-05-nk56-t06-pilot/posture-feedback-report.json b/docs/evidence/2026-11-05-nk56-t06-pilot/posture-feedback-report.json new file mode 100644 index 0000000..7845d36 --- /dev/null +++ b/docs/evidence/2026-11-05-nk56-t06-pilot/posture-feedback-report.json @@ -0,0 +1,24 @@ +{ + "apiVersion": "netkingdom.io/posture-feedback/v0.1", + "as_of": "2026-11-05T09:00:00Z", + "automation": { + "declaration_mutation_permitted": false, + "external_write_permitted": false, + "mode": "proposal-only", + "policy_mutation_permitted": false + }, + "fail_on": "none", + "findings": [], + "horizon_days": 30, + "kind": "PostureFeedbackReport", + "ok": true, + "report_digest": "sha256:344b24f18d3a5fafe547ed1dc9dca6e0fe73d441842b1ede9d8345a02d83e558", + "summary": { + "high": 0, + "low": 0, + "medium": 0, + "total": 0, + "unknown_owner": 0 + }, + "validation_errors": [] +} diff --git a/docs/evidence/2026-11-05-nk56-t06-pilot/receipt-event.json b/docs/evidence/2026-11-05-nk56-t06-pilot/receipt-event.json new file mode 100644 index 0000000..d0c1070 --- /dev/null +++ b/docs/evidence/2026-11-05-nk56-t06-pilot/receipt-event.json @@ -0,0 +1,117 @@ +{ + "correlation_id": "eae561c3-9a1d-4068-93fa-167a023ae127", + "data": { + "action": "bounded-execution", + "artifact_digest": "sha256:4c44e122804cb25252785e961818c485101f3ec4083bef25f2bee8d4f71a5678", + "attempts": 1, + "budget": { + "limit": { + "attempts": 2, + "wall_time_seconds": 1200 + }, + "used": { + "attempts": 1, + "wall_time_seconds": 30.513 + } + }, + "decision_refs": [ + { + "label": "admission", + "ref": "BEA-2026-0003" + }, + { + "label": "admission_digest", + "ref": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721" + }, + { + "label": "approval", + "ref": "5c91717a-cfa7-478b-978e-51560cd595b9" + } + ], + "environment": "PRODUCTION", + "executing_workload": "service:nk-bind-executor", + "initiator": { + "iss": "https://kc.coulomb.social", + "role": "approver", + "sub": "uid=admin,ou=people,dc=netkingdom,dc=local" + }, + "outcome": "completed", + "pdp": "not-evaluated", + "receipt_version": "0.1", + "reverted": false, + "run_id": "eae561c3-9a1d-4068-93fa-167a023ae127", + "runtime_principal": "system:serviceaccount:sso:nk-bind-executor", + "source_commit": "c2a0f2f4e049", + "steps": [ + { + "checks": [ + { + "id": "kv-advanced", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "generate", + "kind": "step", + "operation": "openbao.kv.write-next-version", + "outcome": "done", + "target": "openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia" + }, + { + "checks": [ + { + "id": "bind-signs-in", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "set-directory", + "kind": "step", + "operation": "lldap.user.change-own-password-from-kv", + "outcome": "done", + "target": "lldap:svc-authelia" + }, + { + "checks": [ + { + "id": "eso-synced", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "deliver", + "kind": "step", + "operation": "eso.force-sync", + "outcome": "done", + "target": "k8s:sso/externalsecret/authelia-secrets" + }, + { + "checks": [ + { + "id": "synthetic-journey", + "result": "pass" + } + ], + "consumer": "authelia", + "id": "restart", + "kind": "step", + "operation": "k8s.rollout-restart", + "outcome": "done", + "target": "k8s:sso/deployment/authelia" + } + ], + "target": "admission:BEA-2026-0003", + "tenant": "platform", + "time_interval": { + "clock_source": "system-utc", + "end": "2026-11-05T08:30:42Z", + "start": "2026-11-05T08:30:11Z" + } + }, + "id": "run:eae561c3-9a1d-4068-93fa-167a023ae127:receipt", + "occurred_at": "2026-11-05T08:30:42+00:00", + "source": "net-kingdom.bounded-executor", + "subject": "admission:BEA-2026-0003", + "tenant": "platform", + "type": "execution.attribution.receipt" +} \ No newline at end of file diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index c52fc2a..20d1bd8 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -4,12 +4,12 @@ type: workplan title: "Bounded executor path: founder admits, executors run" domain: infotech repo: net-kingdom -status: proposed +status: finished flavor: design owner: claude topic_slug: netkingdom created: "2026-10-30" -updated: "2026-11-04" +updated: "2026-11-05" related: - NK-WP-0054 - NK-WP-0040 @@ -1061,7 +1061,7 @@ Live (founder-run, after the owners' releases): ```task id: NK-WP-0056-T06 -status: todo +status: done priority: high assignee: claude-code needs_human: true @@ -1112,14 +1112,24 @@ LDAP DN (KeyCape `sub`). - a new admission, BEA-2026-0003, with pins at `c2a0f2f`; - request, then approve as `admin`, then the run. +**Done 2026-11-05** ([evidence](../docs/evidence/2026-11-05-nk56-t06-pilot/README.md)). BEA-2026-0003 completed in +30.5 s, with no revert: + +- KV advanced; LLDAP self-rotation; ESO synced; Authelia restarted; the synthetic journey passed. +- The receipt is valid (schema v0.1), and audit-core holds the started event and the receipt. +- The founder's only act was the approval, as `admin` at aal2. +- The interim routing `net-kingdom-admins` → `admin` is in informed-decision (`77161fe`; Argo pinned in + railiance-platform `31cf74d`). +- The write role stayed open overnight after the diagnostics, without use. `pilot-run.sh` now always closes the + window. + ## Budget and risk enforcement ```task id: NK-WP-0056-T07 -status: wait +status: done priority: medium assignee: claude-code -blocked_on: dependency depends_on: [NK-WP-0056-T06] state_hub_task_id: "a87c5edb-7604-5eba-9261-b1ed2ed16655" ``` @@ -1143,3 +1153,6 @@ pilot's receipts appear in a posture-feedback report. validator. Findings: receipt-missing, not-completed, reverted and budget-pressure, plus the aggregate `execution-recurring-revert`. Owners come from `tools/posture-feedback/execution-owners.yaml`, never inferred. - **Left:** run the report over the pilot's receipts after T06. + +**Done 2026-11-05.** The pilot's receipt appears in a posture-feedback report +(`docs/evidence/2026-11-05-nk56-t06-pilot/posture-feedback-report.json`): validated, `ok`, no findings.