coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T05: founder decision 4af1ec01 opened (agent status grant, options A-D); task waits
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 00:54:43 +01:00
parent 9c73a5fa09
commit 9bbd53c928
2 changed files with 18 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -374,7 +374,7 @@
| task | NK-WP-0058-T02 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T03 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T05 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T05 | wait | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |

19
workplans/NK-WP-0058-bounded-execution-operability.md
View file

@ -430,11 +430,12 @@ make four commands plus the approval. `close` is for emergencies.
```task
id: NK-WP-0058-T05
status: todo
status: wait
priority: medium
assignee: claude-code
needs_human: true
intervention_note: "Founder approves a read-only status grant for the agent identity (owner: railiance-cluster / railiance-platform)."
decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984"
intervention_note: "Founder chooses option A-D for the agent status grant (decision 4af1ec01); then railiance-cluster reviews the RBAC and the founder applies it."
depends_on: [NK-WP-0058-T10]
state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
```
@ -442,6 +443,20 @@ state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
The State Hub decision for this gate is created once T10 has listed the statuses the agent could not read. Its id
then goes into this task block (C-39).
**2026-11-06: decision open** (`4af1ec01`). The proposal is in
`docs/proposals/2026-11-06-nk58-t05-agent-status-grant/`: `rbac.yaml`, not applied, and the options.
- **Recommended option A:** a dedicated ServiceAccount `sso/nk-agent-status`, following SI-14, rather than a wider
`ops-mason-builder`. It reads Jobs, pods, Deployments and ExternalSecrets in `sso`, one named ConfigMap in
`informed-decision` and one Argo Application. No Secrets, pod logs, exec or writes, and 1 h tokens minted per
session.
- **Pod logs stay founder-only,** because RBAC cannot limit them to the executor's pods (option B).
- `tools/contract-tests/tests/test_agent_status_grant.py` keeps the grant read-only and narrow, and keeps `sso`
workloads free of literal secret values, since pod specs become readable.
After the decision: railiance-cluster reviews the change, the founder applies it, and the agent verifies with
`can-i`.
Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers:
- the status and conditions of Jobs, pods, ExternalSecrets and Deployments;