From 9bbd53c92885c0f5be8c69b34e4885d7a7b1fbd7 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 6 Nov 2026 00:54:43 +0100 Subject: [PATCH] NK-WP-0058-T05: founder decision 4af1ec01 opened (agent status grant, options A-D); task waits Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0 --- WORK-RECORDS.md | 2 +- ...K-WP-0058-bounded-execution-operability.md | 19 +++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 9020824..c35b576 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -374,7 +374,7 @@ | task | NK-WP-0058-T02 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T03 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | -| task | NK-WP-0058-T05 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| task | NK-WP-0058-T05 | wait | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | diff --git a/workplans/NK-WP-0058-bounded-execution-operability.md b/workplans/NK-WP-0058-bounded-execution-operability.md index 3a0d504..aba324e 100644 --- a/workplans/NK-WP-0058-bounded-execution-operability.md +++ b/workplans/NK-WP-0058-bounded-execution-operability.md @@ -430,11 +430,12 @@ make four commands plus the approval. `close` is for emergencies. ```task id: NK-WP-0058-T05 -status: todo +status: wait priority: medium assignee: claude-code needs_human: true -intervention_note: "Founder approves a read-only status grant for the agent identity (owner: railiance-cluster / railiance-platform)." +decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984" +intervention_note: "Founder chooses option A-D for the agent status grant (decision 4af1ec01); then railiance-cluster reviews the RBAC and the founder applies it." depends_on: [NK-WP-0058-T10] state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59" ``` @@ -442,6 +443,20 @@ state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59" The State Hub decision for this gate is created once T10 has listed the statuses the agent could not read. Its id then goes into this task block (C-39). +**2026-11-06: decision open** (`4af1ec01`). The proposal is in +`docs/proposals/2026-11-06-nk58-t05-agent-status-grant/`: `rbac.yaml`, not applied, and the options. + +- **Recommended option A:** a dedicated ServiceAccount `sso/nk-agent-status`, following SI-14, rather than a wider + `ops-mason-builder`. It reads Jobs, pods, Deployments and ExternalSecrets in `sso`, one named ConfigMap in + `informed-decision` and one Argo Application. No Secrets, pod logs, exec or writes, and 1 h tokens minted per + session. +- **Pod logs stay founder-only,** because RBAC cannot limit them to the executor's pods (option B). +- `tools/contract-tests/tests/test_agent_status_grant.py` keeps the grant read-only and narrow, and keeps `sso` + workloads free of literal secret values, since pod specs become readable. + +After the decision: railiance-cluster reviews the change, the founder applies it, and the agent verifies with +`can-i`. + Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers: - the status and conditions of Jobs, pods, ExternalSecrets and Deployments;