coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T03 done: readiness command, executor-lanes status, R1 via the preflight source check
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
tools/bounded-execution-readiness/ready.py (make bounded-execution-ready): agent-identity checks from
owner source (admission, approver chain at the Argo pin and main, access-engine profile, CCRs by the
owner's RUNBOOK_ALLOWED_STATUSES, case and broker type pin), and three named read-only founder checks.
executor-lanes.py status: write role, fence, cas_required; no write. A replay test catches 2026-11-04.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-05 23:37:03 +01:00
parent 64cec27c28
commit a29d92ecda
8 changed files with 452 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/bounded-execution-contract-table.md
View file

@ -189,10 +189,11 @@ resolve through the rapp config and must equal the routing recipient for the mem
(`plan.source.files`).
- **Gap:** no record links the digest to the commit to the admission pins, so "the admission's pins match the
pinned image" cannot be checked.
- **Proposal:**
- the image workflow writes a value-free pin record (commit, file sha256s, digest);
- rapp pins that record;
- the renderer refuses when the admission's file hashes are not the image's (T03).
- **Resolved without new records (T03, 2026-11-05):** the image is tagged `main-<commit>` by its workflow, and
the executor's own `source` preflight check compares the admission's pinned file hashes with the files inside
the running image. rapp `make preflight` runs that check in the pinned image before a window opens, so a pin
mismatch shows as `preflight:source` ahead of the window. Remaining hand step: copying the digest into the rapp
`Makefile`.
### R2: config, Job and exit codes
@ -215,7 +216,7 @@ resolve through the rapp config and must equal the routing recipient for the mem
- E1: lane names and policy text, from the CCRs;
- E5: the approver, compared until it has one source;
- E8: the RBAC copy;
- R1: the pin record;
- R1: the pin chain, now checked by the preflight `source` check (T03);
- R2: the config schema.
- **delete:** nothing yet. The candidates are the hand copies named under merge, once they are derived or checked.
- **owner decision** (to NK-WP-0057-T01 or the named owner):