coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T11 done: OpenBao audit shows no use of the write role during the overnight window
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Founder-run, value-free audit read: no login, no write-policy request and no failed kubernetes
login from 23:33:29Z to the 08:26:56Z close; all logins are the attended runs, diagnostics and the
pilot (positive control). Pilot README times corrected from the audit log.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-05 22:42:33 +01:00
parent 7031c97442
commit ae55499fcb
7 changed files with 282 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/NK-WP-0058-bounded-execution-operability.md
View file

@ -76,7 +76,7 @@ and T07 can run in parallel with these, and T08 comes last.
```task
id: NK-WP-0058-T11
status: todo
status: done
priority: high
assignee: claude-code
state_hub_task_id: "e2d02456-b072-5d42-a25b-964dc14de5ef"
@ -94,6 +94,24 @@ founder runs them and reports one result line for each.
**Done when:** a dated, value-free receipt records both results under the NK-WP-0056 pilot evidence. Any login that
was found is routed as a security finding to railiance-platform.
**Result, 2026-11-05: clean.** Evidence is in `docs/evidence/2026-11-05-nk58-t11-write-role-check/`, linked from the
NK-WP-0056 pilot README.
- From 23:33:29Z (the last attended login plus the 15-minute token lifetime) to the close at 08:26:56Z, there was no
login with the write role, no request with its policy, and no failed Kubernetes login.
- All five logins in the log are the documented attended runs and diagnostics, plus the pilot run.
- The role is absent at the end of the log (21:33Z). This was derived from the audit log's create and delete
entries, because the direct `window-close` read failed for lack of a platform-admin login.
- No finding was routed.
Tool: `tools/service-binds/write-role-audit.py`, with tests in `tests/test_write_role_audit.py`.
Inputs for other tasks:
- **T06:** the audit file is not rotated (2 GiB PVC, history since 2026-08-03), and one read takes about 10 minutes
through `kubectl exec`. A recurring check should use audit forwarding (NK-WP-0055-T11), not this stream.
- **T03:** the failed close reported only `LaneError`, without its cause.
### Interface and responsibility inventory, part 1: executor and its services
```task