coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T06 prep: admission helper, write-role window-open/close, service-client case; T15 evidence

Browse source 
- bounded-executor/prepare_admission.py: the live admission from the pilot example, pins read
  from the image's commit, window <= 2 h (audit-core's declared bound), validated.
- executor-lanes.py window-open/window-close: CCR-2026-0058's window-scoped write role, created
  for one admitted open window under attended platform-admin and deleted afterwards (idempotent).
- security-cases/nk-bind-executor-approval.yaml: the case of record, proposed (founder acceptance).
- docs/evidence/2026-11-04-nk56-t15-audit-sender: 8 checks against audit-core 876c3f6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
This commit is contained in:
tegwick 2026-11-04 01:49:40 +01:00
parent 9bd7bf0bdc
commit c43afd46a7
7 changed files with 368 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

44
docs/evidence/2026-11-04-nk56-t15-audit-sender/README.md Normal file
View file

@ -0,0 +1,44 @@
# NK-WP-0056-T15: executor audit sender against audit-core's real ingestion (2026-11-04)
Agent-run, local only, synthetic tokens, everything removed afterwards:
`python3 bounded-executor/exercise_audit_sender.py --receipt FILE`.
**Setup:**
- **audit-core:** source `876c3f6`. It runs in-process with `IngestionApplication` and the SQLite backend. The sender
registry is built the way production builds it: a Secret-shaped `AUDIT_CORE_SENDERS` entry, deliberately minted with
the defaults, plus the Git scope overlay `deploy/senders-scope.json`.
- **Executor:** the real code. `executor.Run.execute()` runs on in-memory operations and emits through
`clients.AuditCore` over HTTP with a token file. Two runs: one completed, one reverted.
Receipt: [`receipt.json`](receipt.json). It is value-free; the harness asserts that no generated token appears in it.
| Check | Result |
| --- | --- |
| Completed run: started and receipt | 202 each |
| Reverted run: started and receipt | 202 each |
| Both emitted pairs against receipt schema v0.1 (EAR-1..EAR-10) | valid |
| Retry of the same event | 200 duplicate; the client counts it as stored |
| Same id with another body | 409; the client reports "run id reused", never retried |
| Wrong source, wrong tenant (`tenant:platform`), another sender's token, no token, unknown token | refused, and nothing stored under that run id |
| A started event with no receipt, whose admission window closed 2 h ago | `opening_without_closing`, `bound: window.not_after` |
| The closed runs | not flagged |
**Built for this task** (`d7133e3`):
- `canon/schemas/execution-attribution-receipt_v0.1.schema.json`
- `tools/execution-attribution-receipt/`: the validator, and fixtures generated from the executor
- the started event now carries `data.window.not_after`, which audit-core asked for in AUDIT-WP-0018-T03
**Limitations:**
- audit-core runs from source, not from the released receiver image.
- The executor's operations are in-memory; the rotation itself is T12's synthetic pilot.
- Plain HTTP on loopback.
**Live path:**
- Custody of the sender bearer is CCR-2026-0063 (railiance-platform, proposed). It is delivered by ESO as
`sso/bounded-executor-tokens` key `audit-core`, which the run Job already mounts.
- Ingress is `audit-core-nk-bounded-executor-ingress` (T16).
- The founder seed is in audit-core `docs/bounded-executor-receipts.md`, "Founder runbook".

32
docs/evidence/2026-11-04-nk56-t15-audit-sender/receipt.json Normal file
View file

@ -0,0 +1,32 @@
{
"schema": "netkingdom.bounded-executor.audit-sender-exercise/v1",
"task": "NK-WP-0056-T15",
"target": "disposable local processes; synthetic tokens",
"started_at": "2026-11-04T00:40:11+00:00",
"audit_core_commit": "876c3f6647798daff56086e03d413f4559bd32a1",
"senders_scope_sha256": "bd29068f9738e3f20939a1e42f96b3c8f836ef6c1bfbc60b39361ca7aa19ebfc",
"net_kingdom_commit": "d7133e3a0489373fa7c9fbf581e36509218e496b",
"executor_source_sha256": {
"executor.py": "e82cd03eba32f4542c1d4842d13f442af8db098deb380160c3fc6c158b1d0d58",
"clients.py": "f0ce580f1beba91b7154051a35c088205de01f26d63a119a23bd926fe1c772cb"
},
"receipt_schema_sha256": "5036bffc81380183e86a7c0c6199c8e72446f7e4e66a79ea4fc4123475d8ac3b",
"limitations": [
"audit-core runs from source in-process (SQLite backend), not the released receiver image",
"the executor's operations are in-memory; the bind rotation itself is T12's synthetic pilot",
"plain HTTP on loopback; the live path is the ESO-delivered bearer over the sso ingress (T16)"
],
"checks": {
"completed_run_started_and_receipt_accepted_202": true,
"reverted_run_started_and_receipt_accepted_202": true,
"emitted_pairs_pass_receipt_schema_v0_1": true,
"retry_is_duplicate_200": true,
"same_id_other_body_conflict_409_reported_as_defect": true,
"wrong_source_tenant_or_token_refused_and_not_stored": true,
"started_without_receipt_flagged_by_its_own_window": true,
"closed_runs_not_flagged": true
},
"status": "passed",
"cleanup_complete": true,
"finished_at": "2026-11-04T00:40:11+00:00"
}