From e181fb0cfb70976a2a6f2833b2aa3ac040dcaa0d Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Thu, 5 Nov 2026 09:27:47 +0100
Subject: [PATCH] NK-WP-0056-T06: pilot-run.sh, window open, run, and an
 EXIT-trap window close (a diagnostic window stayed open overnight)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
---
 sso-mfa/k8s/bounded-executor/pilot-run.sh | 31 +++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100755 sso-mfa/k8s/bounded-executor/pilot-run.sh

diff --git a/sso-mfa/k8s/bounded-executor/pilot-run.sh b/sso-mfa/k8s/bounded-executor/pilot-run.sh
new file mode 100755
index 0000000..8504605
--- /dev/null
+++ b/sso-mfa/k8s/bounded-executor/pilot-run.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# NK-WP-0056-T06 founder-run pilot: open the window, run one admission, ALWAYS close the window.
+#   sso-mfa/k8s/bounded-executor/pilot-run.sh ADMISSION_FILE APPROVAL_ID EVIDENCE_DIR
+# Needs an attended `bao login -method=oidc -path=netkingdom role=platform-admin` in this shell first, and the
+# approval already approved in informed-decision by the admission's approver. Prints value-free results only.
+# The close runs from an EXIT trap, so a failed or interrupted run never leaves the write role open
+# (2026-11-05: a diagnostic window stayed open overnight).
+set -euo pipefail
+A=${1:?admission file}; APPROVAL=${2:?approval id}; E=${3:?evidence dir}
+NK=$HOME/net-kingdom; RAPP=$HOME/rapp-bounded-executor; PLAT=$HOME/railiance-platform
+K="kubectl --kubeconfig $HOME/.kube/config-railiance01"
+export BAO_ADDR=${BAO_ADDR:-http://127.0.0.1:18200} VAULT_ADDR=${VAULT_ADDR:-http://127.0.0.1:18200}
+mkdir -p "$E"
+ID=$(python3 -c "import yaml,sys; print(yaml.safe_load(open(sys.argv[1]))['spec']['id'])" "$A")
+JOB=bounded-executor-$(echo "$ID" | tr 'A-Z' 'a-z')
+W=$(sha256sum "$PLAT"/credential-change-requests/CCR-2026-0058-*.yaml | cut -d' ' -f1)
+J=$(sha256sum "$PLAT"/credential-change-requests/CCR-2026-0059-*.yaml | cut -d' ' -f1)
+n=$(ls "$E" 2>/dev/null | wc -l)
+close() {
+  python3 "$NK/tools/service-binds/executor-lanes.py" window-close --admission "$A" --receipt "$E/$(printf %02d $((n + 3)))-window-close.json" || true
+}
+python3 "$NK/tools/service-binds/executor-lanes.py" window-open --admission "$A" --write-ccr-sha256 "$W" \
+  --journey-ccr-sha256 "$J" --receipt "$E/$(printf %02d $((n + 1)))-window-open.json"
+trap close EXIT
+CFG=$(mktemp --suffix=.json)
+python3 -c "import json,sys; c=json.load(open(sys.argv[1])); c['trust_satisfied']=['runtime_secret_trust','runtime_identity_trust']; json.dump(c, open(sys.argv[2],'w'), indent=2)" "$RAPP/examples/config.pilot.json" "$CFG"
+$K -n sso delete job "$JOB" --ignore-not-found >/dev/null; $K -n sso delete configmap "$JOB" --ignore-not-found >/dev/null
+(cd "$RAPP" && make run ADMISSION="$A" APPROVAL_ID="$APPROVAL" CONFIG="$CFG" KUBECTL="$K")
+$K -n sso wait --for=condition=complete --for=condition=failed "job/$JOB" --timeout=1500s
+$K -n sso logs "job/$JOB" > "$E/$(printf %02d $((n + 2)))-result.json"
+tail -40 "$E/$(printf %02d $((n + 2)))-result.json"