NK-WP-0058-T05: decided (A, 1 h tokens, 4af1ec01); owner is railiance-platform; founder steps and make agent-status-token

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

Makefile

@@ -212,6 +212,10 @@ bounded-execution-admission-check: ## Validate the example admissions (read-only
 execution-attribution-receipt-test: ## Receipt schema v0.1 validator; fixtures match the executor (NK-WP-0056-T15)
 	python3 -m pytest tools/execution-attribution-receipt/tests
 
+agent-status-token: ## Founder, once per working session: a 1 h read-only token for the agent (NK-WP-0058-T05)
+	@umask 077 && kubectl --kubeconfig $(HOME)/.kube/config-railiance01 -n sso create token nk-agent-status \
+	  --duration=1h > $(HOME)/.kube/nk-agent-status.token && echo "agent-status-token: valid 1h"
+
 conventions-lint: ## Runbook and tooling conventions from the 2026-11-04/05 pilot (NK-WP-0058-T07), read-only
 	python3 tools/conventions/lint.py
 

docs/proposals/2026-11-06-nk58-t05-agent-status-grant/README.md

@@ -1,6 +1,7 @@
 # NK-WP-0058-T05: read-only status for the agent identity (proposal, 2026-11-06)
 
-**Status: proposed, for founder decision.** Nothing is applied.
+**Status: decided 2026-11-06, option A with 1 h tokens** (State Hub `4af1ec01`). Not yet applied: it waits for the
+owner's review.
 
 ## Why
 
@@ -53,17 +54,36 @@ literal secret values (only file paths, references and URLs). `tools/contract-te
 keeps it that way and keeps the grant read-only and narrow.
 
 **Tokens:** at most 1 hour (SI-14), minted by the founder once per working session. This is read-only, so it isn't a
-warden lane:
-
-```bash
-kubectl --kubeconfig ~/.kube/config-railiance01 -n sso create token nk-agent-status --duration=1h \
-  > ~/.kube/nk-agent-status.token && chmod 600 ~/.kube/nk-agent-status.token
-```
+warden lane: `make agent-status-token` (founder steps below).
 
 The agent's kubeconfig `~/.kube/config-agent-status` names the cluster and `tokenFile: ~/.kube/nk-agent-status.token`.
 It holds no token itself. A longer token is a deviation from SI-14 and would need its own decision.
 
-**Who applies it:** railiance-cluster owns cluster RBAC, so after the decision the change goes there as a reviewed
-change. The founder applies it, server-side. Verification:
-- `kubectl auth can-i --list` as `nk-agent-status` shows only these rules;
-- `can-i get secrets -n sso` and `can-i get pods --subresource=log -n sso` both answer `no`.
+**Owner:** railiance-platform. Agent-facing cluster grants live there as platform add-ons, the precedent being
+`argocd/platform-addons/ops-mason-builder/`, applied by a manually synced, pinned Argo Application. The proposal first
+named railiance-cluster, which has no RBAC manifests. railiance-platform is asked to adopt `rbac.yaml` the same way,
+as `argocd/platform-addons/nk-agent-status/`. Unlike ops-mason-builder's certificate User, this identity is a
+ServiceAccount with 1 h tokens (SI-14).
+
+## Founder steps after the owner's commit
+
+1. **Once:** sync the reviewed Application in Argo CD, as for ops-mason-builder.
+2. **Once:** build the agent's kubeconfig. It holds the cluster's CA and a pointer to the token file, never a token.
+   No command prints a credential:
+
+   ```bash
+   A=~/.kube/config-agent-status
+   kubectl --kubeconfig ~/.kube/config-railiance01 config view --raw --minify \
+     -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ~/.kube/railiance01-ca.crt
+   kubectl --kubeconfig $A config set-cluster railiance01 --server https://127.0.0.1:16444 \
+     --certificate-authority ~/.kube/railiance01-ca.crt --embed-certs >/dev/null
+   kubectl --kubeconfig $A config set users.nk-agent-status.tokenFile "$HOME/.kube/nk-agent-status.token" >/dev/null
+   kubectl --kubeconfig $A config set-context nk-agent-status --cluster railiance01 --user nk-agent-status >/dev/null
+   kubectl --kubeconfig $A config use-context nk-agent-status >/dev/null && chmod 600 $A && echo agent-kubeconfig-ok
+   ```
+
+3. **Each working session:** `make agent-status-token` mints a 1 h token into `~/.kube/nk-agent-status.token`
+   (mode 600) and prints one line.
+
+The agent then verifies with `kubectl --kubeconfig ~/.kube/config-agent-status auth can-i --list` and the two
+negative checks: Secrets and pod logs in `sso` answer `no`.

docs/proposals/2026-11-06-nk58-t05-agent-status-grant/rbac.yaml

@@ -1,7 +1,7 @@
-# NK-WP-0058-T05 proposal: read-only status for the agent's own Kubernetes identity. PROPOSED, NOT APPLIED.
-# Owner of the change: railiance-cluster (cluster RBAC), reviewed with railiance-platform. Founder decision first.
+# NK-WP-0058-T05: read-only status for the agent's own Kubernetes identity. DECIDED (option A, State Hub 4af1ec01),
+# NOT APPLIED. Owner: railiance-platform, asked to adopt it as argocd/platform-addons/nk-agent-status/.
 #
-# Option A (recommended): status of the bounded-execution path, no pod logs. A dedicated ServiceAccount, not a
+# Option A: status of the bounded-execution path, no pod logs. A dedicated ServiceAccount, not a
 # wider ops-mason-builder: SI-14 wants the agent to present as itself, with tokens of at most 60 minutes.
 # Never: Secrets, pod logs, exec, port-forward, create, update, patch, delete, or anything cluster-wide.
 # Tests: tools/contract-tests/tests/test_agent_status_grant.py.

workplans/NK-WP-0058-bounded-execution-operability.md

@@ -435,9 +435,9 @@ priority: medium
 assignee: claude-code
 needs_human: true
 blocked_on: human
-blocking_reason: "Founder decision 4af1ec01 (agent status grant, options A-D) is open."
+blocking_reason: "Decided (A, 4af1ec01); waits for railiance-platform to adopt the grant as a platform add-on, then the founder's sync and token."
 decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984"
-intervention_note: "Founder chooses option A-D for the agent status grant (decision 4af1ec01); then railiance-cluster reviews the RBAC and the founder applies it."
+intervention_note: "railiance-platform adopts argocd/platform-addons/nk-agent-status/; founder syncs it, builds the agent kubeconfig once, mints 1 h tokens per session."
 depends_on: [NK-WP-0058-T10]
 state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
 ```
@@ -459,6 +459,18 @@ then goes into this task block (C-39).
 After the decision: railiance-cluster reviews the change, the founder applies it, and the agent verifies with
 `can-i`.
 
+**2026-11-06: decided, option A with 1 h tokens** (founder; `4af1ec01` resolved).
+
+- **Owner corrected to railiance-platform.** Agent-facing cluster grants live there as platform add-ons
+  (`argocd/platform-addons/ops-mason-builder/`, a manually synced, pinned Application). railiance-cluster has no
+  RBAC manifests. railiance-platform is asked to adopt the grant as `argocd/platform-addons/nk-agent-status/`.
+- **Founder steps** (proposal README):
+  - sync the Application once;
+  - build `~/.kube/config-agent-status` once. It holds the CA and a token-file pointer, never a token.
+  - `make agent-status-token` each working session.
+- **Then the agent verifies:** `auth can-i --list` shows only the grant, and Secrets and pod logs in `sso` answer
+  `no`.
+
 Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers:
 
 - the status and conditions of Jobs, pods, ExternalSecrets and Deployments;