NK-WP-0058-T05: decided (A, 1 h tokens, 4af1ec01); owner is railiance-platform; founder steps and make agent-status-token

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

docs/proposals/2026-11-06-nk58-t05-agent-status-grant/README.md

@@ -1,6 +1,7 @@
 # NK-WP-0058-T05: read-only status for the agent identity (proposal, 2026-11-06)
 
-**Status: proposed, for founder decision.** Nothing is applied.
+**Status: decided 2026-11-06, option A with 1 h tokens** (State Hub `4af1ec01`). Not yet applied: it waits for the
+owner's review.
 
 ## Why
 
@@ -53,17 +54,36 @@ literal secret values (only file paths, references and URLs). `tools/contract-te
 keeps it that way and keeps the grant read-only and narrow.
 
 **Tokens:** at most 1 hour (SI-14), minted by the founder once per working session. This is read-only, so it isn't a
-warden lane:
-
-```bash
-kubectl --kubeconfig ~/.kube/config-railiance01 -n sso create token nk-agent-status --duration=1h \
-  > ~/.kube/nk-agent-status.token && chmod 600 ~/.kube/nk-agent-status.token
-```
+warden lane: `make agent-status-token` (founder steps below).
 
 The agent's kubeconfig `~/.kube/config-agent-status` names the cluster and `tokenFile: ~/.kube/nk-agent-status.token`.
 It holds no token itself. A longer token is a deviation from SI-14 and would need its own decision.
 
-**Who applies it:** railiance-cluster owns cluster RBAC, so after the decision the change goes there as a reviewed
-change. The founder applies it, server-side. Verification:
-- `kubectl auth can-i --list` as `nk-agent-status` shows only these rules;
-- `can-i get secrets -n sso` and `can-i get pods --subresource=log -n sso` both answer `no`.
+**Owner:** railiance-platform. Agent-facing cluster grants live there as platform add-ons, the precedent being
+`argocd/platform-addons/ops-mason-builder/`, applied by a manually synced, pinned Argo Application. The proposal first
+named railiance-cluster, which has no RBAC manifests. railiance-platform is asked to adopt `rbac.yaml` the same way,
+as `argocd/platform-addons/nk-agent-status/`. Unlike ops-mason-builder's certificate User, this identity is a
+ServiceAccount with 1 h tokens (SI-14).
+
+## Founder steps after the owner's commit
+
+1. **Once:** sync the reviewed Application in Argo CD, as for ops-mason-builder.
+2. **Once:** build the agent's kubeconfig. It holds the cluster's CA and a pointer to the token file, never a token.
+   No command prints a credential:
+
+   ```bash
+   A=~/.kube/config-agent-status
+   kubectl --kubeconfig ~/.kube/config-railiance01 config view --raw --minify \
+     -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ~/.kube/railiance01-ca.crt
+   kubectl --kubeconfig $A config set-cluster railiance01 --server https://127.0.0.1:16444 \
+     --certificate-authority ~/.kube/railiance01-ca.crt --embed-certs >/dev/null
+   kubectl --kubeconfig $A config set users.nk-agent-status.tokenFile "$HOME/.kube/nk-agent-status.token" >/dev/null
+   kubectl --kubeconfig $A config set-context nk-agent-status --cluster railiance01 --user nk-agent-status >/dev/null
+   kubectl --kubeconfig $A config use-context nk-agent-status >/dev/null && chmod 600 $A && echo agent-kubeconfig-ok
+   ```
+
+3. **Each working session:** `make agent-status-token` mints a 1 h token into `~/.kube/nk-agent-status.token`
+   (mode 600) and prints one line.
+
+The agent then verifies with `kubectl --kubeconfig ~/.kube/config-agent-status auth can-i --list` and the two
+negative checks: Secrets and pod logs in `sso` answer `no`.

docs/proposals/2026-11-06-nk58-t05-agent-status-grant/rbac.yaml

@@ -1,7 +1,7 @@
-# NK-WP-0058-T05 proposal: read-only status for the agent's own Kubernetes identity. PROPOSED, NOT APPLIED.
-# Owner of the change: railiance-cluster (cluster RBAC), reviewed with railiance-platform. Founder decision first.
+# NK-WP-0058-T05: read-only status for the agent's own Kubernetes identity. DECIDED (option A, State Hub 4af1ec01),
+# NOT APPLIED. Owner: railiance-platform, asked to adopt it as argocd/platform-addons/nk-agent-status/.
 #
-# Option A (recommended): status of the bounded-execution path, no pod logs. A dedicated ServiceAccount, not a
+# Option A: status of the bounded-execution path, no pod logs. A dedicated ServiceAccount, not a
 # wider ops-mason-builder: SI-14 wants the agent to present as itself, with tokens of at most 60 minutes.
 # Never: Secrets, pod logs, exec, port-forward, create, update, patch, delete, or anything cluster-wide.
 # Tests: tools/contract-tests/tests/test_agent_status_grant.py.