coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T05: decided (A, 1 h tokens, 4af1ec01); owner is railiance-platform; founder steps and make agent-status-token
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 01:07:26 +01:00
parent 1b0f129d23
commit e58d1c22fd
4 changed files with 52 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/NK-WP-0058-bounded-execution-operability.md
View file

@ -435,9 +435,9 @@ priority: medium
assignee: claude-code
needs_human: true
blocked_on: human
blocking_reason: "Founder decision 4af1ec01 (agent status grant, options A-D) is open."
blocking_reason: "Decided (A, 4af1ec01); waits for railiance-platform to adopt the grant as a platform add-on, then the founder's sync and token."
decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984"
intervention_note: "Founder chooses option A-D for the agent status grant (decision 4af1ec01); then railiance-cluster reviews the RBAC and the founder applies it."
intervention_note: "railiance-platform adopts argocd/platform-addons/nk-agent-status/; founder syncs it, builds the agent kubeconfig once, mints 1 h tokens per session."
depends_on: [NK-WP-0058-T10]
state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
```
@ -459,6 +459,18 @@ then goes into this task block (C-39).
After the decision: railiance-cluster reviews the change, the founder applies it, and the agent verifies with
`can-i`.
**2026-11-06: decided, option A with 1 h tokens** (founder; `4af1ec01` resolved).
- **Owner corrected to railiance-platform.** Agent-facing cluster grants live there as platform add-ons
(`argocd/platform-addons/ops-mason-builder/`, a manually synced, pinned Application). railiance-cluster has no
RBAC manifests. railiance-platform is asked to adopt the grant as `argocd/platform-addons/nk-agent-status/`.
- **Founder steps** (proposal README):
- sync the Application once;
- build `~/.kube/config-agent-status` once. It holds the CA and a token-file pointer, never a token.
- `make agent-status-token` each working session.
- **Then the agent verifies:** `auth can-i --list` shows only the grant, and Secrets and pod logs in `sso` answer
`no`.
Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers:
- the status and conditions of Jobs, pods, ExternalSecrets and Deployments;