NK-WP-0058 ready: split inventory (T01/T09/T10), urgent overnight-window check (T11), owner agreement for CI contracts, executor owners named; NK-WP-0057-T01 reuses the table
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
parent
9474fd31c8
commit
ebec183d1b
3 changed files with 121 additions and 27 deletions
|
|
@ -55,7 +55,7 @@
|
|||
| workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
|
||||
| workplan | NK-WP-0056 | finished | — | workplans/NK-WP-0056-bounded-executor-path.md |
|
||||
| workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
|
||||
| workplan | NK-WP-0058 | proposed | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| workplan | NK-WP-0058 | ready | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
|
||||
| task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
|
||||
|
|
@ -378,6 +378,9 @@
|
|||
| task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| task | NK-WP-0058-T07 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| task | NK-WP-0058-T09 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| task | NK-WP-0058-T10 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| task | NK-WP-0058-T11 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
|
||||
|
|
|
|||
|
|
@ -86,6 +86,9 @@ Cover at least:
|
|||
- informed-decision's own intake;
|
||||
- gate-house doctrine.
|
||||
|
||||
For the bounded-execution path, start from the NK-WP-0058 contract table (NK-WP-0058-T01, T09, T10) instead of
|
||||
inventorying it again. Its rows marked "needs an owner decision" are inputs here.
|
||||
|
||||
**Done when:** an inventory table with sources, and the list of routing points in use today (file, owner, what it
|
||||
decides), is in `docs/proposals/`.
|
||||
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Bounded execution operability: clear boundaries, lean interfaces, transparent diagnostics"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: proposed
|
||||
status: ready
|
||||
flavor: implementation
|
||||
owner: claude
|
||||
topic_slug: netkingdom
|
||||
|
|
@ -53,9 +53,47 @@ Founder direction, 2026-11-05. A task is not done unless its result meets all fo
|
|||
- Contract tests replace manual rehearsal wherever they can.
|
||||
- Tests run in CI; a change to the code an interface depends on, in either repo, fails a test.
|
||||
|
||||
## Review, 2026-11-05
|
||||
|
||||
Reviewed against the repository state on 2026-11-05 and set to `ready`. Changes from the proposal:
|
||||
|
||||
- The overnight write-role check was split out of T06 into T11 and made urgent: it depends on OpenBao audit
|
||||
retention.
|
||||
- The inventory (T01) was split into three parts: T01, T09 and T10. They fill one table, which is also the input to
|
||||
NK-WP-0057-T01, so that no second inventory is started.
|
||||
- T02 now starts with an owner agreement on how a contract change reaches net-kingdom CI.
|
||||
- T03 names the owners of the executor mode: net-kingdom owns the source and the image, and `rapp-bounded-executor`
|
||||
packages and deploys it (NK-WP-0056, founder decision `6d1adce9`).
|
||||
- T05's decision is created after T01, once the list of statuses the agent could not read is known.
|
||||
- T07 no longer waits for the inventory.
|
||||
|
||||
Suggested order: T11 first, then T01, T09 and T10, then T03. T02 and T04 come before the next live window. T05, T06
|
||||
and T07 can run in parallel with these, and T08 comes last.
|
||||
|
||||
## Tasks
|
||||
|
||||
### Interface and responsibility inventory
|
||||
### Confirm the overnight write-role window left no trace
|
||||
|
||||
```task
|
||||
id: NK-WP-0058-T11
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: claude-code
|
||||
```
|
||||
|
||||
This is the open check from 2026-11-05. It must not wait for the rest of the workplan, because the evidence it needs
|
||||
ages out with OpenBao audit retention.
|
||||
|
||||
- Confirm that CCR-2026-0058's write role is absent now.
|
||||
- Confirm from OpenBao's audit that no login used the role while it was open overnight on 2026-11-04/05.
|
||||
|
||||
The agent prepares read-only, value-free queries for both checks. Where the agent identity lacks audit access, the
|
||||
founder runs them and reports one result line for each.
|
||||
|
||||
**Done when:** a dated, value-free receipt records both results under the NK-WP-0056 pilot evidence. Any login that
|
||||
was found is routed as a security finding to railiance-platform.
|
||||
|
||||
### Interface and responsibility inventory, part 1: executor and its services
|
||||
|
||||
```task
|
||||
id: NK-WP-0058-T01
|
||||
|
|
@ -65,7 +103,7 @@ assignee: claude-code
|
|||
state_hub_task_id: "fe618717-0c28-51c5-8edb-e5d2f4ba2252"
|
||||
```
|
||||
|
||||
List every interface the bounded-execution path crosses. For each, record:
|
||||
Create the single contract table in `docs/`. Each row is one interface the bounded-execution path crosses and records:
|
||||
|
||||
- **owner and source of truth;**
|
||||
- **consumer;**
|
||||
|
|
@ -73,22 +111,56 @@ List every interface the bounded-execution path crosses. For each, record:
|
|||
- **how it is tested today** (none, stub, real source, live only);
|
||||
- **the 2026-11-04/05 failures it caused.**
|
||||
|
||||
Cover at least these pairs:
|
||||
Part 1 covers the executor's own interfaces:
|
||||
|
||||
- executor ↔ approval-engine, KeyCape, audit-core, informed-decision, OpenBao and LLDAP;
|
||||
- rapp ↔ net-kingdom;
|
||||
- rapp (`rapp-bounded-executor`) ↔ net-kingdom: image, pins, Job template and RBAC.
|
||||
|
||||
Mark duplicated or unowned pieces, for example the approver configured in three places. A row whose owner is
|
||||
unclear is marked "needs an owner decision" and becomes an input to NK-WP-0057-T01, which does not inventory it a
|
||||
second time.
|
||||
|
||||
**Done when:** the table exists with sources for every part 1 row, and each row is marked keep, merge, delete or
|
||||
needs an owner decision.
|
||||
|
||||
### Interface and responsibility inventory, part 2: approval, case and custody chain
|
||||
|
||||
```task
|
||||
id: NK-WP-0058-T09
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
```
|
||||
|
||||
Add rows to the T01 table, in the same format, for:
|
||||
|
||||
- railiance-platform CCRs and broker ↔ net-kingdom cases;
|
||||
- audit-core seed ↔ railiance-platform custody;
|
||||
- informed-decision routing ↔ access-engine policy;
|
||||
- Argo ↔ manual applies;
|
||||
- warden lanes ↔ child scripts;
|
||||
- founder ↔ each runbook.
|
||||
- informed-decision routing ↔ access-engine policy.
|
||||
|
||||
Mark duplicated or unowned pieces, for example the two seeders, the two Secret names, and the approver in three
|
||||
places.
|
||||
Mark the duplicated pieces, for example the two seeders and the two Secret names.
|
||||
|
||||
**Done when:** a single contract table is in `docs/` with sources, and each row is marked keep, merge, delete or
|
||||
needs an owner decision.
|
||||
**Done when:** every part 2 row has sources and a keep, merge, delete or owner-decision mark.
|
||||
|
||||
### Interface and responsibility inventory, part 3: operations and the founder
|
||||
|
||||
```task
|
||||
id: NK-WP-0058-T10
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
```
|
||||
|
||||
Add rows to the T01 table, in the same format, for:
|
||||
|
||||
- Argo ↔ manual applies, including which controller manages each object the runbooks write;
|
||||
- warden lanes ↔ child scripts, including the environment they pass on;
|
||||
- founder ↔ each runbook step, with the authority each step needs and the value-free result it prints.
|
||||
|
||||
**Done when:** every part 3 row has sources and a mark, and the table lists every status the agent had to ask the
|
||||
founder for on 2026-11-04/05 (the input for T05).
|
||||
|
||||
### Contract tests for the cross-repo interfaces
|
||||
|
||||
|
|
@ -97,11 +169,19 @@ id: NK-WP-0058-T02
|
|||
status: todo
|
||||
priority: high
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
depends_on: [NK-WP-0058-T01, NK-WP-0058-T09, NK-WP-0058-T10]
|
||||
state_hub_task_id: "a33eeee6-caef-57d4-b067-26231a19a165"
|
||||
```
|
||||
|
||||
For every interface marked keep or merge, add an automated contract test in CI:
|
||||
First, agree with each owner how a change to their contract reaches net-kingdom CI. Two ways are possible:
|
||||
|
||||
- the owner publishes a versioned contract file that net-kingdom pins;
|
||||
- net-kingdom CI tests against a pinned checkout of the owner's source and is told about new versions.
|
||||
|
||||
Record the agreement in the owner's workplan. Where no agreement is reached, the test runs against the pinned
|
||||
version, and the table records that drift is caught only when the pin moves.
|
||||
|
||||
Then, for every interface marked keep or merge, add an automated contract test in CI:
|
||||
|
||||
- against the owner's real source where it runs locally (approval-engine, audit-core, informed-decision intake,
|
||||
the KeyCape image);
|
||||
|
|
@ -111,8 +191,9 @@ Fold the existing exercises (T19 approval identity, T15 audit sender) into this
|
|||
separate scripts. A change in either repo that breaks a contract fails CI in the consumer, such as a Secret name, a
|
||||
role name, a response code or a memo field.
|
||||
|
||||
**Done when:** the suite runs in CI for every interface in the table; each interface that failed on 2026-11-04/05
|
||||
has a test that would have caught it; and the code that duplicated a contract by hand is removed.
|
||||
**Done when:** the suite runs in CI for every interface in the table, and each interface that failed on 2026-11-04/05
|
||||
has a test that would have caught it. Code in net-kingdom that duplicated a contract by hand is removed. For
|
||||
duplicates in other repos, a removal request is sent to their owners and recorded.
|
||||
|
||||
### Readiness check before any window opens
|
||||
|
||||
|
|
@ -121,10 +202,14 @@ id: NK-WP-0058-T03
|
|||
status: todo
|
||||
priority: high
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
depends_on: [NK-WP-0058-T01, NK-WP-0058-T09]
|
||||
state_hub_task_id: "0e403b18-cf7b-5899-bd86-661fc7284014"
|
||||
```
|
||||
|
||||
Owners: net-kingdom owns the executor source, its tests and its image, so the `--preflight-only` mode is written
|
||||
here. `rapp-bounded-executor` owns the Job packaging, so running the mode as a Job is a change to the rapp. The
|
||||
readiness checks call the owners' validators and do not copy them.
|
||||
|
||||
One command that verifies the chain while nothing is at stake, so a window opens only when everything is green:
|
||||
|
||||
- the admission is valid and its pins match the pinned image;
|
||||
|
|
@ -177,10 +262,13 @@ priority: medium
|
|||
assignee: claude-code
|
||||
needs_human: true
|
||||
intervention_note: "Founder approves a read-only status grant for the agent identity (owner: railiance-cluster / railiance-platform)."
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
depends_on: [NK-WP-0058-T10]
|
||||
state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
|
||||
```
|
||||
|
||||
The State Hub decision for this gate is created once T10 has listed the statuses the agent could not read. Its id
|
||||
then goes into this task block (C-39).
|
||||
|
||||
Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers:
|
||||
|
||||
- the status and conditions of Jobs, pods, ExternalSecrets and Deployments;
|
||||
|
|
@ -199,7 +287,7 @@ id: NK-WP-0058-T06
|
|||
status: todo
|
||||
priority: medium
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
depends_on: [NK-WP-0058-T09]
|
||||
state_hub_task_id: "6a4c7413-0675-5a06-b471-5f849ce0c721"
|
||||
```
|
||||
|
||||
|
|
@ -210,11 +298,9 @@ railiance-platform (the owner):
|
|||
- an alert or finding whenever the write role exists outside an open admission window. The latter could reuse
|
||||
audit-core's stream findings or posture feedback.
|
||||
|
||||
Also settle the open check from 2026-11-05: OpenBao's audit should confirm that no login used the role during the
|
||||
overnight window.
|
||||
The open check from 2026-11-05 on the overnight window is T11.
|
||||
|
||||
**Done when:** an unclosed window is closed or flagged without human memory, tested on a stub, and the 2026-11-05
|
||||
check is recorded.
|
||||
**Done when:** an unclosed window is closed or flagged without human memory, and this is tested on a stub.
|
||||
|
||||
### Runbook and tooling conventions
|
||||
|
||||
|
|
@ -223,10 +309,12 @@ id: NK-WP-0058-T07
|
|||
status: todo
|
||||
priority: medium
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
state_hub_task_id: "a99424ed-ee8b-5db4-9fa7-2ae5fc32c39c"
|
||||
```
|
||||
|
||||
This task does not wait for the inventory, because the conventions below are already known. Findings from T10 are
|
||||
added when they arrive.
|
||||
|
||||
Turn the 2026-11-04/05 surprises into checked conventions:
|
||||
|
||||
- server-side apply only;
|
||||
|
|
@ -248,7 +336,7 @@ id: NK-WP-0058-T08
|
|||
status: todo
|
||||
priority: low
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0058-T01]
|
||||
depends_on: [NK-WP-0058-T02]
|
||||
state_hub_task_id: "dd2b72c8-7225-5b89-8936-d44c99f95872"
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue