From ebec183d1bead2ae0c53b236c6cf39813d4ba0e7 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 5 Nov 2026 13:01:40 +0100 Subject: [PATCH] NK-WP-0058 ready: split inventory (T01/T09/T10), urgent overnight-window check (T11), owner agreement for CI contracts, executor owners named; NK-WP-0057-T01 reuses the table Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0 --- WORK-RECORDS.md | 5 +- ...0057-decision-routing-by-responsibility.md | 3 + ...K-WP-0058-bounded-execution-operability.md | 140 ++++++++++++++---- 3 files changed, 121 insertions(+), 27 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index fdb691d..1889dca 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -55,7 +55,7 @@ | workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | workplan | NK-WP-0056 | finished | — | workplans/NK-WP-0056-bounded-executor-path.md | | workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | -| workplan | NK-WP-0058 | proposed | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| workplan | NK-WP-0058 | ready | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -378,6 +378,9 @@ | task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T07 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | | task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| task | NK-WP-0058-T09 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| task | NK-WP-0058-T10 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | +| task | NK-WP-0058-T11 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/workplans/NK-WP-0057-decision-routing-by-responsibility.md b/workplans/NK-WP-0057-decision-routing-by-responsibility.md index eba91df..ca812d6 100644 --- a/workplans/NK-WP-0057-decision-routing-by-responsibility.md +++ b/workplans/NK-WP-0057-decision-routing-by-responsibility.md @@ -86,6 +86,9 @@ Cover at least: - informed-decision's own intake; - gate-house doctrine. +For the bounded-execution path, start from the NK-WP-0058 contract table (NK-WP-0058-T01, T09, T10) instead of +inventorying it again. Its rows marked "needs an owner decision" are inputs here. + **Done when:** an inventory table with sources, and the list of routing points in use today (file, owner, what it decides), is in `docs/proposals/`. diff --git a/workplans/NK-WP-0058-bounded-execution-operability.md b/workplans/NK-WP-0058-bounded-execution-operability.md index ef3026f..609a970 100644 --- a/workplans/NK-WP-0058-bounded-execution-operability.md +++ b/workplans/NK-WP-0058-bounded-execution-operability.md @@ -4,7 +4,7 @@ type: workplan title: "Bounded execution operability: clear boundaries, lean interfaces, transparent diagnostics" domain: infotech repo: net-kingdom -status: proposed +status: ready flavor: implementation owner: claude topic_slug: netkingdom @@ -53,9 +53,47 @@ Founder direction, 2026-11-05. A task is not done unless its result meets all fo - Contract tests replace manual rehearsal wherever they can. - Tests run in CI; a change to the code an interface depends on, in either repo, fails a test. +## Review, 2026-11-05 + +Reviewed against the repository state on 2026-11-05 and set to `ready`. Changes from the proposal: + +- The overnight write-role check was split out of T06 into T11 and made urgent: it depends on OpenBao audit + retention. +- The inventory (T01) was split into three parts: T01, T09 and T10. They fill one table, which is also the input to + NK-WP-0057-T01, so that no second inventory is started. +- T02 now starts with an owner agreement on how a contract change reaches net-kingdom CI. +- T03 names the owners of the executor mode: net-kingdom owns the source and the image, and `rapp-bounded-executor` + packages and deploys it (NK-WP-0056, founder decision `6d1adce9`). +- T05's decision is created after T01, once the list of statuses the agent could not read is known. +- T07 no longer waits for the inventory. + +Suggested order: T11 first, then T01, T09 and T10, then T03. T02 and T04 come before the next live window. T05, T06 +and T07 can run in parallel with these, and T08 comes last. + ## Tasks -### Interface and responsibility inventory +### Confirm the overnight write-role window left no trace + +```task +id: NK-WP-0058-T11 +status: todo +priority: high +assignee: claude-code +``` + +This is the open check from 2026-11-05. It must not wait for the rest of the workplan, because the evidence it needs +ages out with OpenBao audit retention. + +- Confirm that CCR-2026-0058's write role is absent now. +- Confirm from OpenBao's audit that no login used the role while it was open overnight on 2026-11-04/05. + +The agent prepares read-only, value-free queries for both checks. Where the agent identity lacks audit access, the +founder runs them and reports one result line for each. + +**Done when:** a dated, value-free receipt records both results under the NK-WP-0056 pilot evidence. Any login that +was found is routed as a security finding to railiance-platform. + +### Interface and responsibility inventory, part 1: executor and its services ```task id: NK-WP-0058-T01 @@ -65,7 +103,7 @@ assignee: claude-code state_hub_task_id: "fe618717-0c28-51c5-8edb-e5d2f4ba2252" ``` -List every interface the bounded-execution path crosses. For each, record: +Create the single contract table in `docs/`. Each row is one interface the bounded-execution path crosses and records: - **owner and source of truth;** - **consumer;** @@ -73,22 +111,56 @@ List every interface the bounded-execution path crosses. For each, record: - **how it is tested today** (none, stub, real source, live only); - **the 2026-11-04/05 failures it caused.** -Cover at least these pairs: +Part 1 covers the executor's own interfaces: - executor ↔ approval-engine, KeyCape, audit-core, informed-decision, OpenBao and LLDAP; -- rapp ↔ net-kingdom; +- rapp (`rapp-bounded-executor`) ↔ net-kingdom: image, pins, Job template and RBAC. + +Mark duplicated or unowned pieces, for example the approver configured in three places. A row whose owner is +unclear is marked "needs an owner decision" and becomes an input to NK-WP-0057-T01, which does not inventory it a +second time. + +**Done when:** the table exists with sources for every part 1 row, and each row is marked keep, merge, delete or +needs an owner decision. + +### Interface and responsibility inventory, part 2: approval, case and custody chain + +```task +id: NK-WP-0058-T09 +status: todo +priority: high +assignee: claude-code +depends_on: [NK-WP-0058-T01] +``` + +Add rows to the T01 table, in the same format, for: + - railiance-platform CCRs and broker ↔ net-kingdom cases; - audit-core seed ↔ railiance-platform custody; -- informed-decision routing ↔ access-engine policy; -- Argo ↔ manual applies; -- warden lanes ↔ child scripts; -- founder ↔ each runbook. +- informed-decision routing ↔ access-engine policy. -Mark duplicated or unowned pieces, for example the two seeders, the two Secret names, and the approver in three -places. +Mark the duplicated pieces, for example the two seeders and the two Secret names. -**Done when:** a single contract table is in `docs/` with sources, and each row is marked keep, merge, delete or -needs an owner decision. +**Done when:** every part 2 row has sources and a keep, merge, delete or owner-decision mark. + +### Interface and responsibility inventory, part 3: operations and the founder + +```task +id: NK-WP-0058-T10 +status: todo +priority: high +assignee: claude-code +depends_on: [NK-WP-0058-T01] +``` + +Add rows to the T01 table, in the same format, for: + +- Argo ↔ manual applies, including which controller manages each object the runbooks write; +- warden lanes ↔ child scripts, including the environment they pass on; +- founder ↔ each runbook step, with the authority each step needs and the value-free result it prints. + +**Done when:** every part 3 row has sources and a mark, and the table lists every status the agent had to ask the +founder for on 2026-11-04/05 (the input for T05). ### Contract tests for the cross-repo interfaces @@ -97,11 +169,19 @@ id: NK-WP-0058-T02 status: todo priority: high assignee: claude-code -depends_on: [NK-WP-0058-T01] +depends_on: [NK-WP-0058-T01, NK-WP-0058-T09, NK-WP-0058-T10] state_hub_task_id: "a33eeee6-caef-57d4-b067-26231a19a165" ``` -For every interface marked keep or merge, add an automated contract test in CI: +First, agree with each owner how a change to their contract reaches net-kingdom CI. Two ways are possible: + +- the owner publishes a versioned contract file that net-kingdom pins; +- net-kingdom CI tests against a pinned checkout of the owner's source and is told about new versions. + +Record the agreement in the owner's workplan. Where no agreement is reached, the test runs against the pinned +version, and the table records that drift is caught only when the pin moves. + +Then, for every interface marked keep or merge, add an automated contract test in CI: - against the owner's real source where it runs locally (approval-engine, audit-core, informed-decision intake, the KeyCape image); @@ -111,8 +191,9 @@ Fold the existing exercises (T19 approval identity, T15 audit sender) into this separate scripts. A change in either repo that breaks a contract fails CI in the consumer, such as a Secret name, a role name, a response code or a memo field. -**Done when:** the suite runs in CI for every interface in the table; each interface that failed on 2026-11-04/05 -has a test that would have caught it; and the code that duplicated a contract by hand is removed. +**Done when:** the suite runs in CI for every interface in the table, and each interface that failed on 2026-11-04/05 +has a test that would have caught it. Code in net-kingdom that duplicated a contract by hand is removed. For +duplicates in other repos, a removal request is sent to their owners and recorded. ### Readiness check before any window opens @@ -121,10 +202,14 @@ id: NK-WP-0058-T03 status: todo priority: high assignee: claude-code -depends_on: [NK-WP-0058-T01] +depends_on: [NK-WP-0058-T01, NK-WP-0058-T09] state_hub_task_id: "0e403b18-cf7b-5899-bd86-661fc7284014" ``` +Owners: net-kingdom owns the executor source, its tests and its image, so the `--preflight-only` mode is written +here. `rapp-bounded-executor` owns the Job packaging, so running the mode as a Job is a change to the rapp. The +readiness checks call the owners' validators and do not copy them. + One command that verifies the chain while nothing is at stake, so a window opens only when everything is green: - the admission is valid and its pins match the pinned image; @@ -177,10 +262,13 @@ priority: medium assignee: claude-code needs_human: true intervention_note: "Founder approves a read-only status grant for the agent identity (owner: railiance-cluster / railiance-platform)." -depends_on: [NK-WP-0058-T01] +depends_on: [NK-WP-0058-T10] state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59" ``` +The State Hub decision for this gate is created once T10 has listed the statuses the agent could not read. Its id +then goes into this task block (C-39). + Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers: - the status and conditions of Jobs, pods, ExternalSecrets and Deployments; @@ -199,7 +287,7 @@ id: NK-WP-0058-T06 status: todo priority: medium assignee: claude-code -depends_on: [NK-WP-0058-T01] +depends_on: [NK-WP-0058-T09] state_hub_task_id: "6a4c7413-0675-5a06-b471-5f849ce0c721" ``` @@ -210,11 +298,9 @@ railiance-platform (the owner): - an alert or finding whenever the write role exists outside an open admission window. The latter could reuse audit-core's stream findings or posture feedback. -Also settle the open check from 2026-11-05: OpenBao's audit should confirm that no login used the role during the -overnight window. +The open check from 2026-11-05 on the overnight window is T11. -**Done when:** an unclosed window is closed or flagged without human memory, tested on a stub, and the 2026-11-05 -check is recorded. +**Done when:** an unclosed window is closed or flagged without human memory, and this is tested on a stub. ### Runbook and tooling conventions @@ -223,10 +309,12 @@ id: NK-WP-0058-T07 status: todo priority: medium assignee: claude-code -depends_on: [NK-WP-0058-T01] state_hub_task_id: "a99424ed-ee8b-5db4-9fa7-2ae5fc32c39c" ``` +This task does not wait for the inventory, because the conventions below are already known. Findings from T10 are +added when they arrive. + Turn the 2026-11-04/05 surprises into checked conventions: - server-side apply only; @@ -248,7 +336,7 @@ id: NK-WP-0058-T08 status: todo priority: low assignee: claude-code -depends_on: [NK-WP-0058-T01] +depends_on: [NK-WP-0058-T02] state_hub_task_id: "dd2b72c8-7225-5b89-8936-d44c99f95872" ```