NK-WP-0056-T10: executor lanes set up and verified (founder-run receipts)

rapp deploy (sso/nk-bind-executor uid bd15569c, role = ceiling), bindings
confirmed (railiance-platform b4bafb0), executor-lanes.py setup
lanes_prepared and verify lanes_verified. Left for T10: a journey-only,
read-only run mode and its unattended live run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

docs/evidence/2026-10-31-nk56-t10-executor-lanes/01-setup.json

@@ -0,0 +1,20 @@
+{
+  "action": "setup",
+  "cas_required": true,
+  "ccr_sha256": {
+    "journey": "3f7fd8e7e4c456813d3d067b05790fb42f4fd49f7dbdc7c07e49779eb87de038",
+    "write": "c84c2e539c08e06ad37bcf13cd536ce41b071ec259d6141901402a64c4ee3d27"
+  },
+  "coding_agents_denied": true,
+  "journey_role_created": true,
+  "phase": "done",
+  "policies_applied": true,
+  "source_ccrs": {
+    "journey": "CCR-2026-0059",
+    "write": "CCR-2026-0058"
+  },
+  "source_sha256": "9431b6da514cd8334a082119b715a38c1e1c1a63a513bc13bba12294e1ffab3f",
+  "status": "lanes_prepared",
+  "values_recorded": false,
+  "write_role_absent": true
+}

docs/evidence/2026-10-31-nk56-t10-executor-lanes/02-verify.json

@@ -0,0 +1,26 @@
+{
+  "action": "verify",
+  "cas_required": true,
+  "ccr_sha256": {
+    "journey": "3f7fd8e7e4c456813d3d067b05790fb42f4fd49f7dbdc7c07e49779eb87de038",
+    "write": "c84c2e539c08e06ad37bcf13cd536ce41b071ec259d6141901402a64c4ee3d27"
+  },
+  "coding_agents_denied": true,
+  "exact_policies_and_role": true,
+  "journey_kv_version": 1,
+  "journey_lease_at_most_15m": true,
+  "journey_reads_only_its_path": true,
+  "phase": "done",
+  "source_ccrs": {
+    "journey": "CCR-2026-0059",
+    "write": "CCR-2026-0058"
+  },
+  "source_sha256": "9431b6da514cd8334a082119b715a38c1e1c1a63a513bc13bba12294e1ffab3f",
+  "status": "lanes_verified",
+  "temporary_token_revoked": true,
+  "values_recorded": false,
+  "write_login_denied": true,
+  "write_role_absent": true,
+  "wrong_audience_denied": true,
+  "wrong_service_account_denied": true
+}

docs/evidence/2026-10-31-nk56-t10-executor-lanes/README.md

@@ -0,0 +1,30 @@
+# NK-WP-0056-T10: executor OpenBao lanes, attended setup and proof (2026-10-31)
+
+Founder-run, claude-code guiding. Runbook: `sso-mfa/k8s/bounded-executor/T10-LANES-RUNBOOK.md`. Tool:
+`tools/service-binds/executor-lanes.py`; the second run used source sha256 `9431b6da…`. Receipts hold no values.
+
+1. **rapp-bounded-executor `make deploy`.** It created ServiceAccount `sso/nk-bind-executor` (uid `bd15569c-8a85-4625-b001-d9f799cb857b`),
+   the Role, the RoleBinding and NetworkPolicy `bounded-executor`. `make verify-live` reported
+   `role_matches_ceiling: true`. No Job was created.
+2. **Bindings confirmed.** CCR-2026-0058 and CCR-2026-0059 were marked `binding_confirmed` (railiance-platform
+   `b4bafb0`). The receipts are bound to those files: write `c84c2e53…`, journey `3f7fd8e7…`.
+3. **`00-setup-attempt-patch-denied.json`.** The first setup stopped at `cas_required`. platform-admin holds
+   `update` but not `patch` on `platform/*`. Both policies had been applied; nothing after that.
+   The tool was fixed in `12c9b2d`: a metadata write that names only `cas_required`, guarded by a before/after
+   comparison.
+4. **`01-setup.json`, `lanes_prepared`:**
+   - both policies applied;
+   - `cas_required` set on the svc-authelia key;
+   - the standing journey-read role created;
+   - the write role absent;
+   - the coding-agent fence beats both policies.
+5. **`02-verify.json`, `lanes_verified`:**
+   - exact policies and role;
+   - `sso/nk-bind-executor`, audience `openbao`, logs in to the journey role with a lease of at most 15m and reads
+     only the syn-journey path. The entry is at version 1, with field names checked in memory.
+   - Denied: metadata, every directory bind and token creation.
+   - Denied: the `default` ServiceAccount, a wrong audience, and a login to the write role.
+   - The temporary token was revoked.
+
+The write role (CCR-2026-0058) is created only per admitted window. The journey run through this role is still the
+open part of T10.

workplans/NK-WP-0056-bounded-executor-path.md

@@ -444,11 +444,31 @@ Done since:
   - It is pinned in the rapp (`c107afc`, pushed).
 - CCR-2026-0059 was approved by the founder as platform-owner and net-kingdom-owner (railiance-platform `831a0f9`).
 
-Left:
+**2026-10-31, lanes live** ([evidence](../docs/evidence/2026-10-31-nk56-t10-executor-lanes/README.md)), founder-run
+with `T10-LANES-RUNBOOK.md`:
 
-- `make deploy` of the standing objects, then `confirm-binding` on CCR-2026-0058 and CCR-2026-0059;
-- applying the policy and roles (platform-admin);
-- the approval-engine and audit-core replies and the token Secret.
+- The rapp's standing objects are deployed. `sso/nk-bind-executor` has uid `bd15569c…`, and the Role matches the
+  ceiling.
+- The bindings of CCR-2026-0058 and CCR-2026-0059 are confirmed (railiance-platform `b4bafb0`).
+- `executor-lanes.py setup`:
+  - both policies applied;
+  - `cas_required` set;
+  - the standing journey-read role created;
+  - the write role absent;
+  - the agent fence holds.
+- The first setup stopped because platform-admin has no `patch` on `platform/*`. It now uses a metadata write that
+  names only `cas_required`, with a before/after guard (`12c9b2d`).
+- `verify`: the journey token reads only its path, with a lease of at most 15m. A wrong ServiceAccount, a wrong
+  audience and a login to the write role are all denied.
+
+Left for T10:
+
+- An executor run mode for the journey alone. It is a read-only Job with no admission: journey role only, no write
+  role, no Kubernetes mutation, and a value-free receipt. The CLI today runs only admissions.
+- Its unattended live run.
+- The fail-closed proof against a broken bind on the T08 synthetic directory.
+
+For T06, separately: the approval-engine and audit-core replies, and the token Secret.
 
 ## Executor runtime: core runner