From ef6284c371e4a24d8728aaa34a62b4c9c5446e56 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 19:47:29 +0100 Subject: [PATCH] NK-WP-0056-T10: executor lanes set up and verified (founder-run receipts) rapp deploy (sso/nk-bind-executor uid bd15569c, role = ceiling), bindings confirmed (railiance-platform b4bafb0), executor-lanes.py setup lanes_prepared and verify lanes_verified. Left for T10: a journey-only, read-only run mode and its unattended live run. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- .../01-setup.json | 20 +++++++++++++ .../02-verify.json | 26 ++++++++++++++++ .../README.md | 30 +++++++++++++++++++ workplans/NK-WP-0056-bounded-executor-path.md | 28 ++++++++++++++--- 4 files changed, 100 insertions(+), 4 deletions(-) create mode 100644 docs/evidence/2026-10-31-nk56-t10-executor-lanes/01-setup.json create mode 100644 docs/evidence/2026-10-31-nk56-t10-executor-lanes/02-verify.json create mode 100644 docs/evidence/2026-10-31-nk56-t10-executor-lanes/README.md diff --git a/docs/evidence/2026-10-31-nk56-t10-executor-lanes/01-setup.json b/docs/evidence/2026-10-31-nk56-t10-executor-lanes/01-setup.json new file mode 100644 index 0000000..e761e54 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-t10-executor-lanes/01-setup.json @@ -0,0 +1,20 @@ +{ + "action": "setup", + "cas_required": true, + "ccr_sha256": { + "journey": "3f7fd8e7e4c456813d3d067b05790fb42f4fd49f7dbdc7c07e49779eb87de038", + "write": "c84c2e539c08e06ad37bcf13cd536ce41b071ec259d6141901402a64c4ee3d27" + }, + "coding_agents_denied": true, + "journey_role_created": true, + "phase": "done", + "policies_applied": true, + "source_ccrs": { + "journey": "CCR-2026-0059", + "write": "CCR-2026-0058" + }, + "source_sha256": "9431b6da514cd8334a082119b715a38c1e1c1a63a513bc13bba12294e1ffab3f", + "status": "lanes_prepared", + "values_recorded": false, + "write_role_absent": true +} diff --git a/docs/evidence/2026-10-31-nk56-t10-executor-lanes/02-verify.json b/docs/evidence/2026-10-31-nk56-t10-executor-lanes/02-verify.json new file mode 100644 index 0000000..72183cf --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-t10-executor-lanes/02-verify.json @@ -0,0 +1,26 @@ +{ + "action": "verify", + "cas_required": true, + "ccr_sha256": { + "journey": "3f7fd8e7e4c456813d3d067b05790fb42f4fd49f7dbdc7c07e49779eb87de038", + "write": "c84c2e539c08e06ad37bcf13cd536ce41b071ec259d6141901402a64c4ee3d27" + }, + "coding_agents_denied": true, + "exact_policies_and_role": true, + "journey_kv_version": 1, + "journey_lease_at_most_15m": true, + "journey_reads_only_its_path": true, + "phase": "done", + "source_ccrs": { + "journey": "CCR-2026-0059", + "write": "CCR-2026-0058" + }, + "source_sha256": "9431b6da514cd8334a082119b715a38c1e1c1a63a513bc13bba12294e1ffab3f", + "status": "lanes_verified", + "temporary_token_revoked": true, + "values_recorded": false, + "write_login_denied": true, + "write_role_absent": true, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-31-nk56-t10-executor-lanes/README.md b/docs/evidence/2026-10-31-nk56-t10-executor-lanes/README.md new file mode 100644 index 0000000..82e5e31 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-t10-executor-lanes/README.md @@ -0,0 +1,30 @@ +# NK-WP-0056-T10: executor OpenBao lanes, attended setup and proof (2026-10-31) + +Founder-run, claude-code guiding. Runbook: `sso-mfa/k8s/bounded-executor/T10-LANES-RUNBOOK.md`. Tool: +`tools/service-binds/executor-lanes.py`; the second run used source sha256 `9431b6da…`. Receipts hold no values. + +1. **rapp-bounded-executor `make deploy`.** It created ServiceAccount `sso/nk-bind-executor` (uid `bd15569c-8a85-4625-b001-d9f799cb857b`), + the Role, the RoleBinding and NetworkPolicy `bounded-executor`. `make verify-live` reported + `role_matches_ceiling: true`. No Job was created. +2. **Bindings confirmed.** CCR-2026-0058 and CCR-2026-0059 were marked `binding_confirmed` (railiance-platform + `b4bafb0`). The receipts are bound to those files: write `c84c2e53…`, journey `3f7fd8e7…`. +3. **`00-setup-attempt-patch-denied.json`.** The first setup stopped at `cas_required`. platform-admin holds + `update` but not `patch` on `platform/*`. Both policies had been applied; nothing after that. + The tool was fixed in `12c9b2d`: a metadata write that names only `cas_required`, guarded by a before/after + comparison. +4. **`01-setup.json`, `lanes_prepared`:** + - both policies applied; + - `cas_required` set on the svc-authelia key; + - the standing journey-read role created; + - the write role absent; + - the coding-agent fence beats both policies. +5. **`02-verify.json`, `lanes_verified`:** + - exact policies and role; + - `sso/nk-bind-executor`, audience `openbao`, logs in to the journey role with a lease of at most 15m and reads + only the syn-journey path. The entry is at version 1, with field names checked in memory. + - Denied: metadata, every directory bind and token creation. + - Denied: the `default` ServiceAccount, a wrong audience, and a login to the write role. + - The temporary token was revoked. + +The write role (CCR-2026-0058) is created only per admitted window. The journey run through this role is still the +open part of T10. diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index e8b819a..64e1c0b 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -444,11 +444,31 @@ Done since: - It is pinned in the rapp (`c107afc`, pushed). - CCR-2026-0059 was approved by the founder as platform-owner and net-kingdom-owner (railiance-platform `831a0f9`). -Left: +**2026-10-31, lanes live** ([evidence](../docs/evidence/2026-10-31-nk56-t10-executor-lanes/README.md)), founder-run +with `T10-LANES-RUNBOOK.md`: -- `make deploy` of the standing objects, then `confirm-binding` on CCR-2026-0058 and CCR-2026-0059; -- applying the policy and roles (platform-admin); -- the approval-engine and audit-core replies and the token Secret. +- The rapp's standing objects are deployed. `sso/nk-bind-executor` has uid `bd15569c…`, and the Role matches the + ceiling. +- The bindings of CCR-2026-0058 and CCR-2026-0059 are confirmed (railiance-platform `b4bafb0`). +- `executor-lanes.py setup`: + - both policies applied; + - `cas_required` set; + - the standing journey-read role created; + - the write role absent; + - the agent fence holds. +- The first setup stopped because platform-admin has no `patch` on `platform/*`. It now uses a metadata write that + names only `cas_required`, with a before/after guard (`12c9b2d`). +- `verify`: the journey token reads only its path, with a lease of at most 15m. A wrong ServiceAccount, a wrong + audience and a login to the write role are all denied. + +Left for T10: + +- An executor run mode for the journey alone. It is a read-only Job with no admission: journey role only, no write + role, no Kubernetes mutation, and a value-free receipt. The CLI today runs only admissions. +- Its unattended live run. +- The fail-closed proof against a broken bind on the T08 synthetic directory. + +For T06, separately: the approval-engine and audit-core replies, and the token Secret. ## Executor runtime: core runner