From efb68ca36d9b72f54a02ec0c41ed39ede00a56a0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 6 Nov 2026 00:03:05 +0100 Subject: [PATCH] NK-WP-0058-T02: record the contract CI mode, owner questions and the private-rapp gap Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0 --- docs/bounded-execution-contract-table.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/docs/bounded-execution-contract-table.md b/docs/bounded-execution-contract-table.md index d4b4c8c..03c7d79 100644 --- a/docs/bounded-execution-contract-table.md +++ b/docs/bounded-execution-contract-table.md @@ -486,3 +486,26 @@ The agent's default context can read NetworkPolicies in `sso`, `approval-engine` | C6 | Which copy of the executor's present-existing profile is the source | informed-decision and access-engine | messages `fa7e25d3`, `df5aa613` | | E3 | `required_assurance` | not routed: answered 2026-10-31 (`756016f9`); waits for approval-engine v7 release | — | | C3 | Who materializes | not routed: tracked in ops-mason MASON-WP-0010-T03 (`91e2205f`) | — | + +## Contract CI (NK-WP-0058-T02) + +- **Mode until owners answer:** consumer-pinned. `contracts/owner-pins.json` pins six public owners, and + `.forgejo/workflows/bounded-execution-contracts.yaml` makes anonymous partial clones of them: at the pins on + every push, and at each owner's `main` nightly. `tools/contract-tests/run.sh` is the one suite list, also behind + `make contract-test`, and any skip fails it. +- **Owner questions (2026-11-06):** keep this mode or publish a versioned contract file; and a hub message as the + signal when the nightly run breaks. + +| Owner | Message | Answer | +| --- | --- | --- | +| approval-engine | `4892658f` | open | +| audit-core | `3a546559` | open | +| informed-decision | `aa44a2b3` | open | +| access-engine | `7cf8d61f` | open | +| railiance-platform | `a2105e34` | open | +| key-cape | `ee1e5bb5` | open | + +- **Open, founder:** rapp-bounded-executor is private, so net-kingdom CI cannot fetch it without a credential, and + the rapp has no CI of its own. Its packaging tests (E8 ceiling, E9 egress, R2 config and exit codes) run only + locally today. The options are a rapp CI workflow, which needs the runner to read a private repository, or + making the rapp public.