NK-WP-0058-T02: record the contract CI mode, owner questions and the private-rapp gap

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

docs/bounded-execution-contract-table.md

@@ -486,3 +486,26 @@ The agent's default context can read NetworkPolicies in `sso`, `approval-engine`
 | C6 | Which copy of the executor's present-existing profile is the source | informed-decision and access-engine | messages `fa7e25d3`, `df5aa613` |
 | E3 | `required_assurance` | not routed: answered 2026-10-31 (`756016f9`); waits for approval-engine v7 release | — |
 | C3 | Who materializes | not routed: tracked in ops-mason MASON-WP-0010-T03 (`91e2205f`) | — |
+
+## Contract CI (NK-WP-0058-T02)
+
+- **Mode until owners answer:** consumer-pinned. `contracts/owner-pins.json` pins six public owners, and
+  `.forgejo/workflows/bounded-execution-contracts.yaml` makes anonymous partial clones of them: at the pins on
+  every push, and at each owner's `main` nightly. `tools/contract-tests/run.sh` is the one suite list, also behind
+  `make contract-test`, and any skip fails it.
+- **Owner questions (2026-11-06):** keep this mode or publish a versioned contract file; and a hub message as the
+  signal when the nightly run breaks.
+
+| Owner | Message | Answer |
+| --- | --- | --- |
+| approval-engine | `4892658f` | open |
+| audit-core | `3a546559` | open |
+| informed-decision | `aa44a2b3` | open |
+| access-engine | `7cf8d61f` | open |
+| railiance-platform | `a2105e34` | open |
+| key-cape | `ee1e5bb5` | open |
+
+- **Open, founder:** rapp-bounded-executor is private, so net-kingdom CI cannot fetch it without a credential, and
+  the rapp has no CI of its own. Its packaging tests (E8 ceiling, E9 egress, R2 config and exit codes) run only
+  locally today. The options are a rapp CI workflow, which needs the runner to read a private repository, or
+  making the rapp public.