coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T05: grant implemented in railiance-platform (4e60f69, 2e1ca67); net-kingdom copy removed, test reads the add-on, pins bumped; founder sync steps
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 1m55s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 01:15:03 +01:00
parent e58d1c22fd
commit f56d0b2dc8
5 changed files with 47 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/NK-WP-0058-bounded-execution-operability.md
View file

@ -435,9 +435,9 @@ priority: medium
assignee: claude-code
needs_human: true
blocked_on: human
blocking_reason: "Decided (A, 4af1ec01); waits for railiance-platform to adopt the grant as a platform add-on, then the founder's sync and token."
blocking_reason: "Add-on in railiance-platform (4e60f69, 2e1ca67); waits for the founder's Argo sync, agent kubeconfig and first token."
decision_id: "4af1ec01-e8fb-4352-a09b-ae9cda53d984"
intervention_note: "railiance-platform adopts argocd/platform-addons/nk-agent-status/; founder syncs it, builds the agent kubeconfig once, mints 1 h tokens per session."
intervention_note: "Founder runs the steps in docs/proposals/2026-11-06-nk58-t05-agent-status-grant/README.md; then the agent verifies with can-i."
depends_on: [NK-WP-0058-T10]
state_hub_task_id: "30f8c62e-5707-5395-9d86-178cd650fb59"
```
@ -471,6 +471,16 @@ After the decision: railiance-cluster reviews the change, the founder applies it
- **Then the agent verifies:** `auth can-i --list` shows only the grant, and Secrets and pod logs in `sso` answer
`no`.
**2026-11-06: add-on implemented** on the founder's instruction, in railiance-platform:
- `argocd/platform-addons/nk-agent-status/` (`4e60f69`) with `tests/test_nk_agent_status_rbac.py`;
- the manual, pinned Application (`2e1ca67`).
net-kingdom's copy of the grant is deleted: its contract test reads the platform's files, and the owner pins move to
`2e1ca67`. The founder steps are in the proposal README:
- a selective root sync and the child sync, with prune and force off;
- the agent kubeconfig, once;
- `make agent-status-token`.
Propose a read-only grant for the agent's Kubernetes identity in the namespaces the path uses. The grant covers:
- the status and conditions of Jobs, pods, ExternalSecrets and Deployments;