Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
CLI entry point and approval-engine/audit-core clients; events carry
occurred_at (audit-core envelope); hash-locked image with pinned lldap
stage builds locally; image workflow and executor tests in CI; pilot
example pins the executed files. rapp reshaping still open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Consumes one admission once through the approval-engine carrier after an
effect-free preflight (validity, source pins, trust, window vs budget,
binding digest, actor, human aal2 approvers), emits run.started, runs steps
with settle-timed checks, reverts on failure with per-revert checks, retries
within attempts, stops on unknown outcomes, honours budget and kill switch,
and emits one value-free receipt (PDP not-evaluated). 22 tests with fakes.
BEA-9 extended to revert steps; examples regenerated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Window-scoped write role (CCR-2026-0058 approved as amended), bind
self-rotation (pilot step is OPERATE on the one bind; svc-executor-pw
dropped), pilot without the PDP gate (not-evaluated), started event plus one
receipt per run, rapp Job in sso, owner workplans approved. New tasks: T11
core runner, T12 pilot operations and packaging; T06 depends on T12.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Executor credentials declared (planned) with executor_subject; service-identity
gains convention executor (SI-15: approved-only grants, no person, not
interactive) and --admissions, checking that an admission's ceiling lies inside
the executor's declared grants (pilot covered). RBAC in sso-mfa/k8s/bounded-executor
(not applied): ServiceAccount without automount, a Role limited to the authelia
Deployment and ExternalSecret, no read of credential objects; tests tie Role,
declaration and pilot ceiling. The pilot example's delivery check now reads the
ExternalSecret status. railiance-apps and glas-harness answers recorded (T02).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Standard, schema and validator for the founder's admission of one bounded
executor run: exact plan by digest, window by risk class, SI MODE @ SCOPE
ceiling with least-privilege coverage, blast radius by consumer, named
source-pinned checks, revert per mutating step, budget, single use, and the
NK-WP-0040 receipt. check-approval verifies a carrier record (Approval
Engine or founder SSH signature): aal2 human approver, not the executor,
consumed at most once in the window. Examples express the bind split;
step 10 is refused as human-intrinsic. 22 tests; make targets; tool index.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
