coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
net-kingdom/docs/evidence/2026-10-31-nk56-t10-executor-lanes
History
Exact
tegwick ef6284c371
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
NK-WP-0056-T10: executor lanes set up and verified (founder-run receipts) 
rapp deploy (sso/nk-bind-executor uid bd15569c, role = ceiling), bindings
confirmed (railiance-platform b4bafb0), executor-lanes.py setup
lanes_prepared and verify lanes_verified. Left for T10: a journey-only,
read-only run mode and its unattended live run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
2026-10-31 19:47:29 +01:00
..
00-setup-attempt-patch-denied.json NK-WP-0056-T10: set cas_required by metadata write (platform-admin has no patch) 2026-10-31 19:42:40 +01:00
01-setup.json NK-WP-0056-T10: executor lanes set up and verified (founder-run receipts) 2026-10-31 19:47:29 +01:00
02-verify.json NK-WP-0056-T10: executor lanes set up and verified (founder-run receipts) 2026-10-31 19:47:29 +01:00
README.md NK-WP-0056-T10: executor lanes set up and verified (founder-run receipts) 2026-10-31 19:47:29 +01:00

README.md

NK-WP-0056-T10: executor OpenBao lanes, attended setup and proof (2026-10-31)

Founder-run, claude-code guiding. Runbook: sso-mfa/k8s/bounded-executor/T10-LANES-RUNBOOK.md. Tool: tools/service-binds/executor-lanes.py; the second run used source sha256 9431b6da…. Receipts hold no values.

  1. rapp-bounded-executor make deploy. It created ServiceAccount sso/nk-bind-executor (uid bd15569c-8a85-4625-b001-d9f799cb857b), the Role, the RoleBinding and NetworkPolicy bounded-executor. make verify-live reported role_matches_ceiling: true. No Job was created.
  2. Bindings confirmed. CCR-2026-0058 and CCR-2026-0059 were marked binding_confirmed (railiance-platform b4bafb0). The receipts are bound to those files: write c84c2e53…, journey 3f7fd8e7….
  3. 00-setup-attempt-patch-denied.json. The first setup stopped at cas_required. platform-admin holds update but not patch on platform/*. Both policies had been applied; nothing after that. The tool was fixed in 12c9b2d: a metadata write that names only cas_required, guarded by a before/after comparison.
  4. 01-setup.json, lanes_prepared:
    • both policies applied;
    • cas_required set on the svc-authelia key;
    • the standing journey-read role created;
    • the write role absent;
    • the coding-agent fence beats both policies.
  5. 02-verify.json, lanes_verified:
    • exact policies and role;
    • sso/nk-bind-executor, audience openbao, logs in to the journey role with a lease of at most 15m and reads only the syn-journey path. The entry is at version 1, with field names checked in memory.
    • Denied: metadata, every directory bind and token creation.
    • Denied: the default ServiceAccount, a wrong audience, and a login to the write role.
    • The temporary token was revoked.

The write role (CCR-2026-0058) is created only per admitted window. The journey run through this role is still the open part of T10.