net-kingdom/workplans/NK-WP-0040-execution-attribution-receipt.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related	state_hub_workstream_id
NK-WP-0040	workplan	Define an execution-attribution receipt for Railiance runs	infotech	net-kingdom	active	residual	claude-code	netkingdom	2026-09-23	2026-10-10	RCLK-WP-0002	e2533f3a-aa43-59b3-bff3-8e64b6149487

Raised by the railiance-clock identity review (history/2026-09-23-railiance-clock-identity-and-layer-review.md, Ruling 1). IAM Profile v0.3 defines who acts: human, service and agent principals, and delegation. Playbook Capability Contract v0.1 defines what is selected and who is responsible. No NetKingdom contract defines the record that ties one execution to its actor chain, artifact and result.

Draft the receipt fields as a Playbook Capability Contract amendment

id: NK-WP-0040-T01
status: done
priority: medium
state_hub_task_id: "9d02685a-a3d9-5b9f-b09e-aef1f196a97f"

Draft a v0.2 amendment that adds an execution-attribution receipt with these fields:

• issuer and subject of the initiating actor
• delegation reference (actor_sub/act.sub) when present
• executing workload binding and runtime principal
• tenant and environment
• run ID
• source commit and artifact digest
• target inventory reference and action
• decision and approval IDs
• attributed time interval, with its clock source and bound when one exists

The receipt must never embed bearer credentials. Unknown attribution is kept explicit, not inferred. Start from the field list in railiance-clock's review.

Done 2026-09-27. Drafted as canon/standards/playbook-capability-contract_v0.2.md (status proposed, supersedes v0.1, which stays accepted and normative until this is accepted). It adds an "Execution Attribution Receipt (proposed)" section with every field above, explicit non-goals (no fourth IAM principal type, not a decision record, not a substitute for responsibility claims), and the never-embed-credentials / no-inferred-attribution rules. Emission, custody, schema, and validator are explicitly left to T02.

Agree the evidence holder and schema with audit-core and Railiance

id: NK-WP-0040-T02
status: wait
blocked_on: message-from:railiance-master
blocking_reason: "Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance."
priority: medium
state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54"

audit-core holds evidence (layer model §3.3, Evidence role). Railiance executes and emits. Agree who emits, who holds and how the receipt is validated. Add a schema under canon/schemas/ and a validator beside the existing playbook-capability tooling.

Waiting 2026-09-27. Routed to audit-core (evidence-holder/schema agreement) and Railiance (emitter confirmation) via State Hub messages 48eb1101-a577-40c0-bbaa-39df02198155 and 4f1c67bc-8de2-483f-bcac-dbdf107ce95a. NetKingdom adds the schema and validator once both reply; nothing here can be finished unilaterally without pre-empting their agreement.

Infrastructure review — 2026-09-28

Use accepted IAM Profile v0.3 and Playbook Capability Contract v0.1 as the current baseline. Proposed IAM v0.4 and Playbook v0.2 are not deployed capabilities. RCLK-WP-0002 still explicitly names this receipt as its dependency on September 28. T02 remains wait for emitter and evidence-holder agreement.

Require the agreed schema to preserve unknown actor/delegation and clock bounds explicitly, correlate decision/approval/run/artifact identities, and distinguish durable receipt ingestion from attribution proof. Reuse audit-core sender custody and reconciliation contracts rather than create another audit sink. Acceptance needs an actual Railiance-emitted receipt and audit-core readback, plus invalid/missing attribution cases; schema validation alone cannot establish end-to-end attribution.

Evidence and cross-plan priorities: estate review.

2026-10-10 consolidation review: AUDIT-WP-0014-T01 (October 4) accepts audit-core evidence custody and publishes field/unknown/absence/envelope requirements in audit-core/docs/cross-repo-evidence-admission.md. The custody reply is delivered; a stranded message-from:audit-core qualifier is obsolete. Railiance emitter agreement is still required: retain original request 4f1c67bc-8de2-483f-bcac-dbdf107ce95a and identify the exact component/source, run-id/idempotency, tenant/scope and wire binding with the Railiance owner. T02 remains wait. Its existing both-owner agreement gate still governs schema implementation; draft preparation is not owner acceptance. AUDIT-WP-0014-T02 consumes the eventual canonical schema/fixtures and emitter binding, and cannot be used as evidence that either has already arrived.

2026-10-11: demoted to flavor: residual / backlog by founder-authorized triage — off the critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; promote back when demand or risk appears. See the-custodian history/20261011-netkingdom-security-progress-assessment.md.