net-kingdom/workplans/NK-WP-0040-execution-attribution-receipt.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related	state_hub_workstream_id
NK-WP-0040	workplan	Define an execution-attribution receipt for Railiance runs	infotech	net-kingdom	active	residual	claude-code	netkingdom	2026-09-23	2026-10-10	RCLK-WP-0002	e2533f3a-aa43-59b3-bff3-8e64b6149487

Raised by the railiance-clock identity review (history/2026-09-23-railiance-clock-identity-and-layer-review.md, Ruling 1). IAM Profile v0.3 defines who acts: human, service and agent principals, and delegation. Playbook Capability Contract v0.1 defines what is selected and who is responsible. No NetKingdom contract defines the record that ties one execution to its actor chain, artifact and result.

Draft the receipt fields as a Playbook Capability Contract amendment

id: NK-WP-0040-T01
status: done
priority: medium
state_hub_task_id: "9d02685a-a3d9-5b9f-b09e-aef1f196a97f"

Draft a v0.2 amendment that adds an execution-attribution receipt with these fields:

• issuer and subject of the initiating actor
• delegation reference (actor_sub/act.sub) when present
• executing workload binding and runtime principal
• tenant and environment
• run ID
• source commit and artifact digest
• target inventory reference and action
• decision and approval IDs
• attributed time interval, with its clock source and bound when one exists

The receipt must never embed bearer credentials. Unknown attribution is kept explicit, not inferred. Start from the field list in railiance-clock's review.

Done 2026-09-27. Drafted as canon/standards/playbook-capability-contract_v0.2.md (status proposed, supersedes v0.1, which stays accepted and normative until this is accepted). It adds an "Execution Attribution Receipt (proposed)" section with every field above, explicit non-goals (no fourth IAM principal type, not a decision record, not a substitute for responsibility claims), and the never-embed-credentials / no-inferred-attribution rules. Emission, custody, schema, and validator are explicitly left to T02.

Agree the evidence holder and schema with audit-core and Railiance

id: NK-WP-0040-T02
status: wait
blocked_on: founder-decision
blocking_reason: "Emitter, holder and wire binding agreed (RAIL-HO-WP-0015-T01, RPF-WP-0067-T01, AUDIT-WP-0014-T01). Open: founder decision on how an operator-run process gets the audit-core sender bearer; NetKingdom schema/validator with delegation unknown and S1 meanings for tenant/environment/artifact_digest."
priority: medium
state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54"

audit-core holds evidence (layer model §3.3, Evidence role). Railiance executes and emits. Agree who emits, who holds and how the receipt is validated. Add a schema under canon/schemas/ and a validator beside the existing playbook-capability tooling.

Waiting 2026-09-27. Routed to audit-core (evidence-holder/schema agreement) and Railiance (emitter confirmation) via State Hub messages 48eb1101-a577-40c0-bbaa-39df02198155 and 4f1c67bc-8de2-483f-bcac-dbdf107ce95a. NetKingdom adds the schema and validator once both reply; nothing here can be finished unilaterally without pre-empting their agreement.

2026-10-28: railiance-platform answered from source (RPF-WP-0067-T01, bd8ca57): it runs no playbooks, so it is not the emitter; the contract's reference declaration is railiance-infra's S1 Ansible bootstrap-host. Wire binding to reuse: POST /v1/events to audit-core with an Idempotency-Key equal to the envelope id, correlation_id = run id, a per-sender bearer from platform/workloads/audit-core/senders delivered by ESO, envelope source = sender name, no per-message signature. Recommended emission: every terminal outcome keyed by run_id. Not truthfully fillable today: initiator.iss/sub and delegation (shell-started runs carry no token), executing_workload (workload binding only proposed), artifact_digest (Ansible has no packaged artifact), decision_refs, time_interval.bound. Next: railiance-infra names the runner and emitter; a sender credential then goes to railiance-platform as a change request.

2026-10-28 (railiance-infra): answered from source (RAIL-HO-WP-0015-T01, babae80). No S1 runner exists: the operator runs ansible-playbook through make converge (Makefile:361-362) with no callback or wrapper. Decided: the emitter is a new railiance-infra converge wrapper modelled on scripts/s1_handoff.py (RAIL-HO-WP-0015-T02, not built): UUID4 run_id first, emission from a finally path for succeeded/failed/refused/interrupted, local retention and retry with run_id as Idempotency-Key. Proposed audit-core sender: railiance-infra-s1-runner. Fillable today: run_id, target, action, time_interval.start/end, source_commit (only with a clean-tree refusal); partly runtime_principal (OS accounts) and clock_source; not initiator, delegation, executing_workload, tenant, environment, artifact_digest, decision_refs, time_interval.bound.

Remaining for T02: (1) founder decision: how an operator-run shell process obtains the sender bearer (the ESO-projected Secret reaches pods only), e.g. a short-lived OpenBao fetch or an in-cluster relay; then railiance-platform registers the sender. (2) NetKingdom: the receipt schema allows an explicit unknown for delegation (the draft permits absence only when there was no delegation) and defines tenant, environment and artifact_digest for an Ansible S1 run; then schema under canon/schemas/ and validator. railiance-infra's wrapper waits on both.

Infrastructure review — 2026-09-28

Use accepted IAM Profile v0.3 and Playbook Capability Contract v0.1 as the current baseline. Proposed IAM v0.4 and Playbook v0.2 are not deployed capabilities. RCLK-WP-0002 still explicitly names this receipt as its dependency on September 28. T02 remains wait for emitter and evidence-holder agreement.

Require the agreed schema to preserve unknown actor/delegation and clock bounds explicitly, correlate decision/approval/run/artifact identities, and distinguish durable receipt ingestion from attribution proof. Reuse audit-core sender custody and reconciliation contracts rather than create another audit sink. Acceptance needs an actual Railiance-emitted receipt and audit-core readback, plus invalid/missing attribution cases; schema validation alone cannot establish end-to-end attribution.

Evidence and cross-plan priorities: estate review.

2026-10-10 consolidation review: AUDIT-WP-0014-T01 (October 4) accepts audit-core evidence custody and publishes field/unknown/absence/envelope requirements in audit-core/docs/cross-repo-evidence-admission.md. The custody reply is delivered; a stranded message-from:audit-core qualifier is obsolete. Railiance emitter agreement is still required: retain original request 4f1c67bc-8de2-483f-bcac-dbdf107ce95a and identify the exact component/source, run-id/idempotency, tenant/scope and wire binding with the Railiance owner. T02 remains wait. Its existing both-owner agreement gate still governs schema implementation; draft preparation is not owner acceptance. AUDIT-WP-0014-T02 consumes the eventual canonical schema/fixtures and emitter binding, and cannot be used as evidence that either has already arrived.

2026-10-11: demoted to flavor: residual / backlog by founder-authorized triage — off the critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged; promote back when demand or risk appears. See the-custodian history/20261011-netkingdom-security-progress-assessment.md.