tegwick
d1cf754222
Consumes one admission once through the approval-engine carrier after an effect-free preflight (validity, source pins, trust, window vs budget, binding digest, actor, human aal2 approvers), emits run.started, runs steps with settle-timed checks, reverts on failure with per-revert checks, retries within attempts, stops on unknown outcomes, honours budget and kill switch, and emits one value-free receipt (PDP not-evaluated). 22 tests with fakes. BEA-9 extended to revert steps; examples regenerated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
37 lines
2 KiB
Markdown
37 lines
2 KiB
Markdown
# Bounded executor (NK-WP-0056)
|
|
|
|
Runs one founder-approved Bounded Execution Admission (`canon/standards/bounded-execution-admission_v0.1.md`)
|
|
exactly once. Founder decision 6d1adce9: net-kingdom writes the executor; `rapp-bounded-executor` deploys it as one
|
|
Job per admission in `sso` (T12).
|
|
|
|
`executor.py` is the core runner (T11):
|
|
|
|
- **preflight, no effect:**
|
|
- the admission is valid (BEA-1..14);
|
|
- the executed files match their pins;
|
|
- the trust states hold;
|
|
- every operation and check is known;
|
|
- the window is open and longer than the wall-time budget;
|
|
- the approval-engine approval binds this admission's digest, names this executor as actor and was approved
|
|
only by listed HUMAN approvers at aal2. The name-to-subject map is configured; no guessing.
|
|
- **consume once:** `request_digest` = admission digest, `decision_id` = run id. An unclear outcome is resolved by
|
|
reading the approval back, never by a second consume.
|
|
- **custody:** emit `execution.run.started` to audit-core. If the event can't be stored, the run stops.
|
|
- **steps:** in plan order, one consumer at a time. Checks run after every mutating step, after their settle time.
|
|
The kill switch and the budget are checked between steps.
|
|
- **failure:**
|
|
- A failed check, an exhausted budget or the kill switch reverts in reverse order.
|
|
- Each revert must pass its own checks.
|
|
- A clean revert may retry within `attempts`.
|
|
- An outcome that can't be determined stops without guessing.
|
|
- A failed revert stops and alerts.
|
|
- **receipt:** one `execution.attribution.receipt` per run, with PDP `not-evaluated` in the pilot. It never holds a
|
|
value that an operation handled.
|
|
|
|
Operations, checks, the approval carrier, the trust oracle, the audit sink, alerts and clocks are injected. T12 adds
|
|
the pilot's real operations (OpenBao CAS write, LLDAP self-rotation, ExternalSecret sync, rollout, synthetic
|
|
journey), the CLI, the Containerfile and the image workflow.
|
|
|
|
```bash
|
|
python3 -m pytest bounded-executor/tests # or: make bounded-executor-test
|
|
```
|