net-kingdom/workplans/NK-WP-0040-execution-attribution-receipt.md

---
id: NK-WP-0040
type: workplan
title: "Define an execution-attribution receipt for Railiance runs"
domain: infotech
repo: net-kingdom
status: active
flavor: residual
owner: claude-code
topic_slug: netkingdom
created: "2026-09-23"
updated: "2026-10-10"
related: [RCLK-WP-0002]
state_hub_workstream_id: "e2533f3a-aa43-59b3-bff3-8e64b6149487"
---

Raised by the railiance-clock identity review
(`history/2026-09-23-railiance-clock-identity-and-layer-review.md`, Ruling 1).
IAM Profile v0.3 defines who acts: human, service and agent principals, and
delegation. Playbook Capability Contract v0.1 defines what is selected and who
is responsible. No NetKingdom contract defines the record that ties **one
execution** to its actor chain, artifact and result.

## Draft the receipt fields as a Playbook Capability Contract amendment

```task
id: NK-WP-0040-T01
status: done
priority: medium
state_hub_task_id: "9d02685a-a3d9-5b9f-b09e-aef1f196a97f"
```

Draft a v0.2 amendment that adds an execution-attribution receipt with these
fields:

- issuer and subject of the initiating actor
- delegation reference (`actor_sub`/`act.sub`) when present
- executing workload binding and runtime principal
- tenant and environment
- run ID
- source commit and artifact digest
- target inventory reference and action
- decision and approval IDs
- attributed time interval, with its clock source and bound when one exists

The receipt must never embed bearer credentials. Unknown attribution is kept
explicit, not inferred. Start from the field list in railiance-clock's review.

**Done 2026-09-27.** Drafted as
`canon/standards/playbook-capability-contract_v0.2.md` (status `proposed`,
supersedes v0.1, which stays `accepted` and normative until this is
accepted). It adds an "Execution Attribution Receipt (proposed)" section
with every field above, explicit non-goals (no fourth IAM principal type,
not a decision record, not a substitute for responsibility claims), and the
never-embed-credentials / no-inferred-attribution rules. Emission, custody,
schema, and validator are explicitly left to T02.

## Agree the evidence holder and schema with audit-core and Railiance

```task
id: NK-WP-0040-T02
status: wait
blocked_on: founder-decision
blocking_reason: "Emitter, holder and wire binding agreed (RAIL-HO-WP-0015-T01, RPF-WP-0067-T01, AUDIT-WP-0014-T01). Open: founder decision on how an operator-run process gets the audit-core sender bearer; NetKingdom schema/validator with delegation unknown and S1 meanings for tenant/environment/artifact_digest."
priority: medium
state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54"
```

audit-core holds evidence (layer model §3.3, Evidence role). Railiance
executes and emits. Agree who emits, who holds and how the receipt is
validated. Add a schema under `canon/schemas/` and a validator beside the
existing playbook-capability tooling.

**Waiting 2026-09-27.** Routed to audit-core (evidence-holder/schema
agreement) and Railiance (emitter confirmation) via State Hub messages
`48eb1101-a577-40c0-bbaa-39df02198155` and
`4f1c67bc-8de2-483f-bcac-dbdf107ce95a`. NetKingdom adds the schema and
validator once both reply; nothing here can be finished unilaterally
without pre-empting their agreement.

**2026-10-28:** railiance-platform answered from source (RPF-WP-0067-T01, `bd8ca57`): it runs no
playbooks, so it is not the emitter; the contract's reference declaration is railiance-infra's
S1 Ansible `bootstrap-host`. Wire binding to reuse: `POST /v1/events` to audit-core with an
`Idempotency-Key` equal to the envelope id, `correlation_id` = run id, a per-sender bearer from
`platform/workloads/audit-core/senders` delivered by ESO, envelope `source` = sender name, no
per-message signature. Recommended emission: every terminal outcome keyed by `run_id`. Not
truthfully fillable today: `initiator.iss/sub` and `delegation` (shell-started runs carry no
token), `executing_workload` (workload binding only proposed), `artifact_digest` (Ansible has
no packaged artifact), `decision_refs`, `time_interval.bound`. Next: railiance-infra names the
runner and emitter; a sender credential then goes to railiance-platform as a change request.

**2026-10-28 (railiance-infra):** answered from source (RAIL-HO-WP-0015-T01, `babae80`). No S1
runner exists: the operator runs `ansible-playbook` through `make converge` (`Makefile:361-362`)
with no callback or wrapper. Decided: the emitter is a new railiance-infra converge wrapper
modelled on `scripts/s1_handoff.py` (RAIL-HO-WP-0015-T02, not built): UUID4 `run_id` first,
emission from a `finally` path for succeeded/failed/refused/interrupted, local retention and
retry with `run_id` as Idempotency-Key. Proposed audit-core sender: `railiance-infra-s1-runner`.
Fillable today: `run_id`, `target`, `action`, `time_interval.start/end`, `source_commit` (only
with a clean-tree refusal); partly `runtime_principal` (OS accounts) and `clock_source`; not
`initiator`, `delegation`, `executing_workload`, `tenant`, `environment`, `artifact_digest`,
`decision_refs`, `time_interval.bound`.

Remaining for T02: (1) founder decision: how an operator-run shell process obtains the sender
bearer (the ESO-projected Secret reaches pods only), e.g. a short-lived OpenBao fetch or an
in-cluster relay; then railiance-platform registers the sender. (2) NetKingdom: the receipt
schema allows an explicit `unknown` for `delegation` (the draft permits absence only when there
was no delegation) and defines `tenant`, `environment` and `artifact_digest` for an Ansible S1
run; then schema under `canon/schemas/` and validator. railiance-infra's wrapper waits on both.

## Infrastructure review — 2026-09-28

Use accepted IAM Profile v0.3 and Playbook Capability Contract v0.1 as the
current baseline. Proposed IAM v0.4 and Playbook v0.2 are not deployed
capabilities. RCLK-WP-0002 still explicitly names this receipt as its dependency
on September 28. T02 remains `wait` for emitter and evidence-holder agreement.

Require the agreed schema to preserve unknown actor/delegation and clock
bounds explicitly, correlate decision/approval/run/artifact identities, and
distinguish durable receipt ingestion from attribution proof. Reuse audit-core
sender custody and reconciliation contracts rather than create another audit
sink. Acceptance needs an actual Railiance-emitted receipt and audit-core
readback, plus invalid/missing attribution cases; schema validation alone
cannot establish end-to-end attribution.

Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).

2026-10-10 consolidation review: AUDIT-WP-0014-T01 (October 4) accepts
audit-core evidence custody and publishes field/unknown/absence/envelope
requirements in audit-core/docs/cross-repo-evidence-admission.md. The custody
reply is delivered; a stranded message-from:audit-core qualifier is obsolete.
Railiance emitter agreement is still required: retain original request
4f1c67bc-8de2-483f-bcac-dbdf107ce95a and identify the exact component/source,
run-id/idempotency, tenant/scope and wire binding with the Railiance owner.
T02 remains wait. Its existing both-owner agreement gate still governs schema
implementation; draft preparation is not owner acceptance. AUDIT-WP-0014-T02
consumes the eventual canonical schema/fixtures and emitter binding, and cannot
be used as evidence that either has already arrived.

> 2026-10-11: demoted to `flavor: residual` / `backlog` by founder-authorized triage — off the
> critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged;
> promote back when demand or risk appears. See the-custodian
> `history/20261011-netkingdom-security-progress-assessment.md`.