tegwick
625ad652b9
The exercise runs the real request phase, KeyCape client credentials, preflight and consume against KeyCape's pinned image and approval-engine's source with synthetic keys. It found that approval-engine stores an entry's assurance as the verified token's JSON object (KeyCape assuranceClaim), so the executor's comparison with a bare "aal2" refused every real founder approval. entry_is_aal2 now requires level aal2/aal3 with mfa true and fails closed otherwise. Fakes use the real shape. The request-phase tests freeze the clock inside the example admission's window (they had expired on 2026-11-03T11:00Z). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
68 lines
3.9 KiB
Markdown
68 lines
3.9 KiB
Markdown
# Bounded executor (NK-WP-0056)
|
|
|
|
Runs one founder-approved Bounded Execution Admission (`canon/standards/bounded-execution-admission_v0.1.md`)
|
|
exactly once. Founder decision 6d1adce9: net-kingdom writes the executor; `rapp-bounded-executor` deploys it as one
|
|
Job per admission in `sso`.
|
|
|
|
`executor.py` is the core runner (T11):
|
|
|
|
- **preflight, no effect:**
|
|
- the admission is valid (BEA-1..14);
|
|
- the executed files match their pins;
|
|
- the trust states hold;
|
|
- every operation and check is known;
|
|
- the window is open and longer than the wall-time budget;
|
|
- the approval-engine approval binds this admission's digest, names this executor as actor and was approved
|
|
only by listed HUMAN approvers at aal2. The name-to-subject map is configured; no guessing.
|
|
- **consume once:** `request_digest` = admission digest, `decision_id` = run id. An unclear outcome is resolved by
|
|
reading the approval back, never by a second consume.
|
|
- **custody:** emit `execution.run.started` to audit-core. If the event can't be stored, the run stops.
|
|
- **steps:** in plan order, one consumer at a time. Checks run after every mutating step, after their settle time.
|
|
The kill switch and the budget are checked between steps.
|
|
- **failure:**
|
|
- A failed check, an exhausted budget or the kill switch reverts in reverse order.
|
|
- Each revert must pass its own checks.
|
|
- A clean revert may retry within `attempts`.
|
|
- An outcome that can't be determined stops without guessing.
|
|
- A failed revert stops and alerts.
|
|
- **receipt:** one `execution.attribution.receipt` per run, with PDP `not-evaluated` in the pilot. It never holds a
|
|
value that an operation handled.
|
|
|
|
Operations, checks, the approval carrier, the trust oracle, the audit sink, alerts and clocks are injected.
|
|
|
|
`operations.py` (T12) holds the pilot's real operations:
|
|
|
|
- OpenBao KV v2 with CAS;
|
|
- LLDAP self-rotation;
|
|
- ExternalSecret force-sync and its status;
|
|
- rollout restart, where a rollout that never becomes ready is a definite failure and is reverted;
|
|
- the synthetic journey check.
|
|
|
|
An operation signals a known-bad outcome with `definite_failure`, and the runner reverts. Any other error stops
|
|
without guessing.
|
|
|
|
`synthetic_pilot.py` runs a rotation and a deliberate revert on the T08 stack plus OpenBao:
|
|
`uv run bounded-executor/synthetic_pilot.py`.
|
|
|
|
`cli.py --journey-only` (T10) is a read-only run with no admission. It uses the journey-read role only (CCR-2026-0059),
|
|
runs the synthetic journey once and prints its value-free receipt. Exit codes: `0` pass, `1` fail closed, `4` refused.
|
|
`synthetic_journey_only.py` proves it on the T08 stack: it passes when healthy and fails closed on a broken bind.
|
|
|
|
`exercise_approval_identity.py` (T19) runs the executor's real request phase, approval client, preflight and consume
|
|
against KeyCape's pinned image and approval-engine's source. It uses synthetic keys and writes a value-free receipt:
|
|
`python3 bounded-executor/exercise_approval_identity.py --receipt FILE` (defaults `~/key-cape`, `~/approval-engine`).
|
|
It found that approval-engine stores an entry's assurance as the token's JSON object, not a bare `aal2`. The executor
|
|
now parses that object (`entry_is_aal2`).
|
|
|
|
`cli.py` (T13) is the Job's entry point: one admission, one approval id, a non-secret config. Exit codes: `0`
|
|
completed, `3` reverted, `4` refused before any effect, `5` stopped, unknown or failed revert, `6` consumed but not in
|
|
custody. `Containerfile` builds the image, which `.forgejo/workflows/bounded-executor-image.yaml` publishes by digest.
|
|
|
|
Deployment is in `rapp-bounded-executor`, which pins the digest and renders one ConfigMap and Job per admission
|
|
(`make run`, founder-run). That package also holds the ServiceAccount and Role, copied from
|
|
`sso-mfa/k8s/bounded-executor/rbac.yaml`, and the executor's egress-only NetworkPolicy. The receiving side in `sso` is
|
|
`allow-bounded-executor-to-*` in `sso-mfa/k8s/network-policies/netpol-sso.yaml`.
|
|
|
|
```bash
|
|
python3 -m pytest bounded-executor/tests # or: make bounded-executor-test
|
|
```
|