tegwick
c43afd46a7
- bounded-executor/prepare_admission.py: the live admission from the pilot example, pins read from the image's commit, window <= 2 h (audit-core's declared bound), validated. - executor-lanes.py window-open/window-close: CCR-2026-0058's window-scoped write role, created for one admitted open window under attended platform-admin and deleted afterwards (idempotent). - security-cases/nk-bind-executor-approval.yaml: the case of record, proposed (founder acceptance). - docs/evidence/2026-11-04-nk56-t15-audit-sender: 8 checks against audit-core 876c3f6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
25 lines
1,019 B
YAML
25 lines
1,019 B
YAML
# KeyCape service client for the bounded executor's approval calls (NK-WP-0056-T06 prerequisite).
|
|
# The case of record; identical parameters to the type's first example. Status proposed until the founder
|
|
# accepts it (type acceptance: owner and founder). Going live makes oidc-service-client 0.2 `implemented`.
|
|
apiVersion: netkingdom.io/security-case/v0.1
|
|
kind: SecurityCase
|
|
spec:
|
|
id: nk-bind-executor-approval
|
|
type: oidc-service-client@0.2
|
|
status: proposed
|
|
owner:
|
|
repo: net-kingdom
|
|
person: founder
|
|
parameters:
|
|
client_id: nk-bind-executor-approval
|
|
display_name: NetKingdom bounded executor (approval-engine)
|
|
audience: approval-engine
|
|
allowed_scopes: approval:create,approval:read,approval:consume
|
|
service_subject: service:nk-bind-executor
|
|
tenant: tenant:platform
|
|
roles: bounded-executor
|
|
token_lifetime: 15m
|
|
consuming_service: bounded-executor
|
|
consumer_namespace: sso
|
|
consumer_service_account: nk-bind-executor
|
|
consumer_owner_repo: rapp-bounded-executor
|