railiance-platform/workplans/RPF-WP-0069-bounded-executor-lanes.md

---
id: RPF-WP-0069
type: workplan
title: "Bounded executor lanes: write-next-version type, journey read and audit sender (NK-WP-0056)"
domain: financials
repo: railiance-platform
status: active
flavor: implementation
owner: claude
topic_slug: railiance
created: "2026-10-31"
updated: "2026-10-31"
related:
  - NK-WP-0056
  - NK-WP-0040
  - RPF-WP-0067
state_hub_workstream_id: "6eb39172-babd-57d1-8a3b-f23c41347c22"
---

# RPF-WP-0069 — Bounded executor lanes (NK-WP-0056-T02 owner answer)

Receiving workplan for NetKingdom's owner request (State Hub message
`9d08288d-e866-4e1c-9c0b-f1cc0968bd4d`; net-kingdom
`docs/proposals/2026-10-31-nk56-t02-owner-requests.md`). Owner answer:
`docs/credential-lane-designs/bounded-executor.md`. No live, cluster or OpenBao action is
part of T01; every CCR stays `proposed` until its approvers act.

## Answer the request and add the write-next-version request type

```task
id: RPF-WP-0069-T01
status: done
priority: high
state_hub_task_id: "27432a77-e111-5aa9-9c23-34fb4c9a2984"
```

Answer doc written; new contract-only request type `workload-kv-write-next-version`
(`scripts/workload_kv_write_next_version.py`, `tests/test_workload_kv_write_next_version.py`,
dispatch in `scripts/credential-change.py`); CCR-2026-0058 drafted `proposed` with policy artifact
`openbao/policies/net-kingdom-bind-executor-svc-authelia-write.hcl`.

## Review CCR-2026-0058 (founder gate)

```task
id: RPF-WP-0069-T02
status: wait
priority: high
needs_human: true
```

platform-owner and net-kingdom-owner approve or change CCR-2026-0058. The founder chooses
standing or window-scoped write role (recommendation: standing for the pilot). Binding is
confirmed only after `sso/nk-bind-executor` exists from the reviewed rapp-* package.

## Attended setup and verification of CCR-2026-0058

```task
id: RPF-WP-0069-T03
status: wait
priority: high
state_hub_task_id: "6b456804-c408-53bf-8e1d-49723108fca6"
```

After T02: an attended platform-admin (aal2) session sets `cas_required` on the svc-authelia key,
re-checks the coding-agent fence, applies policy and role, and records value-free positive and
negative receipts. This needs an owner setup script modelled on net-kingdom `bind-lane.py`
setup/verify; write it once approval exists. The founder runs it.

## Journey-secret read lane for the executor (NK-WP-0056-T10)

```task
id: RPF-WP-0069-T04
status: wait
priority: medium
state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
```

Draft a `workload-kv-read` CCR (native login, data read only, 15m) for
`platform/workloads/net-kingdom/synthetic-journey/syn-journey`, stating that it widens
CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the ServiceAccount.

## Executor audit-core sender (NK-WP-0040)

```task
id: RPF-WP-0069-T05
status: wait
priority: medium
state_hub_task_id: "5c582aef-ee9d-56ab-a4eb-2019933f00ac"
```

After audit-core admits the sender and names it, draft a `workload-kv-read` CCR in the
CCR-2026-0021/0022 shape: custody `platform/workloads/net-kingdom/bounded-executor/audit-sender`,
ESO into `sso/nk-bind-executor-audit`, ClusterSecretStore restricted to `sso`.

## LLDAP credential custody for the executor

```task
id: RPF-WP-0069-T06
status: wait
priority: medium
state_hub_task_id: "1456b467-f7c9-529d-9f3e-39404aaa36c6"
```

After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2),
draft the custody CCR here.