RPF-WP-0069: State Hub ids written back by fix-consistency
Some checks failed
CI Smoke / host-smoke (push) Waiting to run
CI Smoke / container-smoke (push) Waiting to run
CCR intake gate / gate (push) Has been cancelled

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
codex 2026-10-31 14:44:00 +01:00
parent 8b57d270de
commit 03a74e839c

View file

@ -14,6 +14,7 @@ related:
- NK-WP-0056
- NK-WP-0040
- RPF-WP-0067
state_hub_workstream_id: "6eb39172-babd-57d1-8a3b-f23c41347c22"
---
# RPF-WP-0069 — Bounded executor lanes (NK-WP-0056-T02 owner answer)
@ -30,6 +31,7 @@ part of T01; every CCR stays `proposed` until its approvers act.
id: RPF-WP-0069-T01
status: done
priority: high
state_hub_task_id: "27432a77-e111-5aa9-9c23-34fb4c9a2984"
```
Answer doc written; new contract-only request type `workload-kv-write-next-version`
@ -56,6 +58,7 @@ confirmed only after `sso/nk-bind-executor` exists from the reviewed rapp-* pack
id: RPF-WP-0069-T03
status: wait
priority: high
state_hub_task_id: "6b456804-c408-53bf-8e1d-49723108fca6"
```
After T02: an attended platform-admin (aal2) session sets `cas_required` on the svc-authelia key,
@ -69,6 +72,7 @@ setup/verify; write it once approval exists. The founder runs it.
id: RPF-WP-0069-T04
status: wait
priority: medium
state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
```
Draft a `workload-kv-read` CCR (native login, data read only, 15m) for
@ -81,6 +85,7 @@ CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the Servic
id: RPF-WP-0069-T05
status: wait
priority: medium
state_hub_task_id: "5c582aef-ee9d-56ab-a4eb-2019933f00ac"
```
After audit-core admits the sender and names it, draft a `workload-kv-read` CCR in the
@ -93,6 +98,7 @@ ESO into `sso/nk-bind-executor-audit`, ClusterSecretStore restricted to `sso`.
id: RPF-WP-0069-T06
status: wait
priority: medium
state_hub_task_id: "1456b467-f7c9-529d-9f3e-39404aaa36c6"
```
After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2),