coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0059 (proposed): bounded executor reads the syn-journey identity
All checks were successful
CCR intake gate / gate (push) Successful in 10s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
workload-kv-read for platform/workloads/net-kingdom/synthetic-journey/syn-journey:
read on the data path only, own role bound to sso/nk-bind-executor (audience
openbao, 15m), separate from the CCR-2026-0058 write role. Widens
CCR-2026-0057 runtime_access (stated). Standing reader proposed; founder
decides. RPF-WP-0069-T04 updated. Not approved, not applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
codex 2026-10-31 18:47:31 +01:00
parent d0ff5349db
commit c9b68ea4e4
3 changed files with 149 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/RPF-WP-0069-bounded-executor-lanes.md
View file

@ -78,7 +78,7 @@ id: RPF-WP-0069-T04
status: wait
priority: medium
blocked_on: human
blocking_reason: "Founder accepts widening CCR-2026-0057 runtime_access; scheduled with NK-WP-0056-T10 once sso/nk-bind-executor exists"
blocking_reason: "CCR-2026-0059 drafted (proposed): founder approval (platform-owner, net-kingdom-owner) incl. the CCR-2026-0057 runtime_access widening and the standing-vs-window role choice; apply needs sso/nk-bind-executor (rapp-bounded-executor make deploy)"
state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
```
@ -86,6 +86,18 @@ Draft a `workload-kv-read` CCR (native login, data read only, 15m) for
`platform/workloads/net-kingdom/synthetic-journey/syn-journey`, stating that it widens
CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the ServiceAccount.
**2026-10-31, drafted** at the founder's request (net-kingdom session):
- `CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml` and the policy
`openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl`: read on the data path, plus
`lookup-self` and `revoke-self`.
- Role `net-kingdom-bind-executor-syn-journey-read`: `sso/nk-bind-executor`, audience `openbao`, 15m, exactly one
policy. It is separate from the CCR-2026-0058 write role.
- `supersedes_boundary` names the CCR-2026-0057 change.
- `lifecycle.role_window` proposes a standing reader (founder decides; window-scoped is the alternative).
- `bound_claims_confirmed: false` until the ServiceAccount exists. Validates with only that warning. The
pre-existing failures (CCR-2026-0035 and 2 tests) are unrelated.
## Executor audit-core sender (NK-WP-0040)
```task