702ca22069
Founder-run net-kingdom executor-lanes.py (setup lanes_prepared, verify lanes_verified; evidence net-kingdom ef6284c). 0059 verified after its first journey run (NK-WP-0056-T10). 0058 role stays per admitted window. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
160 lines
6.3 KiB
Markdown
160 lines
6.3 KiB
Markdown
---
|
|
id: RPF-WP-0069
|
|
type: workplan
|
|
title: "Bounded executor lanes: write-next-version type, journey read and audit sender (NK-WP-0056)"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: active
|
|
flavor: implementation
|
|
owner: claude
|
|
topic_slug: railiance
|
|
created: "2026-10-31"
|
|
updated: "2026-10-31"
|
|
related:
|
|
- NK-WP-0056
|
|
- NK-WP-0040
|
|
- RPF-WP-0067
|
|
state_hub_workstream_id: "6eb39172-babd-57d1-8a3b-f23c41347c22"
|
|
---
|
|
|
|
# RPF-WP-0069 — Bounded executor lanes (NK-WP-0056-T02 owner answer)
|
|
|
|
Receiving workplan for NetKingdom's owner request (State Hub message
|
|
`9d08288d-e866-4e1c-9c0b-f1cc0968bd4d`; net-kingdom
|
|
`docs/proposals/2026-10-31-nk56-t02-owner-requests.md`). Owner answer:
|
|
`docs/credential-lane-designs/bounded-executor.md`. No live, cluster or OpenBao action is
|
|
part of T01; every CCR stays `proposed` until its approvers act.
|
|
|
|
## Answer the request and add the write-next-version request type
|
|
|
|
```task
|
|
id: RPF-WP-0069-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "27432a77-e111-5aa9-9c23-34fb4c9a2984"
|
|
```
|
|
|
|
Answer doc written; new contract-only request type `workload-kv-write-next-version`
|
|
(`scripts/workload_kv_write_next_version.py`, `tests/test_workload_kv_write_next_version.py`,
|
|
dispatch in `scripts/credential-change.py`); CCR-2026-0058 drafted `proposed` with policy artifact
|
|
`openbao/policies/net-kingdom-bind-executor-svc-authelia-write.hcl`.
|
|
|
|
## Review CCR-2026-0058 (founder gate)
|
|
|
|
```task
|
|
id: RPF-WP-0069-T02
|
|
status: done
|
|
priority: high
|
|
needs_human: true
|
|
decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
|
|
blocked_on: human
|
|
blocking_reason: "Founder approval of CCR-2026-0058 and choice of standing or window-scoped write role (hub decision c29c6eda)"
|
|
state_hub_task_id: "3d4c818e-0c5f-5a14-9735-8056ff9fc7c3"
|
|
```
|
|
|
|
platform-owner and net-kingdom-owner approve or change CCR-2026-0058. The founder chooses
|
|
standing or window-scoped write role (recommendation: standing for the pilot). Binding is
|
|
confirmed only after `sso/nk-bind-executor` exists from the reviewed rapp-* package.
|
|
|
|
## Attended setup and verification of CCR-2026-0058
|
|
|
|
```task
|
|
id: RPF-WP-0069-T03
|
|
status: wait
|
|
priority: high
|
|
depends_on: [RPF-WP-0069-T02]
|
|
state_hub_task_id: "6b456804-c408-53bf-8e1d-49723108fca6"
|
|
```
|
|
|
|
After T02: an attended platform-admin (aal2) session sets `cas_required` on the svc-authelia key,
|
|
re-checks the coding-agent fence, applies policy and role, and records value-free positive and
|
|
negative receipts. This needs an owner setup script modelled on net-kingdom `bind-lane.py`
|
|
setup/verify; write it once approval exists. The founder runs it.
|
|
|
|
## Journey-secret read lane for the executor (NK-WP-0056-T10)
|
|
|
|
```task
|
|
id: RPF-WP-0069-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
|
|
```
|
|
|
|
Draft a `workload-kv-read` CCR (native login, data read only, 15m) for
|
|
`platform/workloads/net-kingdom/synthetic-journey/syn-journey`, stating that it widens
|
|
CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the ServiceAccount.
|
|
|
|
**2026-10-31, drafted** at the founder's request (net-kingdom session):
|
|
|
|
- `CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml` and the policy
|
|
`openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl`: read on the data path, plus
|
|
`lookup-self` and `revoke-self`.
|
|
- Role `net-kingdom-bind-executor-syn-journey-read`: `sso/nk-bind-executor`, audience `openbao`, 15m, exactly one
|
|
policy. It is separate from the CCR-2026-0058 write role.
|
|
- `supersedes_boundary` names the CCR-2026-0057 change.
|
|
- `lifecycle.role_window` proposes a standing reader (founder decides; window-scoped is the alternative).
|
|
- `bound_claims_confirmed: false` until the ServiceAccount exists. Validates with only that warning. The
|
|
pre-existing failures (CCR-2026-0035 and 2 tests) are unrelated.
|
|
|
|
**Done 2026-10-31.**
|
|
|
|
- Approved by the founder (`831a0f9`). The binding was confirmed after the rapp deploy (`b4bafb0`).
|
|
- The founder ran net-kingdom `tools/service-binds/executor-lanes.py`:
|
|
- `setup`: the policy and standing role were applied; the CCR-2026-0058 policy and `cas_required` too.
|
|
- `verify`: exact policy, lease of at most 15m, reads only its path, and the negatives held.
|
|
- CCR-2026-0059 is `applied`. It becomes `verified` after the first journey run through the role (NK-WP-0056-T10).
|
|
- Finding: platform-admin has no `patch` on `platform/*`. KV metadata changes therefore use a write that names only the
|
|
changed field.
|
|
|
|
## Executor audit-core sender (NK-WP-0040)
|
|
|
|
```task
|
|
id: RPF-WP-0069-T05
|
|
status: wait
|
|
priority: medium
|
|
blocked_on: dependency
|
|
blocking_reason: "audit-core admits and names the sender (AUDIT-WP-0018-T02)"
|
|
state_hub_task_id: "5c582aef-ee9d-56ab-a4eb-2019933f00ac"
|
|
```
|
|
|
|
After audit-core admits the sender and names it, draft a `workload-kv-read` CCR in the
|
|
CCR-2026-0021/0022 shape: custody `platform/workloads/net-kingdom/bounded-executor/audit-sender`,
|
|
ESO into `sso/nk-bind-executor-audit`, ClusterSecretStore restricted to `sso`.
|
|
|
|
## LLDAP credential custody for the executor
|
|
|
|
```task
|
|
id: RPF-WP-0069-T06
|
|
status: cancel
|
|
priority: medium
|
|
needs_human: true
|
|
decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
|
|
blocked_on: human
|
|
blocking_reason: "Founder chooses bind self-rotation (no account needed) or a lldap_password_manager account"
|
|
state_hub_task_id: "1456b467-f7c9-529d-9f3e-39404aaa36c6"
|
|
```
|
|
|
|
After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2),
|
|
draft the custody CCR here.
|
|
|
|
## Founder decisions 2026-10-31
|
|
|
|
Approved as `ready`. CCR-2026-0058 amended to a window-scoped role (created per admitted run, deleted after the
|
|
receipt; hub decision c29c6eda) and approved by platform-owner and net-kingdom-owner. T06 is cancelled: the bind
|
|
rotates its own password (hub decision 3d0c8f86), so the executor needs no LLDAP custody lane.
|
|
|
|
## Approve tool refuses the second approval for workload-kv-write-next-version
|
|
|
|
```task
|
|
id: RPF-WP-0069-T07
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "b458e369-73b4-515e-ae01-e8afc0dd35eb"
|
|
```
|
|
|
|
`credential-change.py approve` sets `status: approved` after the first reviewer; for this request type, validation
|
|
then requires every role approval, so the second `approve` is refused before it can record itself (CCR-2026-0058's
|
|
net-kingdom-owner approval was recorded by hand in the tool's format). Make validation accept an `approved` request
|
|
that is still collecting role approvals, or have `approve` set `approved` only once all required roles are present,
|
|
with a test.
|
|
|