331c4af2bf
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
5.1 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated | related | state_hub_workstream_id | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RPF-WP-0069 | workplan | Bounded executor lanes: write-next-version type, journey read and audit sender (NK-WP-0056) | financials | railiance-platform | active | implementation | claude | railiance | 2026-10-31 | 2026-10-31 |
|
6eb39172-babd-57d1-8a3b-f23c41347c22 |
RPF-WP-0069 — Bounded executor lanes (NK-WP-0056-T02 owner answer)
Receiving workplan for NetKingdom's owner request (State Hub message
9d08288d-e866-4e1c-9c0b-f1cc0968bd4d; net-kingdom
docs/proposals/2026-10-31-nk56-t02-owner-requests.md). Owner answer:
docs/credential-lane-designs/bounded-executor.md. No live, cluster or OpenBao action is
part of T01; every CCR stays proposed until its approvers act.
Answer the request and add the write-next-version request type
id: RPF-WP-0069-T01
status: done
priority: high
state_hub_task_id: "27432a77-e111-5aa9-9c23-34fb4c9a2984"
Answer doc written; new contract-only request type workload-kv-write-next-version
(scripts/workload_kv_write_next_version.py, tests/test_workload_kv_write_next_version.py,
dispatch in scripts/credential-change.py); CCR-2026-0058 drafted proposed with policy artifact
openbao/policies/net-kingdom-bind-executor-svc-authelia-write.hcl.
Review CCR-2026-0058 (founder gate)
id: RPF-WP-0069-T02
status: done
priority: high
needs_human: true
decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
blocked_on: human
blocking_reason: "Founder approval of CCR-2026-0058 and choice of standing or window-scoped write role (hub decision c29c6eda)"
state_hub_task_id: "3d4c818e-0c5f-5a14-9735-8056ff9fc7c3"
platform-owner and net-kingdom-owner approve or change CCR-2026-0058. The founder chooses
standing or window-scoped write role (recommendation: standing for the pilot). Binding is
confirmed only after sso/nk-bind-executor exists from the reviewed rapp-* package.
Attended setup and verification of CCR-2026-0058
id: RPF-WP-0069-T03
status: wait
priority: high
depends_on: [RPF-WP-0069-T02]
state_hub_task_id: "6b456804-c408-53bf-8e1d-49723108fca6"
After T02: an attended platform-admin (aal2) session sets cas_required on the svc-authelia key,
re-checks the coding-agent fence, applies policy and role, and records value-free positive and
negative receipts. This needs an owner setup script modelled on net-kingdom bind-lane.py
setup/verify; write it once approval exists. The founder runs it.
Journey-secret read lane for the executor (NK-WP-0056-T10)
id: RPF-WP-0069-T04
status: wait
priority: medium
blocked_on: human
blocking_reason: "Founder accepts widening CCR-2026-0057 runtime_access; scheduled with NK-WP-0056-T10 once sso/nk-bind-executor exists"
state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
Draft a workload-kv-read CCR (native login, data read only, 15m) for
platform/workloads/net-kingdom/synthetic-journey/syn-journey, stating that it widens
CCR-2026-0057's runtime_access: false. Waits for T10 scheduling and the ServiceAccount.
Executor audit-core sender (NK-WP-0040)
id: RPF-WP-0069-T05
status: wait
priority: medium
blocked_on: dependency
blocking_reason: "audit-core admits and names the sender (AUDIT-WP-0018-T02)"
state_hub_task_id: "5c582aef-ee9d-56ab-a4eb-2019933f00ac"
After audit-core admits the sender and names it, draft a workload-kv-read CCR in the
CCR-2026-0021/0022 shape: custody platform/workloads/net-kingdom/bounded-executor/audit-sender,
ESO into sso/nk-bind-executor-audit, ClusterSecretStore restricted to sso.
LLDAP credential custody for the executor
id: RPF-WP-0069-T06
status: cancel
priority: medium
needs_human: true
decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
blocked_on: human
blocking_reason: "Founder chooses bind self-rotation (no account needed) or a lldap_password_manager account"
state_hub_task_id: "1456b467-f7c9-529d-9f3e-39404aaa36c6"
After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2), draft the custody CCR here.
Founder decisions 2026-10-31
Approved as ready. CCR-2026-0058 amended to a window-scoped role (created per admitted run, deleted after the
receipt; hub decision c29c6eda) and approved by platform-owner and net-kingdom-owner. T06 is cancelled: the bind
rotates its own password (hub decision 3d0c8f86), so the executor needs no LLDAP custody lane.
Approve tool refuses the second approval for workload-kv-write-next-version
id: RPF-WP-0069-T07
status: todo
priority: medium
state_hub_task_id: "b458e369-73b4-515e-ae01-e8afc0dd35eb"
credential-change.py approve sets status: approved after the first reviewer; for this request type, validation
then requires every role approval, so the second approve is refused before it can record itself (CCR-2026-0058's
net-kingdom-owner approval was recorded by hand in the tool's format). Make validation accept an approved request
that is still collecting role approvals, or have approve set approved only once all required roles are present,
with a test.