8b57d270de
Owner answer for the bounded executor (hub 9d08288d): one Kubernetes role per lane for sso/nk-bind-executor; new contract-only request type for a CAS next-version write (no create, metadata or delete, 15m, agents fenced); CCR-2026-0058 drafted as proposed, not approved; audit sender in the CCR-2026-0021/0022 shape once audit-core admits it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
3 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated | related | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RPF-WP-0069 | workplan | Bounded executor lanes: write-next-version type, journey read and audit sender (NK-WP-0056) | financials | railiance-platform | active | implementation | claude | railiance | 2026-10-31 | 2026-10-31 |
|
RPF-WP-0069 — Bounded executor lanes (NK-WP-0056-T02 owner answer)
Receiving workplan for NetKingdom's owner request (State Hub message
9d08288d-e866-4e1c-9c0b-f1cc0968bd4d; net-kingdom
docs/proposals/2026-10-31-nk56-t02-owner-requests.md). Owner answer:
docs/credential-lane-designs/bounded-executor.md. No live, cluster or OpenBao action is
part of T01; every CCR stays proposed until its approvers act.
Answer the request and add the write-next-version request type
id: RPF-WP-0069-T01
status: done
priority: high
Answer doc written; new contract-only request type workload-kv-write-next-version
(scripts/workload_kv_write_next_version.py, tests/test_workload_kv_write_next_version.py,
dispatch in scripts/credential-change.py); CCR-2026-0058 drafted proposed with policy artifact
openbao/policies/net-kingdom-bind-executor-svc-authelia-write.hcl.
Review CCR-2026-0058 (founder gate)
id: RPF-WP-0069-T02
status: wait
priority: high
needs_human: true
platform-owner and net-kingdom-owner approve or change CCR-2026-0058. The founder chooses
standing or window-scoped write role (recommendation: standing for the pilot). Binding is
confirmed only after sso/nk-bind-executor exists from the reviewed rapp-* package.
Attended setup and verification of CCR-2026-0058
id: RPF-WP-0069-T03
status: wait
priority: high
After T02: an attended platform-admin (aal2) session sets cas_required on the svc-authelia key,
re-checks the coding-agent fence, applies policy and role, and records value-free positive and
negative receipts. This needs an owner setup script modelled on net-kingdom bind-lane.py
setup/verify; write it once approval exists. The founder runs it.
Journey-secret read lane for the executor (NK-WP-0056-T10)
id: RPF-WP-0069-T04
status: wait
priority: medium
Draft a workload-kv-read CCR (native login, data read only, 15m) for
platform/workloads/net-kingdom/synthetic-journey/syn-journey, stating that it widens
CCR-2026-0057's runtime_access: false. Waits for T10 scheduling and the ServiceAccount.
Executor audit-core sender (NK-WP-0040)
id: RPF-WP-0069-T05
status: wait
priority: medium
After audit-core admits the sender and names it, draft a workload-kv-read CCR in the
CCR-2026-0021/0022 shape: custody platform/workloads/net-kingdom/bounded-executor/audit-sender,
ESO into sso/nk-bind-executor-audit, ClusterSecretStore restricted to sso.
LLDAP credential custody for the executor
id: RPF-WP-0069-T06
status: wait
priority: medium
After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2), draft the custody CCR here.