dff35c15d8
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
3.4 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated | related | state_hub_workstream_id | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RPF-WP-0069 | workplan | Bounded executor lanes: write-next-version type, journey read and audit sender (NK-WP-0056) | financials | railiance-platform | active | implementation | claude | railiance | 2026-10-31 | 2026-10-31 |
|
6eb39172-babd-57d1-8a3b-f23c41347c22 |
RPF-WP-0069 — Bounded executor lanes (NK-WP-0056-T02 owner answer)
Receiving workplan for NetKingdom's owner request (State Hub message
9d08288d-e866-4e1c-9c0b-f1cc0968bd4d; net-kingdom
docs/proposals/2026-10-31-nk56-t02-owner-requests.md). Owner answer:
docs/credential-lane-designs/bounded-executor.md. No live, cluster or OpenBao action is
part of T01; every CCR stays proposed until its approvers act.
Answer the request and add the write-next-version request type
id: RPF-WP-0069-T01
status: done
priority: high
state_hub_task_id: "27432a77-e111-5aa9-9c23-34fb4c9a2984"
Answer doc written; new contract-only request type workload-kv-write-next-version
(scripts/workload_kv_write_next_version.py, tests/test_workload_kv_write_next_version.py,
dispatch in scripts/credential-change.py); CCR-2026-0058 drafted proposed with policy artifact
openbao/policies/net-kingdom-bind-executor-svc-authelia-write.hcl.
Review CCR-2026-0058 (founder gate)
id: RPF-WP-0069-T02
status: wait
priority: high
needs_human: true
decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
blocked_on: human
platform-owner and net-kingdom-owner approve or change CCR-2026-0058. The founder chooses
standing or window-scoped write role (recommendation: standing for the pilot). Binding is
confirmed only after sso/nk-bind-executor exists from the reviewed rapp-* package.
Attended setup and verification of CCR-2026-0058
id: RPF-WP-0069-T03
status: wait
priority: high
state_hub_task_id: "6b456804-c408-53bf-8e1d-49723108fca6"
After T02: an attended platform-admin (aal2) session sets cas_required on the svc-authelia key,
re-checks the coding-agent fence, applies policy and role, and records value-free positive and
negative receipts. This needs an owner setup script modelled on net-kingdom bind-lane.py
setup/verify; write it once approval exists. The founder runs it.
Journey-secret read lane for the executor (NK-WP-0056-T10)
id: RPF-WP-0069-T04
status: wait
priority: medium
state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
Draft a workload-kv-read CCR (native login, data read only, 15m) for
platform/workloads/net-kingdom/synthetic-journey/syn-journey, stating that it widens
CCR-2026-0057's runtime_access: false. Waits for T10 scheduling and the ServiceAccount.
Executor audit-core sender (NK-WP-0040)
id: RPF-WP-0069-T05
status: wait
priority: medium
state_hub_task_id: "5c582aef-ee9d-56ab-a4eb-2019933f00ac"
After audit-core admits the sender and names it, draft a workload-kv-read CCR in the
CCR-2026-0021/0022 shape: custody platform/workloads/net-kingdom/bounded-executor/audit-sender,
ESO into sso/nk-bind-executor-audit, ClusterSecretStore restricted to sso.
LLDAP credential custody for the executor
id: RPF-WP-0069-T06
status: wait
priority: medium
state_hub_task_id: "1456b467-f7c9-529d-9f3e-39404aaa36c6"
After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2), draft the custody CCR here.