the-custodian/docs/evidence/2026-10-20-gated-executor-acceptance.md

gated-executor acceptance on railiance01 — 2026-10-20 (attended, CUST-WP-0073-T02 / GEXEC-WP-0001-T06)

Supervisor: Bernd Worsch (present, approved in own terminal).

• Install: source 2ee809d7d84d9ac195562f7da243a1809d4ed255 (git archive) → deploy/install.sh --i-am-attended --supervisor-user tegwick, approver public key SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM (passphrase-protected, founder workstation). Config trimmed to target kube:railiance01 / profile kube-admin. Credential /etc/gexec/targets/railiance01-admin.kubeconfig root:gexec 0640, placed by the founder (! command).
• Layout verified: /etc/gexec root:gexec 0750; config/signers 0640; /var/lib/gexec gexec 0700; receipts chattr +a; requests gexec:custodian-agt 1730; results 2750; exchange root:gexec-review 3770; gexec.path enabled+active. custodian-agt groups: custodian-agt, gexec-review.
• Agent-side (via custodian-agents → certificate login): config, signers, credential, receipts → denied; requests not listable; /opt/gexec not writable.
• Proposals: accept-1 (cwd /home/custodian-agt, digest sha256:1e359e60…, never approved — ProtectHome would block that cwd) and accept-2 (cwd /, kubectl get namespaces --no-headers -o name, sha256:31641635…), approved by the founder, TTL 900 s.
• Results:

  request	outcome
  ok-1 (accept-2 + its approval)	executed, exit 0, namespace list returned
  wrong-proposal-1 (accept-1 + accept-2 approval)	refused digest_mismatch
  replay-1 (accept-2 again)	refused nonce_replayed
  tampered-1 (accept-2 with argv changed to get pods -A)	refused digest_mismatch (sha256:9902df73…)

• Receipts: four JSON lines, one per request. Line 5 is a stray x appended by the supervising Claude session while testing truncation (tee -a is permitted under chattr +a; truncation was refused as expected). gexec only appends and never parses the file; the line is left in place rather than lifting the append-only attribute. Receipt consumers must skip non-JSON lines.
• Cosmetic: k3s kubectl warns open /etc/rancher/k3s/config.yaml: permission denied under gexec (file is root 0600 since RCLUSTER-WP-0019). Harmless; it could be silenced by pointing the profile at a standalone kubectl.
• Follow-up: RAIL-HO-WP-0014's goss spec asserts custodian-agt's exact group set; it must now allow gexec-review.