From 76573deea2a747c87f4028f8570bb853e72462ac Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 10:11:22 +0100 Subject: [PATCH] NK-WP-0056-T04: record svc-authelia lane live and verified Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2 --- workplans/NK-WP-0056-bounded-executor-path.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index efc3074..414c819 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -161,6 +161,12 @@ configuration binds `uid=svc-authelia`, and it decodes only the bind key. Authel only, so the identical projection needs no restart; a later rotation does. 12 lane tests. Next: owner approval and binding confirmation, then the founder-run setup, ESO apply, verify and an Authelia restart with a login. +**2026-10-31, `svc-authelia` live and verified:** CCR-2026-0053 approved and binding confirmed; founder-run setup, +ESO apply (Ready first time), verify and Authelia restart passed, and an `admin` portal sign-in with OTP worked +([evidence](../docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md)). Two of four binds are ESO-delivered. +Remaining: `svc-keycape` (bind inside `sso/keycape-config`), `svc-privacyidea` (resolver password stored in the +privacyIDEA database, not a Secret key). + ## Synthetic verification instead of a founder sign-in ```task