NK-WP-0056-T04: svc-authelia bind delivered from OpenBao; setup and verify receipts

Founder-run under CCR-2026-0053: setup (custody equal to live, KV v1 CAS=0),
ESO apply, verify and Authelia restart passed; admin signed in with OTP.
Custody copy re-sealed after setup (same recipient, contents unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

docs/evidence/2026-10-31-nk56-svc-authelia-bind/01-setup.json

@@ -0,0 +1,14 @@
+{
+  "action": "setup",
+  "ccr_sha256": "11d0b02cce6f0f645e31c925a4ed9bd8df82441dc927678716c15cd422a0f187",
+  "coding_agents_denied": true,
+  "custody_equals_live": true,
+  "external_secret_apply_and_verify_pending": true,
+  "kv_version": 1,
+  "lane": "svc-authelia",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0053",
+  "source_sha256": "3d15811c1dd3794daecbf44ae5fb2cf6b0b77719b80ba2acb0206ff34a122052",
+  "status": "custody_and_reader_prepared",
+  "values_recorded": false
+}

docs/evidence/2026-10-31-nk56-svc-authelia-bind/02-verify.json

@@ -0,0 +1,18 @@
+{
+  "action": "verify",
+  "ccr_sha256": "11d0b02cce6f0f645e31c925a4ed9bd8df82441dc927678716c15cd422a0f187",
+  "eso_delivery_equality_verified": true,
+  "exact_policy_and_ttl_verified": true,
+  "external_secret_ready": true,
+  "kv_version": 1,
+  "lane": "svc-authelia",
+  "phase": "done",
+  "sibling_metadata_and_token_create_denied": true,
+  "source_ccr": "CCR-2026-0053",
+  "source_sha256": "3d15811c1dd3794daecbf44ae5fb2cf6b0b77719b80ba2acb0206ff34a122052",
+  "status": "reader_and_delivery_verified",
+  "temporary_reader_revoked": true,
+  "values_recorded": false,
+  "wrong_audience_denied": true,
+  "wrong_service_account_denied": true
+}

docs/evidence/2026-10-31-nk56-svc-authelia-bind/README.md

@@ -0,0 +1,19 @@
+# NK-WP-0056-T04 — svc-authelia bind in platform custody (2026-10-31)
+
+Founder-run in the founder's terminal under railiance-platform CCR-2026-0053 (approved by
+platform-owner and net-kingdom-owner, binding confirmed, `bcfbe29`; sha256 `11d0b02c…f187`). Tool:
+`tools/service-binds/bind-lane.py` at `034634a` (source sha256 `3d15811c…`). All receipts are value-free
+(`values_recorded: false`).
+
+| Step | Result | Receipt |
+| --- | --- | --- |
+| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | live `authelia-config` binds `uid=svc-authelia`; custody equal to live `ldap_password`; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` |
+| apply `sso-mfa/k8s/authelia/bind-eso.yaml` | ServiceAccount, SecretStore and ExternalSecret created; ExternalSecret Ready on first apply (the pilot's `template.metadata: {}` fix carried over) | operator output |
+| verify | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, the other directory-bind paths and token create denied; KV equals the delivered `ldap_password`; temporary reader revoked | `02-verify.json` |
+| restart Authelia | rolled out; founder signed in through the portal as `admin` with OTP (Authelia session `admin`, account site `aal2`) | operator output |
+
+`svc-authelia`'s bind password is now delivered from OpenBao
+(`platform/workloads/net-kingdom/directory-binds/svc-authelia`) into the `ldap_password` key only; the
+session, storage and OIDC keys of `authelia-secrets` are untouched. The custody copy still holds the same
+value as a fallback. Rotation: change the password in LLDAP, write the next KV version with CAS, restart
+Authelia (it reads the file only at start-up). Remaining lanes: `svc-keycape`, `svc-privacyidea`.