NK-WP-0056 finished: live pilot BEA-2026-0003 completed (T06), receipt in posture feedback (T07)

The executor rotated svc-authelia's bind in production under one admission in 30.5 s with every check passing; the founder's only act was the approval (admin, aal2). Records the overnight write-role window (closed late, no run used it) and its remedy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
2026-11-05 09:46:37 +01:00 · 2026-11-05 09:46:37 +01:00 · 7f3bd6eae8
commit 7f3bd6eae8
parent 216a5db55c
10 changed files with 376 additions and 8 deletions
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@ -53,7 +53,7 @@
 | workplan | NK-WP-0053 | finished | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
 | workplan | NK-WP-0054 | active | — | workplans/NK-WP-0054-service-identity-policy.md |
 | workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
-| workplan | NK-WP-0056 | proposed | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| workplan | NK-WP-0056 | finished | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
 | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
@ -349,8 +349,8 @@
 | task | NK-WP-0056-T03 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T04 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T05 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
-| task | NK-WP-0056-T06 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
-| task | NK-WP-0056-T07 | wait | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T06 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T07 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T08 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T09 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T10 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
--- a/docs/evidence/2026-11-04-nk56-t06-pilot/09-window-close-late.json
+++ b/docs/evidence/2026-11-04-nk56-t06-pilot/09-window-close-late.json
@ -0,0 +1,10 @@
+{
+  "action": "window-close",
+  "admission": "BEA-2026-0002",
+  "phase": "done",
+  "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828",
+  "status": "window_closed",
+  "values_recorded": false,
+  "write_role_absent": true,
+  "write_role_was_present": true
+}
--- a/docs/evidence/2026-11-05-nk56-t06-pilot/01-window-open.json
+++ b/docs/evidence/2026-11-05-nk56-t06-pilot/01-window-open.json
@ -0,0 +1,14 @@
+{
+  "action": "window-open",
+  "admission": "BEA-2026-0003",
+  "admission_digest": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721",
+  "phase": "preconditions",
+  "reason": "write_role_already_open",
+  "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828",
+  "status": "failed",
+  "values_recorded": false,
+  "window": {
+    "not_after": "2026-11-05T10:20:00Z",
+    "not_before": "2026-11-05T08:20:00Z"
+  }
+}
--- a/docs/evidence/2026-11-05-nk56-t06-pilot/02-window-open.json
+++ b/docs/evidence/2026-11-05-nk56-t06-pilot/02-window-open.json
@ -0,0 +1,24 @@
+{
+  "action": "window-open",
+  "admission": "BEA-2026-0003",
+  "admission_digest": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721",
+  "ccr_sha256": {
+    "journey": "4c956f58248e12c631d3990aee0d287f2e11be72f7c6023bfa02d049d2143a98",
+    "write": "f4d75c3e1b931d07a094e07c1d77e328b040ffcf08a30e41e5681c093498917b"
+  },
+  "close_by": "2026-11-05T10:20:00Z",
+  "exact_role": true,
+  "phase": "done",
+  "source_ccrs": {
+    "journey": "CCR-2026-0059",
+    "write": "CCR-2026-0058"
+  },
+  "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828",
+  "status": "window_opened",
+  "values_recorded": false,
+  "window": {
+    "not_after": "2026-11-05T10:20:00Z",
+    "not_before": "2026-11-05T08:20:00Z"
+  },
+  "write_role_created": true
+}
--- a/docs/evidence/2026-11-05-nk56-t06-pilot/03-result.json
+++ b/docs/evidence/2026-11-05-nk56-t06-pilot/03-result.json
@ -0,0 +1,121 @@
+{
+  "outcome": "completed",
+  "receipt": {
+    "correlation_id": "eae561c3-9a1d-4068-93fa-167a023ae127",
+    "data": {
+      "action": "bounded-execution",
+      "artifact_digest": "sha256:4c44e122804cb25252785e961818c485101f3ec4083bef25f2bee8d4f71a5678",
+      "attempts": 1,
+      "budget": {
+        "limit": {
+          "attempts": 2,
+          "wall_time_seconds": 1200
+        },
+        "used": {
+          "attempts": 1,
+          "wall_time_seconds": 30.513
+        }
+      },
+      "decision_refs": [
+        {
+          "label": "admission",
+          "ref": "BEA-2026-0003"
+        },
+        {
+          "label": "admission_digest",
+          "ref": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721"
+        },
+        {
+          "label": "approval",
+          "ref": "5c91717a-cfa7-478b-978e-51560cd595b9"
+        }
+      ],
+      "environment": "PRODUCTION",
+      "executing_workload": "service:nk-bind-executor",
+      "initiator": {
+        "iss": "https://kc.coulomb.social",
+        "role": "approver",
+        "sub": "uid=admin,ou=people,dc=netkingdom,dc=local"
+      },
+      "outcome": "completed",
+      "pdp": "not-evaluated",
+      "receipt_version": "0.1",
+      "reverted": false,
+      "run_id": "eae561c3-9a1d-4068-93fa-167a023ae127",
+      "runtime_principal": "system:serviceaccount:sso:nk-bind-executor",
+      "source_commit": "c2a0f2f4e049",
+      "steps": [
+        {
+          "checks": [
+            {
+              "id": "kv-advanced",
+              "result": "pass"
+            }
+          ],
+          "consumer": "authelia",
+          "id": "generate",
+          "kind": "step",
+          "operation": "openbao.kv.write-next-version",
+          "outcome": "done",
+          "target": "openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia"
+        },
+        {
+          "checks": [
+            {
+              "id": "bind-signs-in",
+              "result": "pass"
+            }
+          ],
+          "consumer": "authelia",
+          "id": "set-directory",
+          "kind": "step",
+          "operation": "lldap.user.change-own-password-from-kv",
+          "outcome": "done",
+          "target": "lldap:svc-authelia"
+        },
+        {
+          "checks": [
+            {
+              "id": "eso-synced",
+              "result": "pass"
+            }
+          ],
+          "consumer": "authelia",
+          "id": "deliver",
+          "kind": "step",
+          "operation": "eso.force-sync",
+          "outcome": "done",
+          "target": "k8s:sso/externalsecret/authelia-secrets"
+        },
+        {
+          "checks": [
+            {
+              "id": "synthetic-journey",
+              "result": "pass"
+            }
+          ],
+          "consumer": "authelia",
+          "id": "restart",
+          "kind": "step",
+          "operation": "k8s.rollout-restart",
+          "outcome": "done",
+          "target": "k8s:sso/deployment/authelia"
+        }
+      ],
+      "target": "admission:BEA-2026-0003",
+      "tenant": "platform",
+      "time_interval": {
+        "clock_source": "system-utc",
+        "end": "2026-11-05T08:30:42Z",
+        "start": "2026-11-05T08:30:11Z"
+      }
+    },
+    "id": "run:eae561c3-9a1d-4068-93fa-167a023ae127:receipt",
+    "occurred_at": "2026-11-05T08:30:42+00:00",
+    "source": "net-kingdom.bounded-executor",
+    "subject": "admission:BEA-2026-0003",
+    "tenant": "platform",
+    "type": "execution.attribution.receipt"
+  },
+  "run_id": "eae561c3-9a1d-4068-93fa-167a023ae127"
+}
--- a/docs/evidence/2026-11-05-nk56-t06-pilot/04-window-close.json
+++ b/docs/evidence/2026-11-05-nk56-t06-pilot/04-window-close.json
@ -0,0 +1,10 @@
+{
+  "action": "window-close",
+  "admission": "BEA-2026-0003",
+  "phase": "done",
+  "source_sha256": "9cbd76d6999b765bacf111a1318860403b242fbf52f5aa4a4ead82d031376828",
+  "status": "window_closed",
+  "values_recorded": false,
+  "write_role_absent": true,
+  "write_role_was_present": true
+}
--- a/docs/evidence/2026-11-05-nk56-t06-pilot/README.md
+++ b/docs/evidence/2026-11-05-nk56-t06-pilot/README.md
@ -0,0 +1,35 @@
+# NK-WP-0056-T06: live pilot, unattended bind rotation under one admission (2026-11-05)
+
+**Completed.** The bounded executor rotated `svc-authelia`'s LLDAP bind in production under admission
+`BEA-2026-0003`. The founder's only act in the run was the approval: `admin`, aal2 with OTP, in informed-decision.
+
+| Item | Value |
+| --- | --- |
+| Admission | `admissions/BEA-2026-0003.yaml`, digest `sha256:917ad448…1721`, window 08:20Z–10:20Z, pins at `c2a0f2f` |
+| Image | `sha256:5f5df866…8a92` (rapp `3ecd462`) |
+| Approval | `5c91717a-cfa7-478b-978e-51560cd595b9`, filed by `service:nk-bind-executor` with its own KeyCape client, presented as memo `bea-2026-0003-5c91717a`, approved by `uid=admin,ou=people,dc=netkingdom,dc=local` |
+| Write-role window | opened `02-window-open.json`, closed `04-window-close.json` (`write_role_was_present: true`, now absent). `01` is a refused open: the role was still present from the night before (see below) |
+| Run `eae561c3-9a1d-4068-93fa-167a023ae127` | `completed`; 08:30:11Z–08:30:42Z (30.5 s of 1200 s); 1 of 2 attempts; no revert |
+| Steps (each with its check) | `generate` (`kv-advanced` pass), `set-directory` (`bind-signs-in` pass), `deliver` (`eso-synced` pass), `restart` (`synthetic-journey` pass at aal2) |
+| Custody | started event and receipt accepted by audit-core: the run reports neither `audit_unavailable` nor `receipt_not_in_custody` |
+| Receipt | [`receipt-event.json`](receipt-event.json): valid against schema v0.1 (EAR-1..9). `initiator.iss` is `https://kc.coulomb.social`, `initiator.sub` is admin |
+| Posture feedback (T07) | [`posture-feedback-report.json`](posture-feedback-report.json): the receipt read through section 4a, `ok`, no findings (a clean run raises none) |
+| Values | none in any file: the result names operations, outcomes and check results only |
+
+## Incident: write role open overnight
+
+The last diagnostic of the first attempt opened BEA-2026-0002's window at about 23:20Z
+(`2026-11-04-nk56-t06-pilot/07-window-open-diag.json`). The final close never ran, so the role stayed until
+08:24Z, when `09-window-close-late.json` closed it.
+
+- **Exposure:** only `sso/nk-bind-executor` (audience `openbao`) could log in, with tokens of at most 15 minutes,
+  and no executor Job or diagnostic ran in that time.
+- **Remedy:** `sso-mfa/k8s/bounded-executor/pilot-run.sh` now opens the window, runs, and closes it from an EXIT trap,
+  so a failed or interrupted run never leaves it open (`e181fb0`, wait fixed in `216a5db`).
+- **Not yet done:** confirming "no login" from OpenBao's audit log. That would need the audit device and a reviewed
+  read, and it remains open.
+
+## Still open for oidc-service-client
+
+`excess-scope-refused` (KeyCape answers `invalid_profile_usage` to a scope outside the list) is proven against the
+pinned KeyCape image in T19, not yet against live KeyCape. The case stays `materialized` until that live check.
--- a/docs/evidence/2026-11-05-nk56-t06-pilot/posture-feedback-report.json
+++ b/docs/evidence/2026-11-05-nk56-t06-pilot/posture-feedback-report.json
@ -0,0 +1,24 @@
+{
+  "apiVersion": "netkingdom.io/posture-feedback/v0.1",
+  "as_of": "2026-11-05T09:00:00Z",
+  "automation": {
+    "declaration_mutation_permitted": false,
+    "external_write_permitted": false,
+    "mode": "proposal-only",
+    "policy_mutation_permitted": false
+  },
+  "fail_on": "none",
+  "findings": [],
+  "horizon_days": 30,
+  "kind": "PostureFeedbackReport",
+  "ok": true,
+  "report_digest": "sha256:344b24f18d3a5fafe547ed1dc9dca6e0fe73d441842b1ede9d8345a02d83e558",
+  "summary": {
+    "high": 0,
+    "low": 0,
+    "medium": 0,
+    "total": 0,
+    "unknown_owner": 0
+  },
+  "validation_errors": []
+}
--- a/docs/evidence/2026-11-05-nk56-t06-pilot/receipt-event.json
+++ b/docs/evidence/2026-11-05-nk56-t06-pilot/receipt-event.json
@ -0,0 +1,117 @@
+{
+  "correlation_id": "eae561c3-9a1d-4068-93fa-167a023ae127",
+  "data": {
+    "action": "bounded-execution",
+    "artifact_digest": "sha256:4c44e122804cb25252785e961818c485101f3ec4083bef25f2bee8d4f71a5678",
+    "attempts": 1,
+    "budget": {
+      "limit": {
+        "attempts": 2,
+        "wall_time_seconds": 1200
+      },
+      "used": {
+        "attempts": 1,
+        "wall_time_seconds": 30.513
+      }
+    },
+    "decision_refs": [
+      {
+        "label": "admission",
+        "ref": "BEA-2026-0003"
+      },
+      {
+        "label": "admission_digest",
+        "ref": "sha256:917ad4484a15605234086c9125e9048db18f2b633d28fd814cec454bac061721"
+      },
+      {
+        "label": "approval",
+        "ref": "5c91717a-cfa7-478b-978e-51560cd595b9"
+      }
+    ],
+    "environment": "PRODUCTION",
+    "executing_workload": "service:nk-bind-executor",
+    "initiator": {
+      "iss": "https://kc.coulomb.social",
+      "role": "approver",
+      "sub": "uid=admin,ou=people,dc=netkingdom,dc=local"
+    },
+    "outcome": "completed",
+    "pdp": "not-evaluated",
+    "receipt_version": "0.1",
+    "reverted": false,
+    "run_id": "eae561c3-9a1d-4068-93fa-167a023ae127",
+    "runtime_principal": "system:serviceaccount:sso:nk-bind-executor",
+    "source_commit": "c2a0f2f4e049",
+    "steps": [
+      {
+        "checks": [
+          {
+            "id": "kv-advanced",
+            "result": "pass"
+          }
+        ],
+        "consumer": "authelia",
+        "id": "generate",
+        "kind": "step",
+        "operation": "openbao.kv.write-next-version",
+        "outcome": "done",
+        "target": "openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia"
+      },
+      {
+        "checks": [
+          {
+            "id": "bind-signs-in",
+            "result": "pass"
+          }
+        ],
+        "consumer": "authelia",
+        "id": "set-directory",
+        "kind": "step",
+        "operation": "lldap.user.change-own-password-from-kv",
+        "outcome": "done",
+        "target": "lldap:svc-authelia"
+      },
+      {
+        "checks": [
+          {
+            "id": "eso-synced",
+            "result": "pass"
+          }
+        ],
+        "consumer": "authelia",
+        "id": "deliver",
+        "kind": "step",
+        "operation": "eso.force-sync",
+        "outcome": "done",
+        "target": "k8s:sso/externalsecret/authelia-secrets"
+      },
+      {
+        "checks": [
+          {
+            "id": "synthetic-journey",
+            "result": "pass"
+          }
+        ],
+        "consumer": "authelia",
+        "id": "restart",
+        "kind": "step",
+        "operation": "k8s.rollout-restart",
+        "outcome": "done",
+        "target": "k8s:sso/deployment/authelia"
+      }
+    ],
+    "target": "admission:BEA-2026-0003",
+    "tenant": "platform",
+    "time_interval": {
+      "clock_source": "system-utc",
+      "end": "2026-11-05T08:30:42Z",
+      "start": "2026-11-05T08:30:11Z"
+    }
+  },
+  "id": "run:eae561c3-9a1d-4068-93fa-167a023ae127:receipt",
+  "occurred_at": "2026-11-05T08:30:42+00:00",
+  "source": "net-kingdom.bounded-executor",
+  "subject": "admission:BEA-2026-0003",
+  "tenant": "platform",
+  "type": "execution.attribution.receipt"
+}
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@ -4,12 +4,12 @@ type: workplan
 title: "Bounded executor path: founder admits, executors run"
 domain: infotech
 repo: net-kingdom
-status: proposed
+status: finished
 flavor: design
 owner: claude
 topic_slug: netkingdom
 created: "2026-10-30"
-updated: "2026-11-04"
+updated: "2026-11-05"
 related:
  - NK-WP-0054
  - NK-WP-0040
@ -1061,7 +1061,7 @@ Live (founder-run, after the owners' releases):

 ```task
 id: NK-WP-0056-T06
-status: todo
+status: done
 priority: high
 assignee: claude-code
 needs_human: true
@ -1112,14 +1112,24 @@ LDAP DN (KeyCape `sub`).
  - a new admission, BEA-2026-0003, with pins at `c2a0f2f`;
  - request, then approve as `admin`, then the run.

+**Done 2026-11-05** ([evidence](../docs/evidence/2026-11-05-nk56-t06-pilot/README.md)). BEA-2026-0003 completed in
+30.5 s, with no revert:
+
+- KV advanced; LLDAP self-rotation; ESO synced; Authelia restarted; the synthetic journey passed.
+- The receipt is valid (schema v0.1), and audit-core holds the started event and the receipt.
+- The founder's only act was the approval, as `admin` at aal2.
+- The interim routing `net-kingdom-admins` → `admin` is in informed-decision (`77161fe`; Argo pinned in
+  railiance-platform `31cf74d`).
+- The write role stayed open overnight after the diagnostics, without use. `pilot-run.sh` now always closes the
+  window.
+
 ## Budget and risk enforcement

 ```task
 id: NK-WP-0056-T07
-status: wait
+status: done
 priority: medium
 assignee: claude-code
-blocked_on: dependency
 depends_on: [NK-WP-0056-T06]
 state_hub_task_id: "a87c5edb-7604-5eba-9261-b1ed2ed16655"
 ```
@ -1143,3 +1153,6 @@ pilot's receipts appear in a posture-feedback report.
  validator. Findings: receipt-missing, not-completed, reverted and budget-pressure, plus the aggregate
  `execution-recurring-revert`. Owners come from `tools/posture-feedback/execution-owners.yaml`, never inferred.
 - **Left:** run the report over the pilot's receipts after T06.
+
+**Done 2026-11-05.** The pilot's receipt appears in a posture-feedback report
+(`docs/evidence/2026-11-05-nk56-t06-pilot/posture-feedback-report.json`): validated, `ok`, no findings.