NK-WP-0056-T04: svc-provisioner bind delivered from OpenBao; setup and verify receipts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e

docs/evidence/2026-10-30-nk56-svc-provisioner-bind/01-setup.json

@@ -0,0 +1,14 @@
+{
+  "action": "setup",
+  "ccr_sha256": "582bc1f419b6a50ac13dcaf16f54a02199d125659ac5ed7b7acc54590b88d8d4",
+  "coding_agents_denied": true,
+  "custody_equals_live": true,
+  "external_secret_apply_and_verify_pending": true,
+  "kv_version": 1,
+  "lane": "svc-provisioner",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0052",
+  "source_sha256": "b6b4c4ad4c8f9aa6d58e281c966e36926511d1dde8e33f03565d89d251bebee6",
+  "status": "custody_and_reader_prepared",
+  "values_recorded": false
+}

docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02a-verify-before-template-fix.json

@@ -0,0 +1,9 @@
+{
+  "action": "verify",
+  "lane": "svc-provisioner",
+  "phase": "external_secret_ready",
+  "reason": "external_secret_not_ready",
+  "source_sha256": "b6b4c4ad4c8f9aa6d58e281c966e36926511d1dde8e33f03565d89d251bebee6",
+  "status": "failed",
+  "values_recorded": false
+}

docs/evidence/2026-10-30-nk56-svc-provisioner-bind/02b-verify.json

@@ -0,0 +1,18 @@
+{
+  "action": "verify",
+  "ccr_sha256": "582bc1f419b6a50ac13dcaf16f54a02199d125659ac5ed7b7acc54590b88d8d4",
+  "eso_delivery_equality_verified": true,
+  "exact_policy_and_ttl_verified": true,
+  "external_secret_ready": true,
+  "kv_version": 1,
+  "lane": "svc-provisioner",
+  "phase": "done",
+  "sibling_metadata_and_token_create_denied": true,
+  "source_ccr": "CCR-2026-0052",
+  "source_sha256": "b6b4c4ad4c8f9aa6d58e281c966e36926511d1dde8e33f03565d89d251bebee6",
+  "status": "reader_and_delivery_verified",
+  "temporary_reader_revoked": true,
+  "values_recorded": false,
+  "wrong_audience_denied": true,
+  "wrong_service_account_denied": true
+}

docs/evidence/2026-10-30-nk56-svc-provisioner-bind/README.md

@@ -0,0 +1,19 @@
+# NK-WP-0056-T04 pilot — svc-provisioner bind in platform custody (2026-10-30)
+
+Founder-run in the founder's terminal under railiance-platform CCR-2026-0052 (approved by
+platform-owner and net-kingdom-owner, binding confirmed; sha256 `582bc1f4…d8d4`). All receipts are
+value-free (`values_recorded: false`).
+
+| Step | Result | Receipt |
+| --- | --- | --- |
+| setup (attended platform-admin, custody decrypted, re-sealed after) | custody equal to live; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` |
+| apply `sso-mfa/k8s/identity-provisioner/bind-eso.yaml` (first) | SecretStore valid; ExternalSecret refused by `reject-secret-last-applied`: ESO copied the ExternalSecret's kubectl last-applied annotation onto the Secret. The Secret was not changed | operator output |
+| verify (first) | refused at `external_secret_ready` | `02a-verify-before-template-fix.json` |
+| manifest fix `985cfc3` (`target.template.metadata: {}`), re-apply | ExternalSecret Ready | operator output |
+| verify | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, other directory-bind paths and token create denied; KV equals the delivered Secret; temporary reader revoked | `02b-verify.json` |
+| restart identity-provisioner | rolled out Ready (readiness includes the directory login) | operator output |
+
+`svc-provisioner`'s bind password is now delivered from OpenBao
+(`platform/workloads/net-kingdom/directory-binds/svc-provisioner`); the custody copy still holds the same
+value as a fallback. A rotation is now: change the password in LLDAP, write the next KV version — no
+custody decryption needed for delivery.