Close SI-X4: OpenBao platform-admin binds aal2 (founder-applied, RPF-WP-0065-T04)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354

canon/standards/service-identity-privilege_v0.1.md

@@ -278,10 +278,13 @@ DSM-EXC-001 binds violations of a canon MUST; an exception against a rule that i
 | --- | --- | --- | --- | --- |
 | SI-X1 | SI-1, SI-2, SI-3, SI-4, SI-9, naming | LLDAP `admin` | The human, the super-admin and the shared bind of four services in one account; password in a person's safe and a Kubernetes Secret | NK-WP-0054-T05: `svc-*` binds, provisioner account, `ld-admin`, `admin` human-only |
 | SI-X2 | SI-10 | LDAP bind accounts | Static long-lived credential; LDAP has no lease | Governed residual secret (DSM-TRANS-002) until a federated directory lookup exists |
-| SI-X3 | naming, SI-11 | `trigger-admin` (privacyIDEA) | Legacy account, consumers uninventoried | NK-WP-0049-T22 disposition |
-| SI-X4 | SI-8 | OpenBao `netkingdom-platform-admin` | Role binds the group claim only | railiance-platform binds `aal2` (decided 2026-10-24); prepared in source as RPF-WP-0065, applied by a founder-run live step |
+| SI-X3 | naming, SI-11 | `trigger-admin` (privacyIDEA) | Legacy account, consumers uninventoried | NK-WP-0049-T22 deleted the unreferenced Kubernetes copy (2026-10-27); revoking the privacyIDEA account stays under CUST-WP-0073-T05 / NK-WP-0055-T06 |
 | SI-X5 | SI-4, SI-5 | privacyIDEA | Only a local administrator is supported | Upstream support for attributed administrators |
 
+**Closed:** SI-X4 (OpenBao `netkingdom-platform-admin` bound the group claim only) closed 2026-10-27: the founder applied the
+`aal2` binding (RPF-WP-0065-T04; receipts show `bound_claims` = `net-kingdom-admins` plus `/assurance/level: aal2`, and a
+fresh MFA login verified).
+
 **Findings at adoption, not excepted:** F-1, the OpenBao coding-agent role binds `principal_type: service`, so the
 agent presents as a service against IAM Profile v0.3 (SI-14). railiance-platform has prepared, in source only,
 a transitional role that accepts both `service` and `agent`, plus an exception record with compensating controls,

docs/evidence/2026-10-27-production-readiness-ledger.md

@@ -16,7 +16,7 @@ Builder-mode acceptances count as **partial**. The definition is in
 | # | Area | Status | Gap carried by |
 |---|---|---|---|
 | 1 | Platform root custody | partial (single-holder custody: accepted exception) | T13, NK-WP-0054-T07 |
-| 2 | MFA and identity | partial | RPF-WP-0065-T04 (SI-X4), NK-WP-0054-T04/T05/T06, T12 |
+| 2 | MFA and identity | partial (SI-X4 closed 2026-10-27) | NK-WP-0054-T04/T05/T06, T12 |
 | 3 | Bootstrap and recovery | partial | T02–T04, T07 (NK-WP-0053), T08 |
 | 4 | OpenBao runtime secrets | partial (manual Shamir unseal approved) | T07 (RPF-WP-0036-T03), T12 |
 | 5 | Secret rotation | partial | T06, T15, RPF-WP-0035, RPF-WP-0055-T01 |
@@ -64,8 +64,8 @@ Each exception is reviewed at the production declaration (T09).
 - The retained-MFA restore is proven (NK-WP-0049-T19).
 
 **Missing.**
-- The `aal2` binding on OpenBao `platform-admin` is not applied. SI-X4 is still open in
-  `tools/service-identity/declarations/openbao.yaml` and RPF-WP-0065-T04 is waiting.
+- ~~The `aal2` binding on OpenBao `platform-admin` is not applied.~~ Applied and verified by the founder on
+  2026-10-27 (RPF-WP-0065-T04); SI-X4 is closed and the account checks conformant.
 - No recorded `tools/iam-profile-conformance/` run against the live issuer (NK-WP-0054-T04
   is waiting).
 - The bind account is still the human `admin` (NK-WP-0054-T05/T06).

tools/service-identity/declarations/openbao.yaml

@@ -13,7 +13,7 @@ identities:
     federated_role: true
     purpose: "OIDC role: group net-kingdom-admins receives policies platform-admin and operator-custody, one-hour token"
     grants: [{mode: ADMINISTER, scope: openbao, activation: STANDING, environments: [PRODUCTION]}]
-    assurance_claim_bound: false
+    assurance_claim_bound: true
     interactive_login: true
     second_factor: required
     custody: [none]
@@ -73,12 +73,4 @@ identities:
     owner: "railiance-platform"
     rotation: {path: "Federated for the JWT role; AppRole secret rotation owned by railiance-platform", coupling: []}
     status: active
-exceptions:
-  - id: SI-X4
-    rules: [SI-8]
-    identity: netkingdom-platform-admin
-    reason: "The role file binds on the group claim only; the aal2 claim is not bound while two sibling roles bind it"
-    owner: "railiance-platform and founder"
-    expires: 2027-01-31
-    compensating_control: "KeyCape requires a second factor for every login (requireForAll)"
-    elimination_path: "railiance-platform binds aal2 in the role (decided 2026-10-24)"
+exceptions: []