NK-WP-0056-T04: svc-keycape bind delivered from OpenBao; bindPW cleared from keycape-config

Founder-run under CCR-2026-0054: setup, ESO apply, verify, rollout of KeyCape
main-e2b5fa1 with KEYCAPE_LLDAP_BIND_PW, clear-password, restart, env-only verify;
admin signed in with OTP before and after the clear. Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json

@@ -0,0 +1,14 @@
+{
+  "action": "setup",
+  "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110",
+  "coding_agents_denied": true,
+  "custody_equals_live": true,
+  "external_secret_apply_and_verify_pending": true,
+  "kv_version": 1,
+  "lane": "svc-keycape",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0054",
+  "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5",
+  "status": "custody_and_reader_prepared",
+  "values_recorded": false
+}

docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json

@@ -0,0 +1,18 @@
+{
+  "action": "verify",
+  "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110",
+  "eso_delivery_equality_verified": true,
+  "exact_policy_and_ttl_verified": true,
+  "external_secret_ready": true,
+  "kv_version": 1,
+  "lane": "svc-keycape",
+  "phase": "done",
+  "sibling_metadata_and_token_create_denied": true,
+  "source_ccr": "CCR-2026-0054",
+  "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5",
+  "status": "reader_and_delivery_verified",
+  "temporary_reader_revoked": true,
+  "values_recorded": false,
+  "wrong_audience_denied": true,
+  "wrong_service_account_denied": true
+}

docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json

@@ -0,0 +1 @@
+{"after": {"resource_version": "83122244", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "before": {"resource_version": "82820316", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "change_needed": true, "changed": true, "mode": "apply", "operation": "clear-password", "other_secret_data_unchanged": true, "prior_bind": "service", "restart_required": true, "schema": "netkingdom.keycape-directory-bind.v1", "target": "sso/keycape-config", "task": "NK-WP-0056-T04", "unrelated_config_bytes_preserved": true, "values_emitted": false}

docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json

@@ -0,0 +1,18 @@
+{
+  "action": "verify",
+  "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110",
+  "eso_delivery_equality_verified": true,
+  "exact_policy_and_ttl_verified": true,
+  "external_secret_ready": true,
+  "kv_version": 1,
+  "lane": "svc-keycape",
+  "phase": "done",
+  "sibling_metadata_and_token_create_denied": true,
+  "source_ccr": "CCR-2026-0054",
+  "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5",
+  "status": "reader_and_delivery_verified",
+  "temporary_reader_revoked": true,
+  "values_recorded": false,
+  "wrong_audience_denied": true,
+  "wrong_service_account_denied": true
+}

docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md

@@ -0,0 +1,21 @@
+# NK-WP-0056-T04 — svc-keycape bind in platform custody (2026-10-31)
+
+Founder-run in the founder's terminal under railiance-platform CCR-2026-0054 (approved by
+platform-owner and net-kingdom-owner, binding confirmed, `5d87acd`; sha256 `e255807f…b110`). KeyCape reads
+the bind from `KEYCAPE_LLDAP_BIND_PW` since key-cape `e2b5fa1` (KEY-WP-0046; image `main-e2b5fa1`,
+`sha256:9e082dca…6f8d`). All receipts are value-free.
+
+| Step | Result | Receipt |
+| --- | --- | --- |
+| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | live `keycape-config` binds `uid=svc-keycape`; custody equal to its `bindPW`; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` |
+| apply `sso-mfa/k8s/keycape/bind-eso.yaml` | dedicated Secret `keycape-lldap-bind` created by ESO (`creationPolicy: Owner`), Ready | operator output |
+| verify (env and config) | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, other bind paths and token create denied; KV equals the delivered Secret and the config `bindPW` | `02-verify-env-and-config.json` |
+| apply `deployment.yaml` (image `main-e2b5fa1` + `KEYCAPE_LLDAP_BIND_PW`) | server dry-run, apply, rolled out; log reports `bindPW` redundant once (both sources equal); `admin` portal sign-in with OTP (aal2) | operator output |
+| `directory-bind-rollout.py clear-password` (dry-run, attended apply on uid/resourceVersion) | `bindPW` emptied; bind stays `svc-keycape`; unrelated config bytes and other Secret data unchanged | `03-clear-password.json` |
+| restart KeyCape, verify (env only) | rolled out; no redundancy warning; KV equals the delivered Secret; `admin` portal sign-in with OTP (aal2) | `04-verify-env-only.json` |
+
+`svc-keycape`'s bind password now lives only in OpenBao
+(`platform/workloads/net-kingdom/directory-binds/svc-keycape`), the ESO Secret and the founder's custody copy
+(fallback); `keycape-config` no longer holds it. Rotation: change the password in LLDAP, write the next KV
+version with CAS, restart KeyCape. Rollback: `directory-bind-rollout.py --operation switch` restores
+`bindPW` from custody; the previous image is `sha256:cdec9dd7…f010` (then remove the env).

workplans/NK-WP-0056-bounded-executor-path.md

@@ -193,6 +193,13 @@ verify reads the dedicated Secret and requires it to equal `bindPW` while presen
 `deployment.yaml` pinned to the new image with the `KEYCAPE_LLDAP_BIND_PW` env. The new image also carries
 key-cape 67a0869..e2c5a94 (online token status, inactive while `tokenStatus` is unset) and identity-facts.
 Founder order: approve, setup, ESO apply, verify, deployment apply (image + env), login, clear-password, restart, login.
+
+**2026-10-31, `svc-keycape` live and verified:** CCR-2026-0054 approved and binding confirmed; founder-run setup, ESO
+apply, verify, deployment rollout (image `main-e2b5fa1` + env; both sources equal), `admin` login, `clear-password`,
+restart, env-only verify and a second `admin` login all passed
+([evidence](../docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md)). Three of four binds are ESO-delivered;
+`keycape-config` no longer holds the bind password. Remaining: `svc-privacyidea` (resolver password stored in the
+privacyIDEA database, not a Secret key: needs its own design).
    the env.
 
 ## Synthetic verification instead of a founder sign-in