NK-WP-0056-T04 done: svc-privacyidea written through from OpenBao; all four binds in platform custody

Founder-run under CCR-2026-0055: setup, verify and realm_bootstrap.py
--rotate-bind --from-openbao with the admin MFA proof. The first apply's check
got a code that was not admin's, so both MFA prompts now name the user.
Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

WORK-RECORDS.md

@@ -338,7 +338,7 @@
 | task | NK-WP-0056-T01 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T02 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T03 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
-| task | NK-WP-0056-T04 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T04 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T05 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T06 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T07 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/01-setup.json

@@ -0,0 +1,14 @@
+{
+  "action": "setup",
+  "ccr_sha256": "97e8e4b17e12d6bcbffe5acd4f8fbd68f52fe340333968bb175e8da18ecb6513",
+  "coding_agents_denied": true,
+  "custody_is_current": true,
+  "kv_version": 1,
+  "lane": "svc-privacyidea",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0055",
+  "source_sha256": "5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0",
+  "status": "custody_prepared",
+  "values_recorded": false,
+  "workload_access": false
+}

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/02-verify.json

@@ -0,0 +1,14 @@
+{
+  "action": "verify",
+  "ccr_sha256": "97e8e4b17e12d6bcbffe5acd4f8fbd68f52fe340333968bb175e8da18ecb6513",
+  "coding_agents_denied": true,
+  "kv_is_current": true,
+  "kv_version": 1,
+  "lane": "svc-privacyidea",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0055",
+  "source_sha256": "5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0",
+  "status": "custody_verified",
+  "values_recorded": false,
+  "workload_access": false
+}

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/03-rotate-bind.json

@@ -0,0 +1 @@
+{"actions": ["rotate-bind"], "configuration_writes": 1, "mfa_verified": true, "onboarding_policy": "owner-managed", "policies_changed": false, "result": "configured"}

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md

@@ -0,0 +1,19 @@
+# NK-WP-0056-T04 — svc-privacyidea bind in platform custody (2026-10-31)
+
+Founder-run in the founder's terminal under railiance-platform CCR-2026-0055 (request type
+`attended-service-credential-delivery`, approved by platform-owner and net-kingdom-owner, `04d9dc8`; sha256
+`97e8e4b1…6513`). privacyIDEA keeps the resolver `BINDPW` encrypted in its own database and accepts it only through
+the `pi-admin` API, so there is no ESO or workload reader: the value is held in OpenBao and written through by an
+attended procedure. Receipts are value-free.
+
+| Step | Result | Receipt |
+| --- | --- | --- |
+| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | custody value signs in to LLDAP as `svc-privacyidea` (current); coding agents fenced; KV version 1 (CAS=0); no policy or role | `01-setup.json` |
+| verify | KV value signs in to LLDAP as `svc-privacyidea`; fence present; no workload role | `02-verify.json` |
+| `realm_bootstrap.py --attended --rotate-bind --from-openbao` (preview) | `actions: ["rotate-bind"]`, no write | operator output |
+| apply, attempt 1 (not counted) | one `BINDPW` write (same value), then the `--verify-user admin` check failed: the code entered was not `admin`'s (the prompt did not name the account; prompts now name the user) | operator output |
+| apply, attempt 2 | one `BINDPW` write (same value from OpenBao); `admin` resolved through `lldap-coulomb` and passed token-backed MFA | `03-rotate-bind.json` |
+
+The resolver bind is now written from OpenBao (`platform/workloads/net-kingdom/directory-binds/svc-privacyidea`); the
+founder's custody copy holds the same value as a fallback. Rotation: change the password in LLDAP, write the next KV
+version with CAS, run `realm_bootstrap.py --attended --rotate-bind --from-openbao --apply --verify-user admin`.

sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age

@@ -1,6 +1,6 @@
 age-encryption.org/v1
--> X25519 un+UWbG5oXAsm5dXauwEzU41cpG5+blwU2gbAkEmVXw
-j7kyOG6iU3FlO8Vcc0p8LklEjMlPw5kC8GP9g3mffx0
---- JmF8vLxSsPTLu5qhvDscgD2EwKpppCW+ELfpdjFsdvg
-#ƒòâ•Š<E280A2>\]÷ R»kHG0É[O
à7°‹3QšU0t¢ ŒŠ6¸áÄ2Ÿ¼Ê4‰ ØŠˆl—%qÔ'}߬›¯)qµYþ¬oùÖ GšÐ=¢ÂçÀø^9ƒÂ„nJï_}“ÞP" Ã¹O¯ž¦÷y5a…v<E280A6>çžç‰—4nÕ)bôÄ‹ØÀ‚|š2]€õtg!<21>‰ 8²|;ÖÞ!ÆŽ¢ÖîQmŒlè¯[ʯ5”¡â5Wì¨_4+×
-jŸöÕ8±S±Æ"Ä´­¹«èº·¡~vzÕD¿î;ÎŽönÂyfö³sl‚<1F>-<2D>GÃÖCb{´›kùlw~f5}<7D>úH’ÿçŠóÛݸ¾«äú´
q~ÌÛx|†©0fæ{a,D½¥^›<>¨ˆt†`ÜvNõösc‘%‹ <E280B9>#‘F|XÒM÷zK¢lÍÒve2\‰hì­¦æ™ï–«òä2¬_M<5F>¬âí(Í<>3¦fÕ¬±m"+ýícNY„ùÓ:}­‚Ú¨ï0ÎD8ì~ˆî»Þh¬LPZç0¸Öûù–ÉèZXå?Óq"‚„
+-> X25519 QLBViIVzS9+rvilFUi/3fTJYoWmfLFnatUUgeSeLWkM
+CPWJ3Dn1NY/Uo2+8rzQcwaIeaz9HD6jmCm34zPw4X94
+--- iHAsNfMnCuzehlSl+WmGOY7TORSrlB/xpV606yXPkcE
+ÍB]M¥ñÒè2™=Ç=e̮ײ¾;ä`á<qì¢BÈA<¶f°¦øËCOCõ{KáßaB$ìlì]À¼Ð<C2BC>¥©ã¬²¯Ÿ¶æ‰°'µt˜ÇÊV½º6Ž|a.ŒÞ¥Ï¡$ØЦÛV™¼Iµž­;öfS)N?¾êî	rc‡œAñ<41>W tã?‰YÚx?¨<>h6 6•ž¡7-/•4<E280A2>Wx«0ζ”¼p
…bÀ±žÓãŒI³[“8ŒÐÍûìJÝVÝü#"\a2Mµ—†f¼oÊgg—[n½™ýÍ9Uõ<55>‡PœÔœ))òËšÕcJ	H=
Eø«ÞôyX-®E»)Œ9<C592>Í®9A0®ïh‚iwÛÖuiŽ¢*!„v¢ú0ÇÃLìRYp¥…^½Sj§°‡®ÅNæ}>‘Ô5_6
+«óì:HÜf:Wá:¯Õ¸®p‘ÿ]!üÏw¬^¾OÀ«™*ˆ
‘ʬõZ]U>ˆZªÁ“	FJ“⌻ݶÇøÏÌ©Ñ{Ñ°e9Ð2þ׶7[ðÏSô\²Íª4Þiz°\½Ñmœ˜ŒK1

sso-mfa/k8s/privacyidea/realm_bootstrap.py

@@ -233,7 +233,7 @@ def main():
             phase = 'functional-verification'
             from verify_mfa import verify
             proof = verify(base, args.verify_user, REALM, RESOLVER, admin,
-                           lambda:getpass.getpass('Fresh MFA code (include token PIN if required): '))
+                           lambda:getpass.getpass('Fresh MFA code of %s (realm %s; token PIN first if set; not pi-admin): ' % (args.verify_user, REALM)))
             if proof['result'] != 'PASS': raise Refused()
             report['mfa_verified'] = True
         print(json.dumps(report, sort_keys=True))

sso-mfa/k8s/privacyidea/verify_mfa.py

@@ -116,7 +116,9 @@ def main(argv=None):
             args.realm,
             args.resolver,
             password,
-            lambda: getpass.getpass("Fresh MFA code (include token PIN if required): "),
+            lambda: getpass.getpass(
+                f"Fresh MFA code of {args.user} (realm {args.realm}; token PIN first if set; not pi-admin): "
+            ),
         )
     except (EOFError, KeyboardInterrupt, ValueError):
         report = {"result": "FAIL", "phase": "protected-input"}

workplans/NK-WP-0056-bounded-executor-path.md

@@ -117,7 +117,7 @@ it.
 
 ```task
 id: NK-WP-0056-T04
-status: todo
+status: done
 priority: high
 assignee: claude-code
 needs_human: true
@@ -227,6 +227,14 @@ agents and writes KV v1 (CAS=0); verify proves the KV value current the same way
 role. `realm_bootstrap.py --rotate-bind --from-openbao` rewrites only `BINDPW` on the service bind from OpenBao
 (attended platform-admin) and requires `--verify-user`. Correction: `pi-admin` signs in with a password; the MFA
 proof is the `--verify-user` login through the resolver.
+
+**Done 2026-10-31.** `svc-privacyidea` live: CCR-2026-0055 approved; founder-run setup and verify passed (KV v1, value
+proven current by LLDAP sign-in, no workload role) and `realm_bootstrap.py --rotate-bind --from-openbao` wrote the
+resolver from OpenBao with an `admin` MFA proof ([evidence](../docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md);
+a first apply wrote the same value but its check got a code that was not `admin`'s; both MFA prompts now name the user).
+All four service binds are held in OpenBao: `svc-provisioner`, `svc-authelia` and `svc-keycape` ESO-delivered,
+`svc-privacyidea` by attended write-through (founder decision 2026-10-31 amends the done criterion accordingly).
+No bind rotation needs the custody copy decrypted. The custody copy keeps the current values as a fallback.
    the env.
 
 ## Synthetic verification instead of a founder sign-in