NK-WP-0056-T04 done: svc-privacyidea written through from OpenBao; all four binds in platform custody

Founder-run under CCR-2026-0055: setup, verify and realm_bootstrap.py
--rotate-bind --from-openbao with the admin MFA proof. The first apply's check
got a code that was not admin's, so both MFA prompts now name the user.
Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/01-setup.json

@@ -0,0 +1,14 @@
+{
+  "action": "setup",
+  "ccr_sha256": "97e8e4b17e12d6bcbffe5acd4f8fbd68f52fe340333968bb175e8da18ecb6513",
+  "coding_agents_denied": true,
+  "custody_is_current": true,
+  "kv_version": 1,
+  "lane": "svc-privacyidea",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0055",
+  "source_sha256": "5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0",
+  "status": "custody_prepared",
+  "values_recorded": false,
+  "workload_access": false
+}

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/02-verify.json

@@ -0,0 +1,14 @@
+{
+  "action": "verify",
+  "ccr_sha256": "97e8e4b17e12d6bcbffe5acd4f8fbd68f52fe340333968bb175e8da18ecb6513",
+  "coding_agents_denied": true,
+  "kv_is_current": true,
+  "kv_version": 1,
+  "lane": "svc-privacyidea",
+  "phase": "done",
+  "source_ccr": "CCR-2026-0055",
+  "source_sha256": "5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0",
+  "status": "custody_verified",
+  "values_recorded": false,
+  "workload_access": false
+}

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/03-rotate-bind.json

@@ -0,0 +1 @@
+{"actions": ["rotate-bind"], "configuration_writes": 1, "mfa_verified": true, "onboarding_policy": "owner-managed", "policies_changed": false, "result": "configured"}

docs/evidence/2026-10-31-nk56-svc-privacyidea-bind/README.md

@@ -0,0 +1,19 @@
+# NK-WP-0056-T04 — svc-privacyidea bind in platform custody (2026-10-31)
+
+Founder-run in the founder's terminal under railiance-platform CCR-2026-0055 (request type
+`attended-service-credential-delivery`, approved by platform-owner and net-kingdom-owner, `04d9dc8`; sha256
+`97e8e4b1…6513`). privacyIDEA keeps the resolver `BINDPW` encrypted in its own database and accepts it only through
+the `pi-admin` API, so there is no ESO or workload reader: the value is held in OpenBao and written through by an
+attended procedure. Receipts are value-free.
+
+| Step | Result | Receipt |
+| --- | --- | --- |
+| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | custody value signs in to LLDAP as `svc-privacyidea` (current); coding agents fenced; KV version 1 (CAS=0); no policy or role | `01-setup.json` |
+| verify | KV value signs in to LLDAP as `svc-privacyidea`; fence present; no workload role | `02-verify.json` |
+| `realm_bootstrap.py --attended --rotate-bind --from-openbao` (preview) | `actions: ["rotate-bind"]`, no write | operator output |
+| apply, attempt 1 (not counted) | one `BINDPW` write (same value), then the `--verify-user admin` check failed: the code entered was not `admin`'s (the prompt did not name the account; prompts now name the user) | operator output |
+| apply, attempt 2 | one `BINDPW` write (same value from OpenBao); `admin` resolved through `lldap-coulomb` and passed token-backed MFA | `03-rotate-bind.json` |
+
+The resolver bind is now written from OpenBao (`platform/workloads/net-kingdom/directory-binds/svc-privacyidea`); the
+founder's custody copy holds the same value as a fallback. Rotation: change the password in LLDAP, write the next KV
+version with CAS, run `realm_bootstrap.py --attended --rotate-bind --from-openbao --apply --verify-user admin`.