NK-WP-0056-T06: standing paths live (custody, audit sender, KeyCape client); manifest carries the new env binding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

docs/evidence/2026-11-04-nk56-t06-go-live/README.md

@@ -0,0 +1,25 @@
+# NK-WP-0056-T06: one-time go-live of the executor's standing paths (2026-11-04)
+
+Founder-run, guided by claude-code, following `sso-mfa/k8s/bounded-executor/T06-PILOT-RUNBOOK.md` sections 1 to 4.
+Every result below is value-free; receipts stay under the founder's `~/.local/state/railiance/receipts/` and
+audit-core `docs/evidence/`.
+
+| Section | Step | Result |
+| --- | --- | --- |
+| 1 | owner ingress | done, T16 evidence (`2026-11-04-nk56-t16-owner-ingress`) |
+| 2 | case acceptance | hub decision `59d570ef` resolved; case `accepted` (`7cc69d1`) |
+| 3.0 | plan and tests | 43 tests pass; plan lists the three lanes |
+| 3.1 | approvals and bindings | CCR-2026-0060 (platform-owner), -0061 (platform-owner, net-kingdom-owner), -0063 (platform-owner, audit-core-owner, net-kingdom-owner); all bindings confirmed (railiance-platform `8c57aa9`, `1d8c081`). The first fence attempt refused at contract (`audit:named_owner_approvals_required`) until the third CCR-0063 approval was added |
+| 3.2 | coding-agent fence | `fenced`, 4 deny lines (data and metadata of both custody paths) |
+| 3.3 | policies and roles | all three CCRs `applied`, `delegated_metadata_apply` passed (`9f22244`); then case `materialized` (`3550602`); the broker's case check passes offline |
+| 3.4 | audit sender seed | r1 refused `token_env_must_be_unset` (a token variable in the shell; warden strips BAO_TOKEN and VAULT_TOKEN, not OPENBAO_TOKEN). r2: `seeded_pending_sso_delivery`; probe read 403, own tenant 200, other tenant 403, other source 403; registry copy matches by hash |
+| 3.5 | mint KeyCape client secret | `dry_run_would_generate`, then `generated`, KV version 1, grant token revoked, no value emitted |
+| 3.6 | ESO delivery | stores Ready. ExternalSecrets first failed: client-side `kubectl apply` left a `last-applied` annotation, which ESO propagates and the `reject-secret-last-applied` admission policy refuses. Recovered by removing the annotation and applying server-side; both Ready. Runbook fixed (railiance-platform `9a2495d`) |
+| 3.7 | custody verify | `custody_verified_pending_keycape_and_executor`, phase done, both custody entries v1, audit copies agree by hash, KeyCape client secret never read. Audit rerun r3: `seeded_and_delivered`, `sso` copy matches |
+| 4 | KeyCape bind and register | rollout paused; env bound; `keycape-client.py apply`: registry 15 → 16 clients, check-config valid live and proposed, unrelated bytes preserved, no values; resumed; one new pod `keycape-8546f8bdc7-chpnw` ready, 0 restarts (22:38:24Z); discovery 200 |
+
+`sso-mfa/k8s/keycape/deployment.yaml` now carries the env binding so the repository matches live.
+
+Open for the type's verification: `service-token-claims` and `excess-scope-refused` run with the executor's first
+token exchanges in the request phase (section 6a). The case moves to `live` after that, and oidc-service-client 0.2
+to `implemented`.

sso-mfa/k8s/keycape/deployment.yaml

@@ -102,6 +102,14 @@ spec:
                 secretKeyRef:
                   name: keycape-approval-engine-operator-client
                   key: client-secret
+            # NK-WP-0056-T06 (2026-11-04, founder-run): SecurityCase nk-bind-executor-approval
+            # (oidc-service-client 0.2); delivered by ESO, CCR-2026-0060. Bound live with the
+            # client's registration in one rollout (sso-mfa/k8s/bounded-executor/T06-PILOT-RUNBOOK.md section 4).
+            - name: KEYCAPE_NK_BIND_EXECUTOR_APPROVAL_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: keycape-nk-bind-executor-approval-client
+                  key: client-secret
 
           volumeMounts:
             - name: authentication-policy