NK-WP-0056-T06 prep: admission helper, write-role window-open/close, service-client case; T15 evidence

- bounded-executor/prepare_admission.py: the live admission from the pilot example, pins read
  from the image's commit, window <= 2 h (audit-core's declared bound), validated.
- executor-lanes.py window-open/window-close: CCR-2026-0058's window-scoped write role, created
  for one admitted open window under attended platform-admin and deleted afterwards (idempotent).
- security-cases/nk-bind-executor-approval.yaml: the case of record, proposed (founder acceptance).
- docs/evidence/2026-11-04-nk56-t15-audit-sender: 8 checks against audit-core 876c3f6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

tests/test_executor_lanes.py

@@ -72,6 +72,8 @@ class FakeBao:
             if path == JOURNEY and token == 'reader':
                 return out({'data': {'data': {'PASSWORD': 'SYNTHETIC-PW-VALUE', 'TOTP_SEED': 'SYNTHETIC-SEED-VALUE'}, 'metadata': {'version': 1}}})
             return out({'data': self.store[path]}) if path in self.store else missing
+        if args[0] == 'delete':
+            self.store.pop(args[-1], None); return out({})
         if args[0] == 'write':
             path = args[-2] if args[-1] == '-' else args[-1]
             if path == 'auth/token/revoke': self.revoked.append(payload['token']); return out({})
@@ -175,3 +177,51 @@ def test_verify_refusals(tmp_path, monkeypatch, mutate, reason):
     mutate(m, fake)
     r = run(m, 'verify', d)
     assert (r['status'], r['reason']) == ('failed', reason)
+
+
+ADMISSION = ROOT / 'examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml'
+
+
+def admission_at(tmp_path, m):
+    """The pilot example, its window around a fixed instant."""
+    import datetime as dt
+    bea = m.load('bea_for_test', m.BEA)
+    doc = bea.load(ADMISSION)
+    path = tmp_path / 'a.yaml'
+    path.write_text(json.dumps(doc))
+    start = bea.parse_time(doc['spec']['window']['not_before'])
+    return path, start + dt.timedelta(minutes=10)
+
+
+def test_window_open_creates_the_exact_write_role_once_then_close_removes_it(tmp_path, monkeypatch):
+    m, fake, d = build(tmp_path, monkeypatch)
+    run(m, 'setup', d)
+    path, now = admission_at(tmp_path, m)
+    r = {}
+    m.window_open(d, path, r, now=now)
+    role = 'auth/kubernetes/role/' + m.LANES['write']['role']
+    assert r['status'] == 'window_opened' and r['admission'] == 'BEA-2026-0001' and role in fake.store
+    m.check_role(fake.store[role], m.LANES['write'])
+    with pytest.raises(m.Refused, match='write_role_already_open'):
+        m.window_open(d, path, {}, now=now)
+    c = {}
+    m.window_close(path, c)
+    assert c['status'] == 'window_closed' and c['write_role_was_present'] and role not in fake.store
+    c = {}
+    m.window_close(path, c)  # idempotent, also late
+    assert c['status'] == 'window_closed' and not c['write_role_was_present']
+
+
+@pytest.mark.parametrize('mutate, reason', [
+    (lambda m, f, now: (now - __import__('datetime').timedelta(hours=1)), 'admission_window_not_open'),
+    (lambda m, f, now: (f.identity.update(policies=['root']), now)[1], 'attended_platform_admin_required'),
+    (lambda m, f, now: (setattr(f, 'cas', False), now)[1], 'cas_required_not_set'),
+    (lambda m, f, now: (f.store.update({m.BOUNDARY: {'policy': ''}}), now)[1], 'agent_fence_missing'),
+])
+def test_window_open_refusals(tmp_path, monkeypatch, mutate, reason):
+    m, fake, d = build(tmp_path, monkeypatch)
+    run(m, 'setup', d)
+    path, now = admission_at(tmp_path, m)
+    with pytest.raises(m.Refused, match=reason):
+        m.window_open(d, path, {}, now=mutate(m, fake, now))
+    assert 'auth/kubernetes/role/' + m.LANES['write']['role'] not in fake.store