NK-WP-0056: founder decisions folded in; runtime split into T11 and T12

Window-scoped write role (CCR-2026-0058 approved as amended), bind
self-rotation (pilot step is OPERATE on the one bind; svc-executor-pw
dropped), pilot without the PDP gate (not-evaluated), started event plus one
receipt per run, rapp Job in sso, owner workplans approved. New tasks: T11
core runner, T12 pilot operations and packaging; T06 depends on T12.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml

@@ -42,7 +42,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 43a78907593a
+      commit: c9ab01e23e92
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -104,7 +104,7 @@ spec:
       requires:
         mode: OPERATE
         scope: k8s/sso/deployment/lldap
-  plan_digest: sha256:33063248bed00c84b640a37344a4c9e52285e76cacb68b92d08872cd9b7c77db
+  plan_digest: sha256:139f0ca7564184290c7cb1f6b20bdb9807db98e5609a79083ac6f7aea13bb50c
   checks:
   - id: ld-admin-administers
     description: ld-admin signs in and administers; admin keeps lldap_admin membership

tools/bounded-execution-admission/generate_examples.py

@@ -52,17 +52,17 @@ rotation = doc(
     "Pilot shape for NK-WP-0056-T06: generate a new bind password into OpenBao, set it in LLDAP, let ESO deliver it, restart Authelia, prove sign-in with the synthetic journey; revert on any failed check.",
     "medium", {"not_before": "2026-11-03T09:00:00Z", "not_after": "2026-11-03T11:00:00Z"},
     [{"mode": "OPERATE", "scope": KV, "environments": P},
-     {"mode": "ADMINISTER", "scope": "lldap/people/svc-authelia", "environments": P},
+     {"mode": "OPERATE", "scope": "lldap/people/svc-authelia", "environments": P},
      {"mode": "OPERATE", "scope": "k8s/sso/externalsecret/authelia-secrets", "environments": P},
      {"mode": "OPERATE", "scope": "k8s/sso/deployment/authelia", "environments": P}],
     {"unit": "consumer", "consumers": ["authelia"], "max_concurrent": 1},
     [LANE, JOURNEY],
     [step("generate", "openbao.kv.write-next-version", "openbao:" + KV[len("openbao/"):], "authelia", "delegable", True, "OPERATE", KV, ["kv-advanced"], "restore-kv"),
-     step("set-directory", "lldap.user.set-password-from-kv", "lldap:svc-authelia", "authelia", "delegable", True, "ADMINISTER", "lldap/people/svc-authelia", ["bind-signs-in"], "restore-directory"),
+     step("set-directory", "lldap.user.change-own-password-from-kv", "lldap:svc-authelia", "authelia", "delegable", True, "OPERATE", "lldap/people/svc-authelia", ["bind-signs-in"], "restore-directory"),
      step("deliver", "eso.force-sync", "k8s:sso/externalsecret/authelia-secrets", "authelia", "delegable", True, "OPERATE", "k8s/sso/externalsecret/authelia-secrets", ["eso-synced"], "redeliver"),
      step("restart", "k8s.rollout-restart", "k8s:sso/deployment/authelia", "authelia", "delegable", True, "OPERATE", "k8s/sso/deployment/authelia", ["synthetic-journey"], "restart-again")],
     [step("restore-kv", "openbao.kv.write-previous-value-as-next-version", "openbao:" + KV[len("openbao/"):], "authelia", "delegable", True, "OPERATE", KV),
-     step("restore-directory", "lldap.user.set-password-from-kv", "lldap:svc-authelia", "authelia", "delegable", True, "ADMINISTER", "lldap/people/svc-authelia"),
+     step("restore-directory", "lldap.user.change-own-password-from-kv", "lldap:svc-authelia", "authelia", "delegable", True, "OPERATE", "lldap/people/svc-authelia"),
      step("redeliver", "eso.force-sync", "k8s:sso/externalsecret/authelia-secrets", "authelia", "delegable", True, "OPERATE", "k8s/sso/externalsecret/authelia-secrets"),
      step("restart-again", "k8s.rollout-restart", "k8s:sso/deployment/authelia", "authelia", "delegable", True, "OPERATE", "k8s/sso/deployment/authelia")],
     [check("kv-advanced", "KV svc-authelia has exactly one new version, CAS on the previous one", LANE, 30),

tools/bounded-execution-admission/tests/test_validate.py

@@ -95,7 +95,10 @@ class RuleTests(unittest.TestCase):
             {"mode": "GOVERN", "scope": "lldap", "environments": ["PRODUCTION"]}))))
         # whole-directory ADMINISTER for a delegable step at medium risk
         def widen(s):
-            s["scope_ceiling"][1]["scope"] = "lldap"
+            s["scope_ceiling"][1].update(mode="ADMINISTER", scope="lldap")
+            for step in s["plan"]["steps"] + s["plan"]["revert_steps"]:
+                if step["requires"]["scope"].startswith("lldap/"):
+                    step["requires"]["mode"] = "ADMINISTER"
         self.assertIn("BEA-5", rules(mutate(ROTATION, widen)))
 
     def test_bea6_least_privilege(self):

tools/service-identity/declarations/bounded-executor.yaml

@@ -31,9 +31,10 @@ identities:
     principal_type: WORKLOAD
     conventions: [executor]
     executor_subject: "service:nk-bind-executor"
-    purpose: "OpenBao Kubernetes-auth role for sso/nk-bind-executor: write the next version of the svc-authelia bind (CAS) and read it for checks; lane shape pending secrets-engine and railiance-platform answers (T02)"
+    purpose: "OpenBao Kubernetes-auth role for sso/nk-bind-executor (CCR-2026-0058, approved, window-scoped): write the next version of the svc-authelia bind (CAS) and read it; holding the current value is what lets the executor change the bind's own password in LLDAP"
     grants:
-      - {mode: OPERATE, scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia, activation: APPROVED, environments: [PRODUCTION], note: "KV data read and CAS write; 15 min TTL"}
+      - {mode: OPERATE, scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia, activation: APPROVED, environments: [PRODUCTION], note: "KV data read and CAS write; 15 min TTL; role exists only in the admitted window (CCR-2026-0058)"}
+      - {mode: OPERATE, scope: lldap/people/svc-authelia, activation: APPROVED, environments: [PRODUCTION], note: "self-rotation: signs in as the bind with the KV value and changes its own password (hub 3d0c8f86)"}
     interactive_login: false
     second_factor: not_applicable
     custody: [openbao-lease]
@@ -41,20 +42,6 @@ identities:
     owner: "railiance-platform (OpenBao role) for NetKingdom"
     rotation: {path: "OpenBao lease per run; no standing secret", coupling: [bounded-executor]}
     status: planned
-  - name: svc-executor-pw
-    principal_type: SERVICE
-    conventions: [executor]
-    executor_subject: "service:nk-bind-executor"
-    purpose: "LLDAP account in lldap_password_manager: set svc-authelia's password from KV. LLDAP cannot narrow it to one account (it can reset any non-admin user); each admission narrows it to the accounts it names"
-    grants:
-      - {mode: ADMINISTER, scope: lldap/people, activation: APPROVED, environments: [PRODUCTION], note: "lldap_password_manager; admission ceiling narrows to lldap/people/<account>"}
-    interactive_login: false
-    second_factor: not_applicable
-    custody: [openbao-lease]
-    consumers: [{name: bounded-executor, kind: service}]
-    owner: "NetKingdom directory and User Engine owners"
-    rotation: {path: "Its own password held in OpenBao; lane shape pending secrets-engine (T02)", coupling: [bounded-executor]}
-    status: planned
   - name: svc-executor-read
     principal_type: SERVICE
     conventions: [bind]