Job sso/bounded-executor-journey-20261031-194719 (image 71da4a51, journey-read
role only, effects false) passed all eight steps to a signature-verified aal2
ID token with no person in the journey. Fail-closed half: synthetic broken
svc-authelia bind fails at authelia_first_factor.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
First live journey Job was refused at setup (URLError). netcheck showed every
connection refused at 0 s and open from 3 s: k3s applies NetworkPolicy to a
new pod a moment late. Both CLI modes now poll OpenBao's unauthenticated
sys/health for up to 30 s before logging in; only connection errors retry.
48 executor tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
rapp deploy (sso/nk-bind-executor uid bd15569c, role = ceiling), bindings
confirmed (railiance-platform b4bafb0), executor-lanes.py setup
lanes_prepared and verify lanes_verified. Left for T10: a journey-only,
read-only run mode and its unattended live run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
First attended setup stopped at cas_required: platform-admin holds
create/read/update/delete/list on platform/*, not patch, so 'kv metadata
patch' was denied. Policies were already applied; nothing after. Now a
metadata write naming only cas_required (KV v2 keeps unnamed fields; checked
on the pinned OpenBao image), guarded by a before/after comparison of
max_versions, delete_version_after and custom_metadata. Receipt of the
stopped attempt kept as evidence.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
The executor logs in separately for the bind write (CCR-2026-0058) and the
journey read (CCR-2026-0059) and refuses one role for both; every login is
revoked at exit, also when setup fails. Clients log in again (re-reading the
rotating projected JWT) before the lease ends, since a run's budget (20m)
outlasts a 15m token. Synthetic pilot with per-lane tokens: completed and
reverted, all_met.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
operations.py: OpenBao KV v2 CAS, LLDAP self-rotation (forward and revert),
ExternalSecret force-sync and status, rollout restart (RolloutFailed is a
definite failure), pilot checks. synthetic_pilot.py on the T08 stack plus
OpenBao 2.5.4 with CCR-2026-0058's policy: rotation completed; a one-off wrong
delivery reverted in declared order with the earlier value restored.
Runner: revert steps run in declared order (BEA-10), definite failures revert,
unknown outcomes stop, receipts carry error types. Found and corrected (in
railiance-platform) CCR-2026-0058's required_parameters refusing reads.
Packaging moved to new T13. 29 executor tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
A lldap_strict_readonly account changes its own password with its own token
on the pinned LLDAP and cannot change another account's, so the pilot needs
no lldap_password_manager account (secrets-engine Q2).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Founder-run under CCR-2026-0057: KeyCape client registered, lane.py setup
(privacyIDEA-generated key, KV v1) and verify passed; the live journey
reached aal2 with otp against kc.coulomb.social. Receipts, findings and the
one teardown of a partial run in docs/evidence. syn-journey declared active.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Third founder setup run stopped at /token/init. Reproduced on the pinned
privacyIDEA 3.12.2: an admin policy with action '*' enables
totp_force_server_generate, so a supplied otpkey is silently replaced and
verify_enrollment then fails with ERR905. setup now enrolls with genkey=1,
takes the seed from the enrollment response (memory only), confirms with a
code, and writes PASSWORD and TOTP_SEED to KV (CAS=0) last. Failed receipts
kept as evidence.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
The first founder setup run stopped in phase absent (no change made):
listing tokens by a user that does not resolve yet is an error in
privacyIDEA. Ownership is now read from the token found by serial, and
pi-admin login, privacyIDEA requests and the LLDAP admin login refuse with
their own reasons. Failed receipt kept as 00-setup-refused-absent.json.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
stack.py starts LLDAP, privacyIDEA (pi_fixture.py in its image), Authelia
and KeyCape from the repository manifests on a throwaway 127.0.0.1-only
network and runs the journey: healthy passes at aal2; svc-authelia fails
closed at first factor, svc-keycape at the token exchange, svc-privacyidea
at the OTP check - the latter only after privacyIDEA's resolver cache
(CACHE_TIMEOUT 120, as live) expired. Each scenario passes again after
restore. Runner: corrected bind-to-step mapping, host_map_only,
min_time_step for privacyIDEA's TOTP replay guard.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
Founder-run under CCR-2026-0055: setup, verify and realm_bootstrap.py
--rotate-bind --from-openbao with the admin MFA proof. The first apply's check
got a code that was not admin's, so both MFA prompts now name the user.
Custody re-sealed after setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
Founder-run under CCR-2026-0054: setup, ESO apply, verify, rollout of KeyCape
main-e2b5fa1 with KEYCAPE_LLDAP_BIND_PW, clear-password, restart, env-only verify;
admin signed in with OTP before and after the clear. Custody re-sealed after setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
Founder-run under CCR-2026-0053: setup (custody equal to live, KV v1 CAS=0),
ESO apply, verify and Authelia restart passed; admin signed in with OTP.
Custody copy re-sealed after setup (same recipient, contents unchanged).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
All five NK-WP-0053 stages passed on generation 20261031T034845Z-a13dc92e2c61,
the first capture after the 2026-10-30 bind split, operated by admin. Uncounted
attempts are kept with their causes. The drill document gains the OpenBao
platform-admin login that stage 1 silently requires. The LLDAP declaration moves
ld-admin and the svc-* binds to active and admin to human-only; SI-X1 is closed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
Founder-run steps 1-10, verify --old-admin-retired pass. Evidence and deviations in
docs/evidence/2026-10-30-nk54-bind-split/. Runbook: export the admin KUBECONFIG and
decrypt the sealed custody copy first. Finding: custody AUTHELIA_KEYCAPE_CLIENT_SECRET
is stale against the live hash.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 620478@bnt-lap001
Assistant-Session: 944e8353-7102-4bc8-affe-84586a10f2d0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
Restored LLDAP, database and original keys in one network-free namespace; archived
resolver repointed to the restored directory in the disposable copy. By user and
realm through /validate/check: wrong key refused (error 907), wrong code refused,
the founder's TOTP PIN+code accepted. Loopback only; cleanup verified. Does not
prove the KeyCape consumer login chain or production token validity.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Original config validated, storage key opened the store, issuer key equals the
archived key, archived keycape client secret accepted (no grant issued), wrong
secret and wrong password refused, existing-user first factor passed against the
restored LLDAP. Loopback only; cleanup verified. Does not prove the full login
chain, MFA (T19) or current production password validity.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4101@bnt-lap001
Assistant-Session: bc7d2ce5-6f32-45f1-83e5-0dcbb8e610a7
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
