bind-lane svc-privacyidea (CCR-2026-0055) has no workload reader. Setup and
verify prove the value is current by an LLDAP sign-in as svc-privacyidea, fence
coding agents, write KV with CAS=0 and refuse any workload role.
realm_bootstrap.py --rotate-bind rewrites only BINDPW on the established
service bind, --from-openbao reads it in memory under the attended
platform-admin session, and an applied rotation requires --verify-user.
Lane tests: 20; realm_bootstrap tests: 102.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
tegwick
c28651e55b