Add NetKingdom SSO credential routing lanes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

registry/routing/catalog.yaml

@@ -733,6 +733,70 @@ entries:
         - "Write the same value to OpenBao and sso/keycape-rapp-qonto-client, then restart KeyCape."
         - "Verify positive qonto:read exchange plus wrong-secret and excessive-scope denial without printing tokens."
 
+  - id: net-kingdom-lldap-bind-credential
+    title: NetKingdom LLDAP bind credential for identity and privacyIDEA resolver
+    need_keywords: [net-kingdom, netkingdom, sso, lldap, ldap, bind, directory, resolver, privacyidea, privacyIDEA, credential, password]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + NetKingdom SSO/MFA
+    warden_executes: false
+    wiki_ref: wiki/playbooks/net-kingdom-sso-bind-credentials.md#worker-checklist
+    canon_ref: net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
+    reviewed: "2026-08-23"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      blocked_on: "Concrete OpenBao path, field contract, owner update procedure, and approved attended reconciliation handoff are not published yet; do not enable fetch or proxy execution."
+      reviewed: "2026-08-23"
+      verified: unverified
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Provider/control-plane bind credential; identity-provisioner and privacyIDEA consumers are governed by NetKingdom rather than a single declared workload."
+    auth_method: "Owner-approved railiance-platform OpenBao custody path; provider reconciliation remains an attended NetKingdom operation"
+    lane: secret
+    exec_capable: false
+    rotation:
+      method: re-establish
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "Rotate through the owner-approved OpenBao/provider procedure; never export the live Kubernetes Secret or place a value in argv, logs, State Hub, or chat."
+        - "Reload identity-provisioner and reconcile privacyIDEA's lldap-coulomb resolver in the same approved window."
+        - "Verify replacement lookup, predecessor denial, readiness, and cleanup using sanitized evidence only."
+
+  - id: net-kingdom-privacyidea-admin-token
+    title: NetKingdom privacyIDEA administrative token for attended resolver reconciliation
+    need_keywords: [net-kingdom, netkingdom, sso, mfa, privacyidea, privacyIDEA, pi-admin, admin, token, resolver, lldap, credential]
+    owner_repo: railiance-platform
+    subsystem: OpenBao + privacyIDEA
+    warden_executes: false
+    wiki_ref: wiki/playbooks/net-kingdom-sso-bind-credentials.md#worker-checklist
+    canon_ref: net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
+    reviewed: "2026-08-23"
+    status: active
+    delegation:
+      mode: native
+      intended_owner: railiance-platform
+      blocked_on: "Concrete OpenBao path, field contract, token expiry/revocation contract, and approved attended reconciliation handoff are not published yet; do not enable fetch or proxy execution."
+      reviewed: "2026-08-23"
+      verified: unverified
+    risk: high
+    workload_ref:
+      applicability: not-applicable
+      reason: "Provider-admin credential for attended privacyIDEA reconciliation, not a workload delivery lane."
+    auth_method: "Owner-approved railiance-platform OpenBao custody path; privacyIDEA reconciliation remains an attended NetKingdom operation"
+    lane: secret
+    exec_capable: false
+    rotation:
+      method: rotate
+      owner: railiance-platform
+      automatable: false
+      steps:
+        - "Obtain a fresh owner-approved privacyIDEA administrative token through the sanctioned custody path; never print or persist it in the routing layer."
+        - "Run only the reviewed NetKingdom attended resolver reconciliation with explicit apply and bounded cleanup."
+        - "Verify MFA/provider health, predecessor rejection or expiry, and sanitized cleanup evidence."
+
   - id: agent-harness-forgejo-deploy
     title: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
     need_keywords: [agent-harness, forgejo, deploy, key, ssh, executor-sandbox, railiance, binky-control, deploy-key]

tests/test_routing.py

@@ -170,6 +170,23 @@ def test_platform_admin_login_lane_is_exact_and_non_value_bearing():
     assert entry.workload_ref.resolution == "not-applicable"
 
 
+def test_netkingdom_sso_bind_lanes_are_routed_but_not_resolvable():
+    catalog = load_catalog(_repo_catalog())
+    for lane_id in (
+        "net-kingdom-lldap-bind-credential",
+        "net-kingdom-privacyidea-admin-token",
+    ):
+        entry = catalog.get(lane_id)
+        assert entry is not None
+        assert entry.owner_repo == "railiance-platform"
+        assert entry.risk == "high"
+        assert entry.warden_executes is False
+        assert entry.exec_capable is False
+        assert entry.resolvable is False
+        assert entry.delegation.blocked_on
+        assert "net-kingdom-sso-bind-credentials.md#worker-checklist" in entry.wiki_ref
+
+
 def test_openbao_recovery_ceremony_is_non_value_bearing_owner_pointer():
     entry = load_catalog(_repo_catalog()).get("openbao-shamir-recovery-ceremony")
     assert entry.lane == "ceremony"

wiki/CredentialRouting.md

@@ -105,6 +105,8 @@ lists the interim set — WARDEN-WP-0030).
 | `forgejo-admin-api-token` | "railiance-platform OpenBao KV for Forgejo admin PAT" | `warden access forgejo-admin-api-token --out FILE` (`risk: high`) |
 | `binky-company-email-imap` | "tenant IMAP on `tenants/binky/company-email/imap` (IONOS)" | `warden access binky-company-email-imap --out FILE` (`risk: high`) |
 | `binky-qonto-api` | "tenant Qonto API on `tenants/binky/qonto-api` (API_KEY+API_USER)" | `warden access binky-qonto-api --out FILE` (`risk: high`) |
+| `net-kingdom-lldap-bind-credential` | "railiance-platform custody for the LLDAP bind credential used by identity-provisioner and the privacyIDEA resolver" | Follow the owner-approved NetKingdom reconciliation runbook; lane is currently unresolved and never fetches a value |
+| `net-kingdom-privacyidea-admin-token` | "railiance-platform custody for the privacyIDEA administrative token used by attended resolver reconciliation" | Follow the owner-approved NetKingdom reconciliation runbook; lane is currently unresolved and never fetches a value |
 
 Promotion criteria: `wiki/playbooks/catalog-lane-promotion.md`.  
 High-risk / agent boundary: `wiki/playbooks/agent-read-boundary.md`.  

wiki/playbooks/net-kingdom-sso-bind-credentials.md

@@ -0,0 +1,47 @@
+# NetKingdom SSO/MFA bind credentials
+
+Pointer playbook for the two high-risk credentials used by the NetKingdom
+LLDAP/privacyIDEA control plane. ops-warden routes these needs; it does not own,
+read, store, or execute either credential flow.
+
+## Ownership
+
+| Credential lane | Custody/update owner | Provider procedure | Current consumer use |
+| --- | --- | --- | --- |
+| `net-kingdom-lldap-bind-credential` | railiance-platform / OpenBao | net-kingdom's approved LLDAP and resolver reconciliation runbook | identity-provisioner and privacyIDEA's persisted `lldap-coulomb` resolver |
+| `net-kingdom-privacyidea-admin-token` | railiance-platform / OpenBao | net-kingdom's attended privacyIDEA reconciliation runbook | attended resolver repair and provider-admin verification |
+
+The credentials are intentionally separate. Rotating the LLDAP bind credential
+requires coordinated consumer reload/reconciliation; rotating the privacyIDEA
+admin token is a provider-admin action with its own expiry and revocation
+semantics. Neither lane authorizes a general bundle export or a read of the
+live Kubernetes Secret.
+
+## Worker checklist
+
+1. Run `warden route show <lane-id>` and confirm the current owner and blocked
+   fields. The lane is a pointer, not a value-vending operation.
+2. Obtain the exact approved action and attended execution window from the
+   owner. Do not request either value in chat, State Hub, Git, command
+   arguments, or normal logs.
+3. Use the railiance-platform custody path once its concrete OpenBao mount,
+   policy, field names, and consumer delivery contract are published.
+4. Execute provider-specific reconciliation only through the net-kingdom
+   owner-controlled runbook. The resolver repair must use protected temporary
+   input, explicit `--apply`, predecessor denial checks, readiness checks, and
+   sanitized evidence.
+5. Retain only non-secret rotation metadata: approval/action id, revision,
+   provider rollout status, public fingerprints where applicable, predecessor
+   rejection/expiry outcome, and cleanup receipt.
+
+## Current gate
+
+The routing entries are active so workers can find the ownership boundary, but
+they are not yet resolvable fetch lanes. railiance-platform must publish the
+concrete OpenBao paths/fields and owner-facing update contract before any
+`warden access --fetch` or proxy execution is enabled. NetKingdom's
+`NK-WP-0033` T03/T05 attended reconciliation and sanitized proof remain the
+provider acceptance gate.
+
+Canonical provider context:
+`net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md`.