Add NetKingdom SSO credential routing lanes

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

wiki/CredentialRouting.md

@@ -105,6 +105,8 @@ lists the interim set — WARDEN-WP-0030).
 | `forgejo-admin-api-token` | "railiance-platform OpenBao KV for Forgejo admin PAT" | `warden access forgejo-admin-api-token --out FILE` (`risk: high`) |
 | `binky-company-email-imap` | "tenant IMAP on `tenants/binky/company-email/imap` (IONOS)" | `warden access binky-company-email-imap --out FILE` (`risk: high`) |
 | `binky-qonto-api` | "tenant Qonto API on `tenants/binky/qonto-api` (API_KEY+API_USER)" | `warden access binky-qonto-api --out FILE` (`risk: high`) |
+| `net-kingdom-lldap-bind-credential` | "railiance-platform custody for the LLDAP bind credential used by identity-provisioner and the privacyIDEA resolver" | Follow the owner-approved NetKingdom reconciliation runbook; lane is currently unresolved and never fetches a value |
+| `net-kingdom-privacyidea-admin-token` | "railiance-platform custody for the privacyIDEA administrative token used by attended resolver reconciliation" | Follow the owner-approved NetKingdom reconciliation runbook; lane is currently unresolved and never fetches a value |
 
 Promotion criteria: `wiki/playbooks/catalog-lane-promotion.md`.  
 High-risk / agent boundary: `wiki/playbooks/agent-read-boundary.md`.  

wiki/playbooks/net-kingdom-sso-bind-credentials.md

@@ -0,0 +1,47 @@
+# NetKingdom SSO/MFA bind credentials
+
+Pointer playbook for the two high-risk credentials used by the NetKingdom
+LLDAP/privacyIDEA control plane. ops-warden routes these needs; it does not own,
+read, store, or execute either credential flow.
+
+## Ownership
+
+| Credential lane | Custody/update owner | Provider procedure | Current consumer use |
+| --- | --- | --- | --- |
+| `net-kingdom-lldap-bind-credential` | railiance-platform / OpenBao | net-kingdom's approved LLDAP and resolver reconciliation runbook | identity-provisioner and privacyIDEA's persisted `lldap-coulomb` resolver |
+| `net-kingdom-privacyidea-admin-token` | railiance-platform / OpenBao | net-kingdom's attended privacyIDEA reconciliation runbook | attended resolver repair and provider-admin verification |
+
+The credentials are intentionally separate. Rotating the LLDAP bind credential
+requires coordinated consumer reload/reconciliation; rotating the privacyIDEA
+admin token is a provider-admin action with its own expiry and revocation
+semantics. Neither lane authorizes a general bundle export or a read of the
+live Kubernetes Secret.
+
+## Worker checklist
+
+1. Run `warden route show <lane-id>` and confirm the current owner and blocked
+   fields. The lane is a pointer, not a value-vending operation.
+2. Obtain the exact approved action and attended execution window from the
+   owner. Do not request either value in chat, State Hub, Git, command
+   arguments, or normal logs.
+3. Use the railiance-platform custody path once its concrete OpenBao mount,
+   policy, field names, and consumer delivery contract are published.
+4. Execute provider-specific reconciliation only through the net-kingdom
+   owner-controlled runbook. The resolver repair must use protected temporary
+   input, explicit `--apply`, predecessor denial checks, readiness checks, and
+   sanitized evidence.
+5. Retain only non-secret rotation metadata: approval/action id, revision,
+   provider rollout status, public fingerprints where applicable, predecessor
+   rejection/expiry outcome, and cleanup receipt.
+
+## Current gate
+
+The routing entries are active so workers can find the ownership boundary, but
+they are not yet resolvable fetch lanes. railiance-platform must publish the
+concrete OpenBao paths/fields and owner-facing update contract before any
+`warden access --fetch` or proxy execution is enabled. NetKingdom's
+`NK-WP-0033` T03/T05 attended reconciliation and sanitized proof remain the
+provider acceptance gate.
+
+Canonical provider context:
+`net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md`.