railiance-platform/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml

id: CCR-2026-0059
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey)
status: verified
created: '2026-10-31'
updated: '2026-10-31'
requester:
  agent: claude-code
  reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs
    the synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after
    each consumer restart, with no person signing in. It needs the syn-journey password
    and TOTP seed held under CCR-2026-0057. Lane design: railiance-platform docs/credential-lane-designs/bounded-executor.md
    "Journey secrets (T10)". Drafted by net-kingdom; not approved.'
review:
  required: true
  required_approvers:
  - platform-owner
  - net-kingdom-owner
  comments:
  - at: '2026-10-31T18:06:02+00:00'
    reviewer: platform-owner
    decision: approved
    comment: 'Approved by the founder 2026-10-31: standing journey reader for NK-WP-0056-T10,
      accepting the CCR-2026-0057 runtime_access widening.'
  - at: '2026-10-31T18:06:12+00:00'
    reviewer: net-kingdom-owner
    decision: approved
    comment: Approved by the founder 2026-10-31 for NK-WP-0056-T10/T06.
  - at: '2026-10-31T18:38:23+00:00'
    reviewer: platform-owner
    decision: binding_confirmed
    comment: 'Binding confirmed: ServiceAccount nk-bind-executor in namespace sso
      only (uid bd15569c-8a85-4625-b001-d9f799cb857b), audience openbao, from rapp-bounded-executor.'
supersedes_boundary:
  ccr: CCR-2026-0057
  field: openbao.runtime_access
  was: false
  change: 'This request gives one workload reader to the path CCR-2026-0057 holds
    with runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation
    stay valid and unchanged; its rotate (teardown + setup) does not need this role.'
target:
  domain: infotech
  tenant: platform
  workload: net-kingdom-bind-executor
  rapp: rapp-bounded-executor
  environment: production
  purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the syn-journey
    PASSWORD and TOTP_SEED to run the synthetic journey; no write, metadata, list,
    sibling path, or other identity
admission:
  standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
  executor_identity: service:nk-bind-executor
  example: net-kingdom examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
  note: The journey is a check step under an admission. The OpenBao role does not
    evaluate the admission; it bounds what the ServiceAccount can read to one synthetic,
    group-less identity.
openbao:
  mount: platform
  kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey
  fields:
  - PASSWORD
  - TOTP_SEED
  policy_name: net-kingdom-bind-executor-syn-journey-read
  policy_file: openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl
  metadata_read: false
  token_self_lifecycle: true
  auth:
    method: kubernetes
    mount: kubernetes
    role: net-kingdom-bind-executor-syn-journey-read
    audience: openbao
    ttl: 15m
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
    policies:
    - net-kingdom-bind-executor-syn-journey-read
    bound_claims:
      service_account_names:
      - nk-bind-executor
      service_account_namespaces:
      - sso
    bound_claims_confirmed: true
access_frontdoor:
  type: platform-owner
  catalog_id: net-kingdom-bind-executor-syn-journey-read
  readiness: pending-review
  resolvable: false
agent_fence:
  data_and_metadata_denied: true
  note: The syn-journey data and metadata paths are denied to coding agents since
    CCR-2026-0057; setup re-checks the deny before the role is created.
lifecycle:
  role_window: Standing (founder decision 2026-10-31, net-kingdom session). Unlike
    the CCR-2026-0058 write role, this role only reads a group-less synthetic identity,
    and a standing reader lets the journey run as a scheduled check (T10) without
    a platform-admin per run.
  deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the
    privacyIDEA token stay under CCR-2026-0057.
  rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change,
    because the path stays the same.
  compromised: Delete the privacyIDEA token SYNJOURNEY01 first (the account then cannot
    pass MFA), delete this role, then tear down and set up as in CCR-2026-0057. The
    identity has no groups, so a leak grants a sign-in that reaches no protected service.
delivery:
  surface: native-workload-login
  namespace: sso
  service_account: nk-bind-executor
  reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
    logs in with its projected ServiceAccount token, audience openbao, separately
    from the CCR-2026-0058 write role; values stay in memory and never reach a Secret,
    log or receipt
  manifest: 'rapp-bounded-executor: manifests/rbac.yaml, templates/job.yaml'
risk:
  classification: low
  notes:
  - Reachable value is one synthetic identity with no groups. Authelia and KeyCape
    admit it, but no consuming service grants it anything (CCR-2026-0057 risk notes).
  - A reader holding both values can complete an MFA sign-in as syn-journey, which
    is the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use
    and the journey can race; the journey then fails closed.
  - The role is separate from the CCR-2026-0058 write role and from the ESO reader
    (CCR-2026-0053); policies are never combined in one role.
  - Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
    remain inside this credential boundary.
verification:
  positive:
  - Exact policy and role read back; login as sso/nk-bind-executor (audience openbao)
    gets only this policy with a lease of at most 15m
  - The synthetic journey passes at aal2 with the values read through this role, with
    a value-free receipt
  negative:
  - Write, metadata read, list, delete and sibling paths (including directory-binds)
    are refused
  - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
  - Coding-agent boundary denies data and metadata of the path
  activation_conditions:
  - Explicit platform-owner and net-kingdom-owner approval of this exact request,
    which includes the change to CCR-2026-0057's runtime_access boundary.
  - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-bounded-executor
    package (bound_claims_confirmed then set to true by the platform-owner).
  - Attended platform-admin (aal2) session applies the policy and role from a reviewed
    commit.
  - Positive and negative results recorded in value-free receipts.
  evidence:
  - at: '2026-10-31T18:48:55+00:00'
    actor: founder (attended), claude-code guiding
    kind: executor_lane_setup_and_proof
    result: passed
    details:
    - '2026-10-31: policy and standing role applied by net-kingdom tools/service-binds/executor-lanes.py
      setup (lanes_prepared); verify (lanes_verified): sso/nk-bind-executor audience
      openbao gets exactly this policy, lease <=15m, reads only syn-journey data (fields
      checked in memory), metadata/directory-binds/token-create denied, default SA,
      wrong audience and write-role login denied, coding-agent fence effective. The
      positive journey run through this role is the open part of NK-WP-0056-T10. Evidence:
      net-kingdom docs/evidence/2026-10-31-nk56-t10-executor-lanes/ (ef6284c).'
  - at: '2026-10-31T19:50:05+00:00'
    actor: founder started the Job; no person in the journey
    kind: executor_journey_live
    result: passed
    details:
    - '2026-10-31: rapp-bounded-executor make journey, Job sso/bounded-executor-journey-20261031-194719
      (image sha256:71da4a51), logged in as sso/nk-bind-executor with this role only
      (openbao audience), read syn-journey and passed the synthetic journey at aal2
      (pwd+otp, signature verified), effects false. Evidence: net-kingdom docs/evidence/2026-10-31-nk56-t10-journey-only/live-receipt.json
      (a020758).'