CCR-2026-0057 (proposed): NetKingdom synthetic journey identity custody

syn-journey password and TOTP seed in platform custody, attended delivery
into LLDAP and privacyIDEA by net-kingdom sso-mfa/k8s/synthetic-journey/lane.py
(NK-WP-0056-T09). No workload reader.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml

@@ -0,0 +1,99 @@
+id: CCR-2026-0057
+kind: credential-change-request
+schema_version: 1
+request_type: attended-service-credential-delivery
+title: NetKingdom synthetic journey identity (syn-journey) password and TOTP seed custody
+status: proposed
+created: '2026-10-31'
+updated: '2026-10-31'
+requester:
+  agent: claude-code
+  reason: 'NK-WP-0056-T09: a synthetic, unprivileged sign-in identity whose MFA journey through
+    KeyCape, Authelia and privacyIDEA replaces the founder''s sign-in as the check between
+    consumers in a bounded bind rotation (NK-WP-0056-T06). Its password and TOTP seed are
+    generated in memory and held only in OpenBao; LLDAP and privacyIDEA receive them through
+    one attended procedure. No workload reads them until the executor identity exists (T03/T10),
+    which needs its own request.'
+review:
+  required: true
+  required_approvers:
+  - platform-owner
+  - net-kingdom-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: net-kingdom-synthetic-journey
+  environment: production
+  purpose: Hold the password and TOTP seed of the LLDAP user syn-journey (no groups, no rights)
+    so that a synthetic journey can prove sign-in with MFA without a person. No other identity,
+    directory, privacyIDEA or service credential.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey
+  fields:
+  - PASSWORD
+  - TOTP_SEED
+  auth:
+    method: attended-oidc
+    mount: netkingdom
+    role: platform-admin
+  runtime_access: false
+  initial_cas: 0
+access_frontdoor:
+  type: attended-service-config
+  catalog_id: openbao-platform-admin-login
+  readiness: pending-review
+  resolvable: false
+lifecycle:
+  deactivate: lane.py teardown deletes the privacyIDEA token SYNJOURNEY01, the LLDAP user
+    syn-journey (refused if it has gained any group) and the KV entry with all versions;
+    the KeyCape client nk-synthetic-journey is removed with keycape-client.py --operation
+    remove. The coding-agent fence stays.
+  rotate: Tear down and set up again (new password and seed, CAS=0 on the fresh path).
+    No in-place rotation path in this request.
+  compromised: Delete the privacyIDEA token first (the account then cannot pass MFA),
+    then tear down. The identity has no groups, so a leak grants a sign-in that reaches
+    no protected service.
+delivery:
+  surface: attended-service-config
+  service: LLDAP (sso) user syn-journey; privacyIDEA (mfa) TOTP token SYNJOURNEY01 in realm
+    coulomb
+  target: the LLDAP user's password (set with the pinned lldap_set_password, OPAQUE) and the
+    privacyIDEA token's OTP key (stored encrypted in the privacyIDEA database)
+  procedure: net-kingdom sso-mfa/k8s/synthetic-journey/lane.py setup
+  gate: attended platform-admin (aal2) OpenBao session, the human admin's LLDAP password, the
+    attended pi-admin password, and a passing synthetic journey (lane.py verify) against
+    the live issuer
+risk:
+  classification: medium
+  notes:
+  - 'The identity is new and holds no group. Authelia admits it (it is not svc-* or ld-admin),
+    KeyCape issues it tokens, but no consuming service grants it anything. KeyCape has no
+    per-client group gate, so every client that admits any authenticated user would admit it
+    too; none of the registered clients grants rights without a group.'
+  - KeyCape marks its tokens principal_type human (key-cape token.go); the account is
+    declared SERVICE in the service-identity declarations. Recorded, not changed here.
+  - Values are generated in memory by lane.py and written CAS=0; neither is printed,
+    logged or written to disk. The journey's receipts are value-free.
+  - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary
+    before the first write.
+  - No workload, Kubernetes or ESO reader exists; T10 needs a separate workload-kv-read request
+    for the executor identity.
+verification:
+  positive:
+  - The KV password signs in to LLDAP as syn-journey (compared without display)
+  - The synthetic journey passes against https://kc.coulomb.social at aal2 with the KV
+    values (lane.py verify), with a value-free receipt
+  negative:
+  - Coding-agent boundary denies data and metadata of the path
+  - No auth role or policy grants the path to a workload
+  - setup refuses if the KV path, the LLDAP user or the privacyIDEA token already exist
+  activation_conditions:
+  - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound
+    by lane.py).
+  - The KeyCape client nk-synthetic-journey registered through security-cases/nk-synthetic-journey.yaml
+    before lane.py verify.
+  - Attended platform-admin (aal2) session; the founder runs setup and verify.
+  - Positive and negative results recorded in value-free receipts.
+  evidence: []