CCR-2026-0057: approved (platform-owner, net-kingdom-owner)

Founder approval in session 2026-10-31 for NK-WP-0056-T09.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml

@@ -2,32 +2,43 @@ id: CCR-2026-0057
 kind: credential-change-request
 schema_version: 1
 request_type: attended-service-credential-delivery
-title: NetKingdom synthetic journey identity (syn-journey) password and TOTP seed custody
+title: NetKingdom synthetic journey identity (syn-journey) password and TOTP seed
-status: proposed
+  custody
+status: approved
 created: '2026-10-31'
 updated: '2026-10-31'
 requester:
   agent: claude-code
-  reason: 'NK-WP-0056-T09: a synthetic, unprivileged sign-in identity whose MFA journey through
+  reason: 'NK-WP-0056-T09: a synthetic, unprivileged sign-in identity whose MFA journey
-    KeyCape, Authelia and privacyIDEA replaces the founder''s sign-in as the check between
+    through KeyCape, Authelia and privacyIDEA replaces the founder''s sign-in as the
-    consumers in a bounded bind rotation (NK-WP-0056-T06). Its password and TOTP seed are
+    check between consumers in a bounded bind rotation (NK-WP-0056-T06). Its password
-    generated in memory and held only in OpenBao; LLDAP and privacyIDEA receive them through
+    and TOTP seed are generated in memory and held only in OpenBao; LLDAP and privacyIDEA
-    one attended procedure. No workload reads them until the executor identity exists (T03/T10),
+    receive them through one attended procedure. No workload reads them until the
-    which needs its own request.'
+    executor identity exists (T03/T10), which needs its own request.'
 review:
   required: true
   required_approvers:
   - platform-owner
   - net-kingdom-owner
-  comments: []
+  comments:
+  - at: '2026-10-31T11:50:37+00:00'
+    reviewer: platform-owner
+    decision: approved
+    comment: Approved by the founder in session 2026-10-31 ('i accept the ccr') for
+      NK-WP-0056-T09.
+  - at: '2026-10-31T11:50:37+00:00'
+    reviewer: net-kingdom-owner
+    decision: approved
+    comment: Approved by the founder in session 2026-10-31 ('i accept the ccr') for
+      NK-WP-0056-T09.
 target:
   domain: infotech
   tenant: platform
   workload: net-kingdom-synthetic-journey
   environment: production
-  purpose: Hold the password and TOTP seed of the LLDAP user syn-journey (no groups, no rights)
+  purpose: Hold the password and TOTP seed of the LLDAP user syn-journey (no groups,
-    so that a synthetic journey can prove sign-in with MFA without a person. No other identity,
+    no rights) so that a synthetic journey can prove sign-in with MFA without a person.
-    directory, privacyIDEA or service credential.
+    No other identity, directory, privacyIDEA or service credential.
 openbao:
   mount: platform
   kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey
@@ -46,10 +57,10 @@ access_frontdoor:
   readiness: pending-review
   resolvable: false
 lifecycle:
-  deactivate: lane.py teardown deletes the privacyIDEA token SYNJOURNEY01, the LLDAP user
+  deactivate: lane.py teardown deletes the privacyIDEA token SYNJOURNEY01, the LLDAP
-    syn-journey (refused if it has gained any group) and the KV entry with all versions;
+    user syn-journey (refused if it has gained any group) and the KV entry with all
-    the KeyCape client nk-synthetic-journey is removed with keycape-client.py --operation
+    versions; the KeyCape client nk-synthetic-journey is removed with keycape-client.py
-    remove. The coding-agent fence stays.
+    --operation remove. The coding-agent fence stays.
   rotate: Tear down and set up again (new password and seed, CAS=0 on the fresh path).
     No in-place rotation path in this request.
   compromised: Delete the privacyIDEA token first (the account then cannot pass MFA),
@@ -57,38 +68,41 @@ lifecycle:
     no protected service.
 delivery:
   surface: attended-service-config
-  service: LLDAP (sso) user syn-journey; privacyIDEA (mfa) TOTP token SYNJOURNEY01 in realm
+  service: LLDAP (sso) user syn-journey; privacyIDEA (mfa) TOTP token SYNJOURNEY01
-    coulomb
+    in realm coulomb
-  target: the LLDAP user's password (set with the pinned lldap_set_password, OPAQUE) and the
+  target: the LLDAP user's password (set with the pinned lldap_set_password, OPAQUE)
-    privacyIDEA token's OTP key (stored encrypted in the privacyIDEA database)
+    and the privacyIDEA token's OTP key (stored encrypted in the privacyIDEA database)
   procedure: net-kingdom sso-mfa/k8s/synthetic-journey/lane.py setup
-  gate: attended platform-admin (aal2) OpenBao session, the human admin's LLDAP password, the
+  gate: attended platform-admin (aal2) OpenBao session, the human admin's LLDAP password,
-    attended pi-admin password, and a passing synthetic journey (lane.py verify) against
+    the attended pi-admin password, and a passing synthetic journey (lane.py verify)
-    the live issuer
+    against the live issuer
 risk:
   classification: medium
   notes:
-  - 'The identity is new and holds no group. Authelia admits it (it is not svc-* or ld-admin),
+  - The identity is new and holds no group. Authelia admits it (it is not svc-* or
-    KeyCape issues it tokens, but no consuming service grants it anything. KeyCape has no
+    ld-admin), KeyCape issues it tokens, but no consuming service grants it anything.
-    per-client group gate, so every client that admits any authenticated user would admit it
+    KeyCape has no per-client group gate, so every client that admits any authenticated
-    too; none of the registered clients grants rights without a group.'
+    user would admit it too; none of the registered clients grants rights without
-  - KeyCape marks its tokens principal_type human (key-cape token.go); the account is
+    a group.
-    declared SERVICE in the service-identity declarations. Recorded, not changed here.
+  - KeyCape marks its tokens principal_type human (key-cape token.go); the account
+    is declared SERVICE in the service-identity declarations. Recorded, not changed
+    here.
   - Values are generated in memory by lane.py and written CAS=0; neither is printed,
     logged or written to disk. The journey's receipts are value-free.
   - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary
     before the first write.
-  - No workload, Kubernetes or ESO reader exists; T10 needs a separate workload-kv-read request
+  - No workload, Kubernetes or ESO reader exists; T10 needs a separate workload-kv-read
-    for the executor identity.
+    request for the executor identity.
 verification:
   positive:
   - The KV password signs in to LLDAP as syn-journey (compared without display)
-  - The synthetic journey passes against https://kc.coulomb.social at aal2 with the KV
+  - The synthetic journey passes against https://kc.coulomb.social at aal2 with the
-    values (lane.py verify), with a value-free receipt
+    KV values (lane.py verify), with a value-free receipt
   negative:
   - Coding-agent boundary denies data and metadata of the path
   - No auth role or policy grants the path to a workload
-  - setup refuses if the KV path, the LLDAP user or the privacyIDEA token already exist
+  - setup refuses if the KV path, the LLDAP user or the privacyIDEA token already
+    exist
   activation_conditions:
   - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound
     by lane.py).