CCR-2026-0055 (proposed) and request type attended-service-credential-delivery

A value held in platform custody that no workload reads, delivered into a
service by an attended, MFA-gated procedure (privacyIDEA resolver bind for
NetKingdom NK-WP-0056-T04). The contract forbids any policy, auth role, ESO
object or runtime frontdoor. Modelled on attended-host-key-delivery. 4 tests.
The 3 failures in test_credential_change.py also occur on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

docs/credential-lane-designs/attended-service-credential-delivery.md

@@ -0,0 +1,21 @@
+# Attended service credential delivery
+
+Request type `attended-service-credential-delivery` (`scripts/attended_service_delivery.py`), first used by
+CCR-2026-0055 (NetKingdom `svc-privacyidea`, NK-WP-0056-T04).
+
+Some services keep a credential in their own encrypted store and accept it only through an administrator API
+that requires a person's MFA. privacyIDEA's LDAP resolver is one: its `BINDPW` lives encrypted in the
+privacyIDEA database and only `pi-admin` with a fresh code may change it. ESO cannot deliver such a value, and an
+unattended job would need an administrator credential without MFA.
+
+The contract therefore holds the value in OpenBao and nothing else:
+
+- `openbao.auth` is the attended `platform-admin` OIDC session on `netkingdom`; `runtime_access: false`;
+  `initial_cas: 0`. No policy, auth role, ESO object or other access may be declared.
+- The runtime frontdoor stays disabled (`access_frontdoor.resolvable: false`).
+- `delivery` names the service, the target inside it, the owner's procedure and the gate (the person's MFA).
+- Approval follows `review.required_approvers`; from `applied` onward every listed role must have approved.
+
+The owner's procedure reads the value in memory under the attended session and writes it into the service; the
+person's MFA remains the gate. A rotation needs no decrypted custody copy. Modelled on
+`attended-host-key-delivery` (CCR-2026-0028), which delivers to a host file instead of a service.