From 5dd1d6875bef6ea534aa3d6927e6ec5e576c8506 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 10:11:39 +0100 Subject: [PATCH] CCR-2026-0053: verified (setup, ESO delivery and verify passed; net-kingdom 7f37e25) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2 --- .../CCR-2026-0053-net-kingdom-authelia-bind.yaml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml b/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml index f72d4d8..7001883 100644 --- a/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml +++ b/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: NetKingdom Authelia directory bind (svc-authelia) delivery -status: approved +status: verified created: '2026-10-31' updated: '2026-10-31' requester: @@ -127,4 +127,15 @@ verification: from the decrypted custody copy without display. - Policy, role and KV in place and equal to live before the ExternalSecret is applied. - Positive and negative results recorded in value-free receipts. - evidence: [] + evidence: + - at: '2026-10-31T09:11:39+00:00' + actor: founder (attended), claude-code guiding + kind: verifier_custody_and_rollout + result: passed + details: + - '2026-10-31: bind-lane.py setup (live authelia-config binds svc-authelia, custody + equal to live, coding agents fenced, KV v1 CAS=0, policy+role) and verify (exact + policy/TTL, wrong SA and audience denied, metadata/sibling/token-create denied, + KV equals delivered ldap_password, reader revoked) passed; ExternalSecret Ready + on first apply; Authelia restarted and admin signed in with OTP. Evidence: net-kingdom + docs/evidence/2026-10-31-nk56-svc-authelia-bind/ (7f37e25).'