CCR-2026-0058: approved (platform-owner, net-kingdom-owner)

Founder approval in session 2026-10-31, as amended.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-write-next-version
 title: NetKingdom bounded executor writes the next svc-authelia bind version (pilot)
-status: proposed
+status: approved
 created: '2026-10-31'
 updated: '2026-10-31'
 requester:
@@ -11,25 +11,30 @@ requester:
   reason: 'NK-WP-0056-T02 owner request (hub 9d08288d), for NK-WP-0056-T06: the bounded
     executor service:nk-bind-executor rotates the svc-authelia LLDAP bind unattended
     under one founder admission (Bounded Execution Admission v0.1, proposed). The
-    executor must write the next KV version of the bind with CAS and read it back for
-    its checks and revert. Drafted by the railiance-platform worker; not approved.'
+    executor must write the next KV version of the bind with CAS and read it back
+    for its checks and revert. Drafted by the railiance-platform worker; not approved.'
 review:
   required: true
   required_approvers:
   - platform-owner
   - net-kingdom-owner
-  comments: []
+  comments:
+  - at: '2026-10-31T14:26:48+00:00'
+    reviewer: platform-owner
+    decision: approved
+    comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
+      role, bind self-rotation) for NK-WP-0056-T06.
 target:
   domain: infotech
   tenant: platform
   workload: net-kingdom-bind-executor
   environment: production
-  purpose: Let only the executor ServiceAccount sso/nk-bind-executor read and write the
-    next version of platform/workloads/net-kingdom/directory-binds/svc-authelia, with
-    CAS on the current version; no create, metadata, delete, destroy, list or sibling
-    path
+  purpose: Let only the executor ServiceAccount sso/nk-bind-executor read and write
+    the next version of platform/workloads/net-kingdom/directory-binds/svc-authelia,
+    with CAS on the current version; no create, metadata, delete, destroy, list or
+    sibling path
 admission:
-  standard: 'net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)'
+  standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
   executor_identity: service:nk-bind-executor
   example: net-kingdom examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
   note: The OpenBao role does not evaluate the admission. The admission (approval-engine
@@ -76,19 +81,19 @@ agent_fence:
   note: The svc-authelia data and metadata paths are already denied to coding agents
     since CCR-2026-0053; setup re-checks the deny before the role is created.
 lifecycle:
-  role_window: 'Window-scoped (founder decision 2026-10-31, hub c29c6eda): the policy is
-    applied once and grants nothing on its own; the Kubernetes-auth role is created by
-    the attended platform-admin when an admission naming this lane is approved, bounded
-    to that admission''s window, and deleted after the run''s receipt or at window end,
-    whichever comes first. No write role exists between admitted runs.'
+  role_window: 'Window-scoped (founder decision 2026-10-31, hub c29c6eda): the policy
+    is applied once and grants nothing on its own; the Kubernetes-auth role is created
+    by the attended platform-admin when an admission naming this lane is approved,
+    bounded to that admission''s window, and deleted after the run''s receipt or at
+    window end, whichever comes first. No write role exists between admitted runs.'
   deactivate: Delete the role, then the policy; the KV entry and the ESO reader lane
     (CCR-2026-0053) are unchanged. The bind falls back to founder-run rotation.
-  rotate: Executor reads the current version N, signs in to LLDAP as svc-authelia with
-    it and changes that account's own password (self-rotation, founder decision 2026-10-31,
-    hub 3d0c8f86; no lldap_password_manager account), writes version N+1 with options.cas=N;
-    ESO projects it, Authelia restarts, the synthetic journey proves sign-in. Revert
-    changes the password back the same way and writes the prior value as version N+2
-    with options.cas=N+1.
+  rotate: Executor reads the current version N, signs in to LLDAP as svc-authelia
+    with it and changes that account's own password (self-rotation, founder decision
+    2026-10-31, hub 3d0c8f86; no lldap_password_manager account), writes version N+1
+    with options.cas=N; ESO projects it, Authelia restarts, the synthetic journey
+    proves sign-in. Revert changes the password back the same way and writes the prior
+    value as version N+2 with options.cas=N+1.
   compromised: Delete the role first (stops new logins; existing tokens expire within
     15m, or revoke by accessor), then reset svc-authelia in LLDAP and rotate attended
     as in CCR-2026-0053.
@@ -96,17 +101,17 @@ delivery:
   surface: native-workload-login
   namespace: sso
   service_account: nk-bind-executor
-  reader: 'Executor runtime (net-kingdom source, rapp-* package per ADR-0015, NK-WP-0056-T03);
+  reader: Executor runtime (net-kingdom source, rapp-* package per ADR-0015, NK-WP-0056-T03);
     logs in with its projected ServiceAccount token, audience openbao; no Secret is
-    created by this request'
+    created by this request
 risk:
   classification: medium
   notes:
-  - A write role on the svc-authelia bind is new; until now only the attended
-    platform-admin wrote this path. It exists only during an admitted window. Within it,
-    a compromised executor ServiceAccount can replace the bind value (Authelia sign-in
-    outage on next restart) but cannot read any other path, create paths, delete versions
-    or read metadata; outside it, the ServiceAccount cannot log in to this role at all.
+  - A write role on the svc-authelia bind is new; until now only the attended platform-admin
+    wrote this path. It exists only during an admitted window. Within it, a compromised
+    executor ServiceAccount can replace the bind value (Authelia sign-in outage on
+    next restart) but cannot read any other path, create paths, delete versions or
+    read metadata; outside it, the ServiceAccount cannot log in to this role at all.
   - cas_required on the key makes every write state the version it replaces; a racing
     or replayed write is refused by the engine, not by the executor.
   - The executor also reads the current value (needed for CAS and revert). svc-authelia
@@ -130,8 +135,8 @@ verification:
   - Coding-agent boundary denies data and metadata of the path
   activation_conditions:
   - Explicit platform-owner and net-kingdom-owner approval of this exact request.
-  - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-* package
-    (bound_claims_confirmed then set to true by the platform-owner).
+  - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-* package (bound_claims_confirmed
+    then set to true by the platform-owner).
   - Attended platform-admin (aal2) session sets cas_required on the key and applies
     the policy once from a reviewed commit.
   - Per admitted run, the attended platform-admin creates the role for the admission's