CCR-2026-0059 applied, CCR-2026-0058 policy set up; RPF-WP-0069-T04 done

Founder-run net-kingdom executor-lanes.py (setup lanes_prepared, verify
lanes_verified; evidence net-kingdom ef6284c). 0059 verified after its first
journey run (NK-WP-0056-T10). 0058 role stays per admitted window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml

@@ -174,3 +174,15 @@ verification:
     window and deletes it after the receipt (or at window end); both steps are recorded
     with the admission id.
   - Positive and negative results recorded in value-free receipts.
+  evidence:
+  - at: '2026-10-31T18:48:55+00:00'
+    actor: founder (attended), claude-code guiding
+    kind: executor_lane_policy_setup
+    result: passed
+    details:
+    - '2026-10-31: policy applied and cas_required set on the svc-authelia key (metadata
+      write naming only cas_required; max_versions, delete_version_after and custom_metadata
+      unchanged) by net-kingdom tools/service-binds/executor-lanes.py; the window-scoped
+      role was not created and its login is denied (verified). Role creation remains
+      per admitted window. Evidence: net-kingdom docs/evidence/2026-10-31-nk56-t10-executor-lanes/
+      (ef6284c).'

credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey)
-status: approved
+status: applied
 created: '2026-10-31'
 updated: '2026-10-31'
 requester:
@@ -144,3 +144,16 @@ verification:
   - Attended platform-admin (aal2) session applies the policy and role from a reviewed
     commit.
   - Positive and negative results recorded in value-free receipts.
+  evidence:
+  - at: '2026-10-31T18:48:55+00:00'
+    actor: founder (attended), claude-code guiding
+    kind: executor_lane_setup_and_proof
+    result: passed
+    details:
+    - '2026-10-31: policy and standing role applied by net-kingdom tools/service-binds/executor-lanes.py
+      setup (lanes_prepared); verify (lanes_verified): sso/nk-bind-executor audience
+      openbao gets exactly this policy, lease <=15m, reads only syn-journey data (fields
+      checked in memory), metadata/directory-binds/token-create denied, default SA,
+      wrong audience and write-role login denied, coding-agent fence effective. The
+      positive journey run through this role is the open part of NK-WP-0056-T10. Evidence:
+      net-kingdom docs/evidence/2026-10-31-nk56-t10-executor-lanes/ (ef6284c).'