CCR-2026-0059 applied, CCR-2026-0058 policy set up; RPF-WP-0069-T04 done

Founder-run net-kingdom executor-lanes.py (setup lanes_prepared, verify
lanes_verified; evidence net-kingdom ef6284c). 0059 verified after its first
journey run (NK-WP-0056-T10). 0058 role stays per admitted window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

WORK-RECORDS.md

@@ -229,7 +229,7 @@
 | task | RPF-WP-0069-T01 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T02 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T03 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
-| task | RPF-WP-0069-T04 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
+| task | RPF-WP-0069-T04 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T05 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T06 | cancel | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T07 | todo | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |

credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml

@@ -174,3 +174,15 @@ verification:
     window and deletes it after the receipt (or at window end); both steps are recorded
     with the admission id.
   - Positive and negative results recorded in value-free receipts.
+  evidence:
+  - at: '2026-10-31T18:48:55+00:00'
+    actor: founder (attended), claude-code guiding
+    kind: executor_lane_policy_setup
+    result: passed
+    details:
+    - '2026-10-31: policy applied and cas_required set on the svc-authelia key (metadata
+      write naming only cas_required; max_versions, delete_version_after and custom_metadata
+      unchanged) by net-kingdom tools/service-binds/executor-lanes.py; the window-scoped
+      role was not created and its login is denied (verified). Role creation remains
+      per admitted window. Evidence: net-kingdom docs/evidence/2026-10-31-nk56-t10-executor-lanes/
+      (ef6284c).'

credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey)
-status: approved
+status: applied
 created: '2026-10-31'
 updated: '2026-10-31'
 requester:
@@ -144,3 +144,16 @@ verification:
   - Attended platform-admin (aal2) session applies the policy and role from a reviewed
     commit.
   - Positive and negative results recorded in value-free receipts.
+  evidence:
+  - at: '2026-10-31T18:48:55+00:00'
+    actor: founder (attended), claude-code guiding
+    kind: executor_lane_setup_and_proof
+    result: passed
+    details:
+    - '2026-10-31: policy and standing role applied by net-kingdom tools/service-binds/executor-lanes.py
+      setup (lanes_prepared); verify (lanes_verified): sso/nk-bind-executor audience
+      openbao gets exactly this policy, lease <=15m, reads only syn-journey data (fields
+      checked in memory), metadata/directory-binds/token-create denied, default SA,
+      wrong audience and write-role login denied, coding-agent fence effective. The
+      positive journey run through this role is the open part of NK-WP-0056-T10. Evidence:
+      net-kingdom docs/evidence/2026-10-31-nk56-t10-executor-lanes/ (ef6284c).'

workplans/RPF-WP-0069-bounded-executor-lanes.md

@@ -75,10 +75,8 @@ setup/verify; write it once approval exists. The founder runs it.
 
 ```task
 id: RPF-WP-0069-T04
-status: wait
+status: done
 priority: medium
-blocked_on: human
-blocking_reason: "CCR-2026-0059 approved 2026-10-31 (standing reader); apply needs sso/nk-bind-executor (rapp-bounded-executor make deploy), then confirm-binding and an attended platform-admin apply"
 state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
 ```
 
@@ -98,6 +96,16 @@ CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the Servic
 - `bound_claims_confirmed: false` until the ServiceAccount exists. Validates with only that warning. The
   pre-existing failures (CCR-2026-0035 and 2 tests) are unrelated.
 
+**Done 2026-10-31.**
+
+- Approved by the founder (`831a0f9`). The binding was confirmed after the rapp deploy (`b4bafb0`).
+- The founder ran net-kingdom `tools/service-binds/executor-lanes.py`:
+  - `setup`: the policy and standing role were applied; the CCR-2026-0058 policy and `cas_required` too.
+  - `verify`: exact policy, lease of at most 15m, reads only its path, and the negatives held.
+- CCR-2026-0059 is `applied`. It becomes `verified` after the first journey run through the role (NK-WP-0056-T10).
+- Finding: platform-admin has no `patch` on `platform/*`. KV metadata changes therefore use a write that names only the
+  changed field.
+
 ## Executor audit-core sender (NK-WP-0040)
 
 ```task