CCR-2026-0059: approved (platform-owner, net-kingdom-owner)

Standing journey reader for NK-WP-0056-T10, accepting the CCR-2026-0057
runtime_access widening. Binding unconfirmed until sso/nk-bind-executor exists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml

@@ -3,14 +3,14 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey)
-status: proposed
+status: approved
 created: '2026-10-31'
 updated: '2026-10-31'
 requester:
   agent: claude-code
-  reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs the
-    synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after each
-    consumer restart, with no person signing in. It needs the syn-journey password
+  reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs
+    the synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after
+    each consumer restart, with no person signing in. It needs the syn-journey password
     and TOTP seed held under CCR-2026-0057. Lane design: railiance-platform docs/credential-lane-designs/bounded-executor.md
     "Journey secrets (T10)". Drafted by net-kingdom; not approved.'
 review:
@@ -18,13 +18,22 @@ review:
   required_approvers:
   - platform-owner
   - net-kingdom-owner
-  comments: []
+  comments:
+  - at: '2026-10-31T18:06:02+00:00'
+    reviewer: platform-owner
+    decision: approved
+    comment: 'Approved by the founder 2026-10-31: standing journey reader for NK-WP-0056-T10,
+      accepting the CCR-2026-0057 runtime_access widening.'
+  - at: '2026-10-31T18:06:12+00:00'
+    reviewer: net-kingdom-owner
+    decision: approved
+    comment: Approved by the founder 2026-10-31 for NK-WP-0056-T10/T06.
 supersedes_boundary:
   ccr: CCR-2026-0057
   field: openbao.runtime_access
   was: false
-  change: 'This request gives one workload reader to the path CCR-2026-0057 holds with
-    runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation
+  change: 'This request gives one workload reader to the path CCR-2026-0057 holds
+    with runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation
     stay valid and unchanged; its rotate (teardown + setup) does not need this role.'
 target:
   domain: infotech
@@ -76,13 +85,13 @@ access_frontdoor:
   resolvable: false
 agent_fence:
   data_and_metadata_denied: true
-  note: The syn-journey data and metadata paths are denied to coding agents since CCR-2026-0057;
-    setup re-checks the deny before the role is created.
+  note: The syn-journey data and metadata paths are denied to coding agents since
+    CCR-2026-0057; setup re-checks the deny before the role is created.
 lifecycle:
-  role_window: 'Standing (founder decision 2026-10-31, net-kingdom session). Unlike
+  role_window: Standing (founder decision 2026-10-31, net-kingdom session). Unlike
     the CCR-2026-0058 write role, this role only reads a group-less synthetic identity,
-    and a standing reader lets the journey run as a scheduled check (T10) without a
-    platform-admin per run.'
+    and a standing reader lets the journey run as a scheduled check (T10) without
+    a platform-admin per run.
   deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the
     privacyIDEA token stay under CCR-2026-0057.
   rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change,
@@ -95,18 +104,18 @@ delivery:
   namespace: sso
   service_account: nk-bind-executor
   reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
-    logs in with its projected ServiceAccount token, audience openbao, separately from
-    the CCR-2026-0058 write role; values stay in memory and never reach a Secret, log
-    or receipt
+    logs in with its projected ServiceAccount token, audience openbao, separately
+    from the CCR-2026-0058 write role; values stay in memory and never reach a Secret,
+    log or receipt
   manifest: 'rapp-bounded-executor: manifests/rbac.yaml, templates/job.yaml'
 risk:
   classification: low
   notes:
   - Reachable value is one synthetic identity with no groups. Authelia and KeyCape
     admit it, but no consuming service grants it anything (CCR-2026-0057 risk notes).
-  - A reader holding both values can complete an MFA sign-in as syn-journey, which is
-    the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use and
-    the journey can race; the journey then fails closed.
+  - A reader holding both values can complete an MFA sign-in as syn-journey, which
+    is the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use
+    and the journey can race; the journey then fails closed.
   - The role is separate from the CCR-2026-0058 write role and from the ESO reader
     (CCR-2026-0053); policies are never combined in one role.
   - Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
@@ -123,8 +132,8 @@ verification:
   - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
   - Coding-agent boundary denies data and metadata of the path
   activation_conditions:
-  - Explicit platform-owner and net-kingdom-owner approval of this exact request, which
-    includes the change to CCR-2026-0057's runtime_access boundary.
+  - Explicit platform-owner and net-kingdom-owner approval of this exact request,
+    which includes the change to CCR-2026-0057's runtime_access boundary.
   - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-bounded-executor
     package (bound_claims_confirmed then set to true by the platform-owner).
   - Attended platform-admin (aal2) session applies the policy and role from a reviewed