From b4bafb0df88b4110aaa493e94758f49b852077b1 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 19:38:47 +0100 Subject: [PATCH] CCR-2026-0058/0059: binding confirmed (sso/nk-bind-executor uid bd15569c) ServiceAccount created by rapp-bounded-executor make deploy (founder, 2026-10-31); verify-live: role matches the net-kingdom ceiling. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- ...-0058-net-kingdom-bind-executor-svc-authelia-write.yaml | 7 ++++++- ...26-0059-net-kingdom-bind-executor-syn-journey-read.yaml | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml b/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml index 174db49..bdd2167 100644 --- a/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml +++ b/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml @@ -41,6 +41,11 @@ review: decision: approved comment: Re-approved by the founder in session 2026-10-31 with the corrected policy (required_parameters removed; NK-WP-0056-T12 synthetic pilot evidence). + - at: '2026-10-31T18:38:22+00:00' + reviewer: platform-owner + decision: binding_confirmed + comment: 'Binding confirmed: ServiceAccount nk-bind-executor in namespace sso + only (uid bd15569c-8a85-4625-b001-d9f799cb857b), audience openbao, from rapp-bounded-executor.' target: domain: infotech tenant: platform @@ -87,7 +92,7 @@ openbao: - nk-bind-executor service_account_namespaces: - sso - bound_claims_confirmed: false + bound_claims_confirmed: true access_frontdoor: type: platform-owner catalog_id: net-kingdom-bind-executor-svc-authelia-write diff --git a/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml index 9354652..5a1e500 100644 --- a/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml +++ b/credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml @@ -28,6 +28,11 @@ review: reviewer: net-kingdom-owner decision: approved comment: Approved by the founder 2026-10-31 for NK-WP-0056-T10/T06. + - at: '2026-10-31T18:38:23+00:00' + reviewer: platform-owner + decision: binding_confirmed + comment: 'Binding confirmed: ServiceAccount nk-bind-executor in namespace sso + only (uid bd15569c-8a85-4625-b001-d9f799cb857b), audience openbao, from rapp-bounded-executor.' supersedes_boundary: ccr: CCR-2026-0057 field: openbao.runtime_access @@ -77,7 +82,7 @@ openbao: - nk-bind-executor service_account_namespaces: - sso - bound_claims_confirmed: false + bound_claims_confirmed: true access_frontdoor: type: platform-owner catalog_id: net-kingdom-bind-executor-syn-journey-read