CCR-2026-0058: window-scoped write role and bind self-rotation (founder decisions 2026-10-31)

Role created per admitted run for its window and deleted after the receipt;
the bind changes its own password, no lldap_password_manager account.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml

@@ -76,11 +76,19 @@ agent_fence:
   note: The svc-authelia data and metadata paths are already denied to coding agents
     since CCR-2026-0053; setup re-checks the deny before the role is created.
 lifecycle:
+  role_window: 'Window-scoped (founder decision 2026-10-31, hub c29c6eda): the policy is
+    applied once and grants nothing on its own; the Kubernetes-auth role is created by
+    the attended platform-admin when an admission naming this lane is approved, bounded
+    to that admission''s window, and deleted after the run''s receipt or at window end,
+    whichever comes first. No write role exists between admitted runs.'
   deactivate: Delete the role, then the policy; the KV entry and the ESO reader lane
     (CCR-2026-0053) are unchanged. The bind falls back to founder-run rotation.
-  rotate: Executor reads the current version N, sets the new password in LLDAP, writes
-    version N+1 with options.cas=N; ESO projects it, Authelia restarts, the synthetic
-    journey proves sign-in. Revert writes the prior value as version N+2 with options.cas=N+1.
+  rotate: Executor reads the current version N, signs in to LLDAP as svc-authelia with
+    it and changes that account's own password (self-rotation, founder decision 2026-10-31,
+    hub 3d0c8f86; no lldap_password_manager account), writes version N+1 with options.cas=N;
+    ESO projects it, Authelia restarts, the synthetic journey proves sign-in. Revert
+    changes the password back the same way and writes the prior value as version N+2
+    with options.cas=N+1.
   compromised: Delete the role first (stops new logins; existing tokens expire within
     15m, or revoke by accessor), then reset svc-authelia in LLDAP and rotate attended
     as in CCR-2026-0053.
@@ -94,10 +102,11 @@ delivery:
 risk:
   classification: medium
   notes:
-  - A standing write role on the svc-authelia bind is new; until now only the attended
-    platform-admin wrote this path. A compromised executor ServiceAccount can replace
-    the bind value (Authelia sign-in outage on next restart) but cannot read any other
-    path, create paths, delete versions or read metadata.
+  - A write role on the svc-authelia bind is new; until now only the attended
+    platform-admin wrote this path. It exists only during an admitted window. Within it,
+    a compromised executor ServiceAccount can replace the bind value (Authelia sign-in
+    outage on next restart) but cannot read any other path, create paths, delete versions
+    or read metadata; outside it, the ServiceAccount cannot log in to this role at all.
   - cas_required on the key makes every write state the version it replaces; a racing
     or replayed write is refused by the engine, not by the executor.
   - The executor also reads the current value (needed for CAS and revert). svc-authelia
@@ -124,5 +133,8 @@ verification:
   - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-* package
     (bound_claims_confirmed then set to true by the platform-owner).
   - Attended platform-admin (aal2) session sets cas_required on the key and applies
-    policy and role from a reviewed commit.
+    the policy once from a reviewed commit.
+  - Per admitted run, the attended platform-admin creates the role for the admission's
+    window and deletes it after the receipt (or at window end); both steps are recorded
+    with the admission id.
   - Positive and negative results recorded in value-free receipts.