CCR-2026-0059 (proposed): bounded executor reads the syn-journey identity

workload-kv-read for platform/workloads/net-kingdom/synthetic-journey/syn-journey:
read on the data path only, own role bound to sso/nk-bind-executor (audience
openbao, 15m), separate from the CCR-2026-0058 write role. Widens
CCR-2026-0057 runtime_access (stated). Standing reader proposed; founder
decides. RPF-WP-0069-T04 updated. Not approved, not applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

credential-change-requests/CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml

@@ -0,0 +1,133 @@
+id: CCR-2026-0059
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey)
+status: proposed
+created: '2026-10-31'
+updated: '2026-10-31'
+requester:
+  agent: claude-code
+  reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs the
+    synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after each
+    consumer restart, with no person signing in. It needs the syn-journey password
+    and TOTP seed held under CCR-2026-0057. Lane design: railiance-platform docs/credential-lane-designs/bounded-executor.md
+    "Journey secrets (T10)". Drafted by net-kingdom; not approved.'
+review:
+  required: true
+  required_approvers:
+  - platform-owner
+  - net-kingdom-owner
+  comments: []
+supersedes_boundary:
+  ccr: CCR-2026-0057
+  field: openbao.runtime_access
+  was: false
+  change: 'This request gives one workload reader to the path CCR-2026-0057 holds with
+    runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation
+    stay valid and unchanged; its rotate (teardown + setup) does not need this role.'
+target:
+  domain: infotech
+  tenant: platform
+  workload: net-kingdom-bind-executor
+  rapp: rapp-bounded-executor
+  environment: production
+  purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the syn-journey
+    PASSWORD and TOTP_SEED to run the synthetic journey; no write, metadata, list,
+    sibling path, or other identity
+admission:
+  standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
+  executor_identity: service:nk-bind-executor
+  example: net-kingdom examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
+  note: The journey is a check step under an admission. The OpenBao role does not
+    evaluate the admission; it bounds what the ServiceAccount can read to one synthetic,
+    group-less identity.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey
+  fields:
+  - PASSWORD
+  - TOTP_SEED
+  policy_name: net-kingdom-bind-executor-syn-journey-read
+  policy_file: openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl
+  metadata_read: false
+  token_self_lifecycle: true
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: net-kingdom-bind-executor-syn-journey-read
+    audience: openbao
+    ttl: 15m
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+    policies:
+    - net-kingdom-bind-executor-syn-journey-read
+    bound_claims:
+      service_account_names:
+      - nk-bind-executor
+      service_account_namespaces:
+      - sso
+    bound_claims_confirmed: false
+access_frontdoor:
+  type: platform-owner
+  catalog_id: net-kingdom-bind-executor-syn-journey-read
+  readiness: pending-review
+  resolvable: false
+agent_fence:
+  data_and_metadata_denied: true
+  note: The syn-journey data and metadata paths are denied to coding agents since CCR-2026-0057;
+    setup re-checks the deny before the role is created.
+lifecycle:
+  role_window: 'Standing (proposed; founder decides). Unlike the CCR-2026-0058 write
+    role, this role only reads a group-less synthetic identity, and a standing reader
+    lets the journey run as a scheduled check (T10) without a platform-admin per run.
+    Alternative: window-scoped like CCR-2026-0058, created and deleted with each admitted
+    run.'
+  deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the
+    privacyIDEA token stay under CCR-2026-0057.
+  rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change,
+    because the path stays the same.
+  compromised: Delete the privacyIDEA token SYNJOURNEY01 first (the account then cannot
+    pass MFA), delete this role, then tear down and set up as in CCR-2026-0057. The
+    identity has no groups, so a leak grants a sign-in that reaches no protected service.
+delivery:
+  surface: native-workload-login
+  namespace: sso
+  service_account: nk-bind-executor
+  reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
+    logs in with its projected ServiceAccount token, audience openbao, separately from
+    the CCR-2026-0058 write role; values stay in memory and never reach a Secret, log
+    or receipt
+  manifest: 'rapp-bounded-executor: manifests/rbac.yaml, templates/job.yaml'
+risk:
+  classification: low
+  notes:
+  - Reachable value is one synthetic identity with no groups. Authelia and KeyCape
+    admit it, but no consuming service grants it anything (CCR-2026-0057 risk notes).
+  - A reader holding both values can complete an MFA sign-in as syn-journey, which is
+    the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use and
+    the journey can race; the journey then fails closed.
+  - The role is separate from the CCR-2026-0058 write role and from the ESO reader
+    (CCR-2026-0053); policies are never combined in one role.
+  - Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
+    remain inside this credential boundary.
+verification:
+  positive:
+  - Exact policy and role read back; login as sso/nk-bind-executor (audience openbao)
+    gets only this policy with a lease of at most 15m
+  - The synthetic journey passes at aal2 with the values read through this role, with
+    a value-free receipt
+  negative:
+  - Write, metadata read, list, delete and sibling paths (including directory-binds)
+    are refused
+  - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
+  - Coding-agent boundary denies data and metadata of the path
+  activation_conditions:
+  - Explicit platform-owner and net-kingdom-owner approval of this exact request, which
+    includes the change to CCR-2026-0057's runtime_access boundary.
+  - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-bounded-executor
+    package (bound_claims_confirmed then set to true by the platform-owner).
+  - Attended platform-admin (aal2) session applies the policy and role from a reviewed
+    commit.
+  - Positive and negative results recorded in value-free receipts.

openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl

@@ -0,0 +1,3 @@
+path "platform/data/workloads/net-kingdom/synthetic-journey/syn-journey" { capabilities = ["read"] }
+path "auth/token/lookup-self" { capabilities = ["read"] }
+path "auth/token/revoke-self" { capabilities = ["update"] }

workplans/RPF-WP-0069-bounded-executor-lanes.md

@@ -78,7 +78,7 @@ id: RPF-WP-0069-T04
 status: wait
 priority: medium
 blocked_on: human
-blocking_reason: "Founder accepts widening CCR-2026-0057 runtime_access; scheduled with NK-WP-0056-T10 once sso/nk-bind-executor exists"
+blocking_reason: "CCR-2026-0059 drafted (proposed): founder approval (platform-owner, net-kingdom-owner) incl. the CCR-2026-0057 runtime_access widening and the standing-vs-window role choice; apply needs sso/nk-bind-executor (rapp-bounded-executor make deploy)"
 state_hub_task_id: "5615be47-2b25-5f7d-a1c2-d4391b1377d0"
 ```
 
@@ -86,6 +86,18 @@ Draft a `workload-kv-read` CCR (native login, data read only, 15m) for
 `platform/workloads/net-kingdom/synthetic-journey/syn-journey`, stating that it widens
 CCR-2026-0057's `runtime_access: false`. Waits for T10 scheduling and the ServiceAccount.
 
+**2026-10-31, drafted** at the founder's request (net-kingdom session):
+
+- `CCR-2026-0059-net-kingdom-bind-executor-syn-journey-read.yaml` and the policy
+  `openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl`: read on the data path, plus
+  `lookup-self` and `revoke-self`.
+- Role `net-kingdom-bind-executor-syn-journey-read`: `sso/nk-bind-executor`, audience `openbao`, 15m, exactly one
+  policy. It is separate from the CCR-2026-0058 write role.
+- `supersedes_boundary` names the CCR-2026-0057 change.
+- `lifecycle.role_window` proposes a standing reader (founder decides; window-scoped is the alternative).
+- `bound_claims_confirmed: false` until the ServiceAccount exists. Validates with only that warning. The
+  pre-existing failures (CCR-2026-0035 and 2 tests) are unrelated.
+
 ## Executor audit-core sender (NK-WP-0040)
 
 ```task