CCR-2026-0064: founder approvals, binding confirmation (uid 180a2463) and delegated apply

Approved as platform-owner and net-kingdom-owner 2026-11-06; binding confirmed for sso/nk-window-watch
(the first binding entry named no uid; the second corrects it); applier-apply passed through the
warden platform-admin lane; status applied. NK-WP-0058-T06.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

credential-change-requests/CCR-2026-0064-nk-bounded-executor-window-watch.yaml

@@ -2,31 +2,53 @@ id: CCR-2026-0064
 kind: credential-change-request
 schema_version: 1
 request_type: auth-role-presence-watch
-title: 'nk-window-watch: flag the CCR-2026-0058 write role when it outlives its run (read-only)'
-status: proposed
+title: 'nk-window-watch: flag the CCR-2026-0058 write role when it outlives its run
+  (read-only)'
+status: applied
 created: '2026-11-06'
 updated: '2026-11-06'
 requester:
   agent: net-kingdom
-  reason: net-kingdom NK-WP-0058-T06 (contract row O5). On 2026-11-04/05 the window-scoped write role of
-    CCR-2026-0058 stayed open overnight; T11 confirmed no use. A watcher in sso
-    (net-kingdom bounded-executor/window_watch.py, rapp-bounded-executor manifests/window-watch.yaml) checks every
-    10 minutes whether the role exists while no bounded-executor run Job is active or recent, and flags it.
-    Drafted by net-kingdom on the founder's instruction (2026-11-06), for platform-owner review. Not approved.
+  reason: net-kingdom NK-WP-0058-T06 (contract row O5). On 2026-11-04/05 the window-scoped
+    write role of CCR-2026-0058 stayed open overnight; T11 confirmed no use. A watcher
+    in sso (net-kingdom bounded-executor/window_watch.py, rapp-bounded-executor manifests/window-watch.yaml)
+    checks every 10 minutes whether the role exists while no bounded-executor run
+    Job is active or recent, and flags it. Drafted by net-kingdom on the founder's
+    instruction (2026-11-06), for platform-owner review. Not approved.
 review:
   required: true
   required_approvers:
   - platform-owner
   - net-kingdom-owner
-  comments: []
+  comments:
+  - at: '2026-11-06T09:15:09+00:00'
+    reviewer: platform-owner
+    decision: approved
+    comment: 'Approved by the founder 2026-11-06: read-only window watch for the CCR-2026-0058
+      write role, NK-WP-0058-T06.'
+  - at: '2026-11-06T09:15:14+00:00'
+    reviewer: net-kingdom-owner
+    decision: approved
+    comment: Approved by the founder 2026-11-06 for NK-WP-0058-T06.
+  - at: '2026-11-06T09:17:34+00:00'
+    reviewer: platform-owner
+    decision: binding_confirmed
+    comment: 'Binding confirmed: ServiceAccount nk-window-watch in namespace sso only
+      (uid UID), audience openbao, from rapp-bounded-executor.'
+  - at: '2026-11-06T09:23:42+00:00'
+    reviewer: platform-owner
+    decision: binding_confirmed
+    comment: 'Binding confirmed (corrects the entry above, which named no uid): ServiceAccount
+      nk-window-watch in namespace sso only (uid 180a2463-0e44-4d93-b360-2a494d02f0f0),
+      audience openbao, from rapp-bounded-executor.'
 target:
   domain: infotech
   tenant: platform
   workload: net-kingdom-bounded-executor-window-watch
   rapp: rapp-bounded-executor
   environment: production
-  purpose: Let only the ServiceAccount sso/nk-window-watch read whether the role
-    net-kingdom-bind-executor-svc-authelia-write exists; no other path, no list, no write, no value
+  purpose: Let only the ServiceAccount sso/nk-window-watch read whether the role net-kingdom-bind-executor-svc-authelia-write
+    exists; no other path, no list, no write, no value
 openbao:
   policy_name: net-kingdom-bounded-executor-window-watch
   policy_file: openbao/policies/net-kingdom-bounded-executor-window-watch.hcl
@@ -50,47 +72,63 @@ openbao:
       - nk-window-watch
       service_account_namespaces:
       - sso
-    bound_claims_confirmed: false
+    bound_claims_confirmed: true
 access_frontdoor:
   type: platform-owner
   catalog_id: bounded-executor-window-watch
   readiness: pending-review
   resolvable: false
 lifecycle:
-  role_window: Standing. The watcher logs in once per run (every 10 minutes), reads one role path and revokes its
-    token at exit.
-  close_mode: Mode close would add delete on the same single path, so the watcher removes a stale write role
-    itself. It only ever reduces privilege, but it is an unattended write on an auth role, so it needs its own
-    founder and platform-owner decision and an amendment of this CCR.
+  role_window: Standing. The watcher logs in once per run (every 10 minutes), reads
+    one role path and revokes its token at exit.
+  close_mode: Mode close would add delete on the same single path, so the watcher
+    removes a stale write role itself. It only ever reduces privilege, but it is an
+    unattended write on an auth role, so it needs its own founder and platform-owner
+    decision and an amendment of this CCR.
   deactivate: Delete the role, then the policy; remove the CronJob (rapp-bounded-executor).
   rotate: Nothing to rotate; the login uses the projected ServiceAccount token.
-  compromised: Delete the role. The reachable information is whether one role exists and its parameters.
+  compromised: Delete the role. The reachable information is whether one role exists
+    and its parameters.
 delivery:
   surface: native-workload-login
   namespace: sso
   service_account: nk-window-watch
-  reader: The window watch CronJob (net-kingdom bounded-executor/window_watch.py in the pinned executor image,
-    deployed by rapp-bounded-executor make deploy-window-watch); it prints one value-free line per run
+  reader: The window watch CronJob (net-kingdom bounded-executor/window_watch.py in
+    the pinned executor image, deployed by rapp-bounded-executor make deploy-window-watch);
+    it prints one value-free line per run
 risk:
   classification: low
   notes:
-  - Reachable data is the parameters of one Kubernetes-auth role (bound ServiceAccount, policies, TTLs), no
-    secret value and no token.
-  - The role is separate from the CCR-2026-0058/0059/0061 roles; policies are never combined in one role.
-  - Node root, cluster admins able to mint tokens for sso/nk-window-watch and platform-admin remain inside this
-    boundary.
+  - Reachable data is the parameters of one Kubernetes-auth role (bound ServiceAccount,
+    policies, TTLs), no secret value and no token.
+  - The role is separate from the CCR-2026-0058/0059/0061 roles; policies are never
+    combined in one role.
+  - Node root, cluster admins able to mint tokens for sso/nk-window-watch and platform-admin
+    remain inside this boundary.
 verification:
   positive:
   - Exact policy and role read back (credential-change.py applier-apply readback)
-  - The watch CronJob's next run reports ok (no write role outside a run), visible as a succeeded Job to
-    sso/nk-agent-status
+  - The watch CronJob's next run reports ok (no write role outside a run), visible
+    as a succeeded Job to sso/nk-agent-status
   negative:
   - Reading any other auth role, KV path or sys path is refused
   - Writing or deleting the watched role is refused in mode flag
   - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
   activation_conditions:
   - Explicit platform-owner and net-kingdom-owner approval of this exact request.
-  - ServiceAccount sso/nk-window-watch exists (rapp-bounded-executor make deploy-window-watch), then
-    bound_claims_confirmed set to true by the platform-owner with its uid.
-  - Attended platform-admin (aal2) session or the delegated applier applies policy and role from a reviewed
-    commit; results recorded value-free.
+  - ServiceAccount sso/nk-window-watch exists (rapp-bounded-executor make deploy-window-watch),
+    then bound_claims_confirmed set to true by the platform-owner with its uid.
+  - Attended platform-admin (aal2) session or the delegated applier applies policy
+    and role from a reviewed commit; results recorded value-free.
+  evidence:
+  - at: '2026-11-06T09:24:26+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy write: sys/policies/acl/net-kingdom-bounded-executor-window-watch (flag
+      on auth/kubernetes/role/net-kingdom-bind-executor-svc-authelia-write)'
+    - 'Kubernetes auth role write: auth/kubernetes/role/net-kingdom-bounded-executor-window-watch'
+    - Readback matched source for policy and role.
+    - No secret values were read, written, printed, or accepted in argv.