railiance-platform/credential-change-requests/CCR-2026-0057-net-kingdom-synthetic-journey-identity.yaml

id: CCR-2026-0057
kind: credential-change-request
schema_version: 1
request_type: attended-service-credential-delivery
title: NetKingdom synthetic journey identity (syn-journey) password and TOTP seed
  custody
status: verified
created: '2026-10-31'
updated: '2026-10-31'
requester:
  agent: claude-code
  reason: 'NK-WP-0056-T09: a synthetic, unprivileged sign-in identity whose MFA journey
    through KeyCape, Authelia and privacyIDEA replaces the founder''s sign-in as the
    check between consumers in a bounded bind rotation (NK-WP-0056-T06). Its password
    and TOTP seed are generated in memory and held only in OpenBao; LLDAP and privacyIDEA
    receive them through one attended procedure. No workload reads them until the
    executor identity exists (T03/T10), which needs its own request.'
review:
  required: true
  required_approvers:
  - platform-owner
  - net-kingdom-owner
  comments:
  - at: '2026-10-31T11:50:37+00:00'
    reviewer: platform-owner
    decision: approved
    comment: Approved by the founder in session 2026-10-31 ('i accept the ccr') for
      NK-WP-0056-T09.
  - at: '2026-10-31T11:50:37+00:00'
    reviewer: net-kingdom-owner
    decision: approved
    comment: Approved by the founder in session 2026-10-31 ('i accept the ccr') for
      NK-WP-0056-T09.
target:
  domain: infotech
  tenant: platform
  workload: net-kingdom-synthetic-journey
  environment: production
  purpose: Hold the password and TOTP seed of the LLDAP user syn-journey (no groups,
    no rights) so that a synthetic journey can prove sign-in with MFA without a person.
    No other identity, directory, privacyIDEA or service credential.
openbao:
  mount: platform
  kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey
  fields:
  - PASSWORD
  - TOTP_SEED
  auth:
    method: attended-oidc
    mount: netkingdom
    role: platform-admin
  runtime_access: false
  initial_cas: 0
access_frontdoor:
  type: attended-service-config
  catalog_id: openbao-platform-admin-login
  readiness: pending-review
  resolvable: false
lifecycle:
  deactivate: lane.py teardown deletes the privacyIDEA token SYNJOURNEY01, the LLDAP
    user syn-journey (refused if it has gained any group) and the KV entry with all
    versions; the KeyCape client nk-synthetic-journey is removed with keycape-client.py
    --operation remove. The coding-agent fence stays.
  rotate: Tear down and set up again (new password and seed, CAS=0 on the fresh path).
    No in-place rotation path in this request.
  compromised: Delete the privacyIDEA token first (the account then cannot pass MFA),
    then tear down. The identity has no groups, so a leak grants a sign-in that reaches
    no protected service.
delivery:
  surface: attended-service-config
  service: LLDAP (sso) user syn-journey; privacyIDEA (mfa) TOTP token SYNJOURNEY01
    in realm coulomb
  target: the LLDAP user's password (set with the pinned lldap_set_password, OPAQUE)
    and the privacyIDEA token's OTP key (stored encrypted in the privacyIDEA database)
  procedure: net-kingdom sso-mfa/k8s/synthetic-journey/lane.py setup
  gate: attended platform-admin (aal2) OpenBao session, the human admin's LLDAP password,
    the attended pi-admin password, and a passing synthetic journey (lane.py verify)
    against the live issuer
risk:
  classification: medium
  notes:
  - The identity is new and holds no group. Authelia admits it (it is not svc-* or
    ld-admin), KeyCape issues it tokens, but no consuming service grants it anything.
    KeyCape has no per-client group gate, so every client that admits any authenticated
    user would admit it too; none of the registered clients grants rights without
    a group.
  - KeyCape marks its tokens principal_type human (key-cape token.go); the account
    is declared SERVICE in the service-identity declarations. Recorded, not changed
    here.
  - Values are generated in memory by lane.py and written CAS=0; neither is printed,
    logged or written to disk. The journey's receipts are value-free.
  - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary
    before the first write.
  - No workload, Kubernetes or ESO reader exists; T10 needs a separate workload-kv-read
    request for the executor identity.
verification:
  positive:
  - The KV password signs in to LLDAP as syn-journey (compared without display)
  - The synthetic journey passes against https://kc.coulomb.social at aal2 with the
    KV values (lane.py verify), with a value-free receipt
  negative:
  - Coding-agent boundary denies data and metadata of the path
  - No auth role or policy grants the path to a workload
  - setup refuses if the KV path, the LLDAP user or the privacyIDEA token already
    exist
  activation_conditions:
  - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound
    by lane.py).
  - The KeyCape client nk-synthetic-journey registered through security-cases/nk-synthetic-journey.yaml
    before lane.py verify.
  - Attended platform-admin (aal2) session; the founder runs setup and verify.
  - Positive and negative results recorded in value-free receipts.
  evidence:
  - at: '2026-10-31T12:33:37+00:00'
    actor: founder (attended), claude-code guiding
    kind: verifier_identity_custody_and_journey
    result: passed
    details:
    - '2026-10-31: KeyCape client nk-synthetic-journey registered (SecurityCase accepted,
      net-kingdom d654f8a); lane.py setup (coding agents fenced, syn-journey with
      no groups, TOTP token SYNJOURNEY01 with a privacyIDEA-generated key confirmed
      by code, KV v1 CAS=0, no workload role) and verify (KV current by LLDAP sign-in,
      live synthetic journey passed at aal2 with otp) passed. One partial setup removed
      by lane.py teardown first. Evidence: net-kingdom docs/evidence/2026-10-31-nk56-t09-synthetic-identity/
      (661ab6a).'