codex f3b0c4f4b2 RPF-WP-0069-T05/T09/T10: bounded executor credential go-live runbook (NK-WP-0056-T06) ... - CCR-2026-0063: NetKingdom's answer recorded (ESO as drafted); delivery aligned to the Secret the rapp Job mounts (sso/bounded-executor-tokens, key audit-core); reader role in the CCR-2026-0033/0041/0060 shape (audience openbao, explicit max TTL, self-lifecycle); custody_procedure names audit-core's seeder (one seeder only). - CCR-2026-0060: delivery block (store rendered from the issuer template); fence step named. - manifests/nk-bind-executor-eso.yaml: two sso-restricted stores and ExternalSecrets. - scripts/nk_bind_executor_custody.py plan|fence|verify with synthetic-fixture tests. - Source coding-agent boundary carries the KeyCape nk-bind-executor-approval path. - docs/credential-lane-designs/nk-bind-executor-go-live.md: exact founder sequence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350		2026-11-04 01:59:30 +01:00
..
templates	feat: declare proposed fixed KeyCape issuer ESO source contract	2026-10-17 20:36:52 +02:00
factory-audit-senders.yaml	fix(security): prevent ESO copying source annotations (CUST-WP-0073)	2026-09-28 15:56:50 +02:00
keycape-factor-custody.yaml	fix(security): prevent ESO copying source annotations (CUST-WP-0073)	2026-09-28 15:56:50 +02:00
nk-bind-executor-eso.yaml	RPF-WP-0069-T05/T09/T10: bounded executor credential go-live runbook (NK-WP-0056-T06)	2026-11-04 01:59:30 +01:00
rapp-qonto-audit-sender.yaml	Record explicit owner approval for exact Qonto custody packet	2026-10-15 21:27:32 +02:00
whitehat-audit-e2-projection-02.yaml	Bind audit E2 retry projection to new engagement	2026-08-22 20:56:58 +02:00
whitehat-audit-e2-projection.yaml	Add attended Whitehat E2 credential projection	2026-08-22 12:59:38 +02:00