railiance-platform/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml

id: CCR-2026-0058
kind: credential-change-request
schema_version: 1
request_type: workload-kv-write-next-version
title: NetKingdom bounded executor writes the next svc-authelia bind version (pilot)
status: proposed
created: '2026-10-31'
updated: '2026-10-31'
requester:
  agent: claude-code
  reason: 'NK-WP-0056-T02 owner request (hub 9d08288d), for NK-WP-0056-T06: the bounded
    executor service:nk-bind-executor rotates the svc-authelia LLDAP bind unattended
    under one founder admission (Bounded Execution Admission v0.1, proposed). The
    executor must write the next KV version of the bind with CAS and read it back
    for its checks and revert. Drafted by the railiance-platform worker; not approved.'
review:
  required: true
  required_approvers:
  - platform-owner
  - net-kingdom-owner
  comments:
  - at: '2026-10-31T14:26:48+00:00'
    reviewer: platform-owner
    decision: approved
    comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
      role, bind self-rotation) for NK-WP-0056-T06.
  - at: '2026-10-31T14:27:33+00:00'
    reviewer: net-kingdom-owner
    decision: approved
    comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
      role, bind self-rotation) for NK-WP-0056-T06. Recorded by hand in the approve
      tool's format; the tool refuses the second approval for this request type once the
      first sets status approved.
target:
  domain: infotech
  tenant: platform
  workload: net-kingdom-bind-executor
  environment: production
  purpose: Let only the executor ServiceAccount sso/nk-bind-executor read and write
    the next version of platform/workloads/net-kingdom/directory-binds/svc-authelia,
    with CAS on the current version; no create, metadata, delete, destroy, list or
    sibling path
admission:
  standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
  executor_identity: service:nk-bind-executor
  example: net-kingdom examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
  note: The OpenBao role does not evaluate the admission. The admission (approval-engine
    consume, window, plan digest) is enforced by the executor and its owners; this
    request bounds what a compromised or unadmitted executor can reach to one value.
openbao:
  mount: platform
  kv_path: platform/workloads/net-kingdom/directory-binds/svc-authelia
  fields:
  - LDAP_BIND_PASSWORD
  policy_name: net-kingdom-bind-executor-svc-authelia-write
  policy_file: openbao/policies/net-kingdom-bind-executor-svc-authelia-write.hcl
  write:
    mode: next-version
    cas_required: true
    create: false
    metadata_read: false
    delete: false
    token_self_lifecycle: true
  auth:
    method: kubernetes
    mount: kubernetes
    role: net-kingdom-bind-executor-svc-authelia-write
    audience: openbao
    ttl: 15m
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
    policies:
    - net-kingdom-bind-executor-svc-authelia-write
    bound_claims:
      service_account_names:
      - nk-bind-executor
      service_account_namespaces:
      - sso
    bound_claims_confirmed: false
access_frontdoor:
  type: platform-owner
  catalog_id: net-kingdom-bind-executor-svc-authelia-write
  readiness: pending-review
  resolvable: false
agent_fence:
  data_and_metadata_denied: true
  note: The svc-authelia data and metadata paths are already denied to coding agents
    since CCR-2026-0053; setup re-checks the deny before the role is created.
amendments:
- at: '2026-10-31'
  by: claude-code
  change: 'Policy file corrected: removed required_parameters = ["options"]. OpenBao 2.5.4
    applies it to reads as well, so the executor could not read the version it must name for CAS
    (net-kingdom NK-WP-0056-T12 synthetic pilot, docs/evidence/2026-10-31-nk56-t12-synthetic-pilot/). Writes
    without options.cas are still refused by cas_required on the key; metadata, delete, sibling and new paths
    stay denied (tested). Status reset to proposed: the approved policy file changed, re-approval needed.'
lifecycle:
  role_window: 'Window-scoped (founder decision 2026-10-31, hub c29c6eda): the policy
    is applied once and grants nothing on its own; the Kubernetes-auth role is created
    by the attended platform-admin when an admission naming this lane is approved,
    bounded to that admission''s window, and deleted after the run''s receipt or at
    window end, whichever comes first. No write role exists between admitted runs.'
  deactivate: Delete the role, then the policy; the KV entry and the ESO reader lane
    (CCR-2026-0053) are unchanged. The bind falls back to founder-run rotation.
  rotate: Executor reads the current version N, signs in to LLDAP as svc-authelia
    with it and changes that account's own password (self-rotation, founder decision
    2026-10-31, hub 3d0c8f86; no lldap_password_manager account), writes version N+1
    with options.cas=N; ESO projects it, Authelia restarts, the synthetic journey
    proves sign-in. Revert changes the password back the same way and writes the prior
    value as version N+2 with options.cas=N+1.
  compromised: Delete the role first (stops new logins; existing tokens expire within
    15m, or revoke by accessor), then reset svc-authelia in LLDAP and rotate attended
    as in CCR-2026-0053.
delivery:
  surface: native-workload-login
  namespace: sso
  service_account: nk-bind-executor
  reader: Executor runtime (net-kingdom source, rapp-* package per ADR-0015, NK-WP-0056-T03);
    logs in with its projected ServiceAccount token, audience openbao; no Secret is
    created by this request
risk:
  classification: medium
  notes:
  - A write role on the svc-authelia bind is new; until now only the attended platform-admin
    wrote this path. It exists only during an admitted window. Within it, a compromised
    executor ServiceAccount can replace the bind value (Authelia sign-in outage on
    next restart) but cannot read any other path, create paths, delete versions or
    read metadata; outside it, the ServiceAccount cannot log in to this role at all.
  - cas_required on the key makes every write state the version it replaces; a racing
    or replayed write is refused by the engine, not by the executor.
  - The executor also reads the current value (needed for CAS and revert). svc-authelia
    is a read-only directory bind (lldap_strict_readonly).
  - The role is a separate role from the ESO reader (CCR-2026-0053) and from the journey
    read lane (NK-WP-0056-T10); policies are never combined in one role.
  - Node root, ESO administration, cluster admins able to mint tokens for sso/nk-bind-executor
    and platform-admin remain inside this credential boundary.
verification:
  positive:
  - Exact policy and role read back; login as sso/nk-bind-executor (audience openbao)
    gets only this policy with a lease of at most 15m
  - Write of the next version with options.cas equal to the current version succeeds
    in a rehearsal on a synthetic sibling-free test path or under the T06 admission;
    the value is compared in memory only
  negative:
  - Write without options or with a stale cas is refused
  - Create of a new sibling path, metadata read, delete, destroy, undelete and list
    are refused
  - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
  - Coding-agent boundary denies data and metadata of the path
  activation_conditions:
  - Explicit platform-owner and net-kingdom-owner approval of this exact request.
  - ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-* package (bound_claims_confirmed
    then set to true by the platform-owner).
  - Attended platform-admin (aal2) session sets cas_required on the key and applies
    the policy once from a reviewed commit.
  - Per admitted run, the attended platform-admin creates the role for the admission's
    window and deletes it after the receipt (or at window end); both steps are recorded
    with the admission id.
  - Positive and negative results recorded in value-free receipts.