{
  "schema": "helixforge.keycape-verifier-admission.v1",
  "recorded_at": "2026-09-09T00:14:27.155338+00:00",
  "approval": {
    "schema": "railiance.keycape-custody-user-approval.v1",
    "recorded_at": "2026-09-08T23:05:19.886216+00:00",
    "user_response": "I approve, go on.",
    "approved_question": "Do you approve CCR-2026-0017 and CCR-2026-0018, as platform operator and KeyCape owner, for the verifier-side credential delivery described in the review packet?",
    "review_packet_revision": "52b24eab9a8aff3396e71b2296d0240a44f3b0db",
    "roles": [
      "platform-operator",
      "key-cape-owner"
    ],
    "scope": "Two verifier-side KeyCape client credential custody requests, including their governed attended provisioning and compatible rollout sequence.",
    "client_side_read_authorized": false,
    "factory_spending_authorized": false,
    "requests": [
      {
        "id": "CCR-2026-0017",
        "decision_id": "b533a271-b704-4c5c-98a2-9a5951aadfb6",
        "status": "approved",
        "decision_status": "resolved",
        "reviewed_roles": [
          "platform-operator",
          "key-cape-owner"
        ]
      },
      {
        "id": "CCR-2026-0018",
        "decision_id": "efa90517-0cae-4eb6-a68d-5b0489c84d65",
        "status": "approved",
        "decision_status": "resolved",
        "reviewed_roles": [
          "platform-operator",
          "key-cape-owner"
        ]
      }
    ]
  },
  "activation": {
    "schema": "platform.keycape-approval-custody.v1",
    "status": "custody_and_service_acceptance_passed_pending_fresh_human_login",
    "lanes": [
      {
        "ccr": "CCR-2026-0017",
        "source_sha256": "dc2bbd86e213edecc2f2f91a99d0f51136e9a0853a90e55f65dda2b942305416",
        "custody_seeded": false,
        "existing_version_reused": true,
        "kv_version": 1,
        "initial_request_id": "94c98373-33fa-591d-c201-d36dddf9879b",
        "policy_applied": false,
        "role_applied": true,
        "native_reader_verified": true,
        "cross_path_denied": true,
        "parent_listing_denied": true,
        "auth_ttl": 900,
        "reader_revocation_verified": true,
        "wrong_service_account_denied": true,
        "coding_agent_deny_wins": true,
        "store_ready": true,
        "external_secret_ready": true,
        "delivery_matches": true,
        "secret_uid": "eaa28bdf-04af-4e4e-a1fc-fe395c7689a7",
        "secret_resource_version": "58747058",
        "wrong_namespace_denied": true,
        "outside_namespace_store_denied": true
      },
      {
        "ccr": "CCR-2026-0018",
        "source_sha256": "99148133ddf1eb15dce3c03862b51dc001818ca3121045035a0b0e5897c55dad",
        "custody_seeded": false,
        "existing_version_reused": true,
        "kv_version": 1,
        "initial_request_id": "a62ee5c5-b5ba-b7dc-0f51-e6fd8a6dde32",
        "policy_applied": false,
        "role_applied": true,
        "native_reader_verified": true,
        "cross_path_denied": true,
        "parent_listing_denied": true,
        "auth_ttl": 900,
        "reader_revocation_verified": true,
        "wrong_service_account_denied": true,
        "coding_agent_deny_wins": true,
        "store_ready": true,
        "external_secret_ready": true,
        "delivery_matches": true,
        "secret_uid": "599a61a7-8244-4618-8c44-6473195bbe4e",
        "secret_resource_version": "58747062",
        "wrong_namespace_denied": true,
        "outside_namespace_store_denied": true
      }
    ],
    "started_at": "2026-09-09T00:09:28.852280+00:00",
    "credential_values_emitted": false,
    "client_side_read_admitted": false,
    "keycape_rollout_completed": true,
    "issuer_pin_revision": "58746187",
    "phase": "awaiting_fresh_human_login",
    "custody_versions_unchanged": true,
    "namespace_probe_cleanup_requested": true,
    "keycape": {
      "existing_human_login_before": true,
      "protected_recovery_retained": true,
      "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
      "generation": 38,
      "pod_uid": "8d62e972-d466-413e-a2e4-08b9a08016bc",
      "single_ready_replica": true,
      "acceptance_phase": "passed",
      "clients": [
        {
          "client_id": "secrets-engine-approval",
          "live_jwks_signature_verified": true,
          "exact_claims_verified": true,
          "lifetime_seconds": 900,
          "maximum_future_iat_seconds": 30,
          "expiry_leeway_seconds": 0,
          "excess_scope_denied": true,
          "wrong_secret_denied": true,
          "pinned_artifact_verifier_passed": true,
          "verifier_location": "attended owner process",
          "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
          "real_predecessor_rotation_tested": false,
          "observed_wall_clock_expiry": false
        },
        {
          "client_id": "approval-engine-operator",
          "live_jwks_signature_verified": true,
          "exact_claims_verified": true,
          "lifetime_seconds": 900,
          "maximum_future_iat_seconds": 30,
          "expiry_leeway_seconds": 0,
          "excess_scope_denied": true,
          "wrong_secret_denied": true,
          "pinned_artifact_verifier_passed": true,
          "verifier_location": "attended owner process",
          "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
          "real_predecessor_rotation_tested": false,
          "observed_wall_clock_expiry": false
        }
      ],
      "acceptance_client": "approval-engine-operator",
      "human_client_consume_denied": true,
      "status": "service_acceptance_passed_pending_fresh_human_login",
      "image": "forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611",
      "config_resource_version": "58747126",
      "signing_key_unchanged": true,
      "unrelated_config_bytes_preserved": true,
      "existing_human_login_after": false
    },
    "finished_at": "2026-09-09T00:10:09.099481+00:00"
  },
  "post_rollout_login": {
    "schema": "netkingdom.keycape-approval-rollout.v1",
    "status": "service_and_existing_human_login_acceptance_passed",
    "values_emitted": false,
    "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
    "generation": 38,
    "pod_uid": "8d62e972-d466-413e-a2e4-08b9a08016bc",
    "single_ready_replica": true,
    "acceptance_phase": "passed",
    "clients": [
      {
        "client_id": "secrets-engine-approval",
        "live_jwks_signature_verified": true,
        "exact_claims_verified": true,
        "lifetime_seconds": 900,
        "maximum_future_iat_seconds": 30,
        "expiry_leeway_seconds": 0,
        "excess_scope_denied": true,
        "wrong_secret_denied": true,
        "pinned_artifact_verifier_passed": true,
        "verifier_location": "attended owner process",
        "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
        "real_predecessor_rotation_tested": false,
        "observed_wall_clock_expiry": false
      },
      {
        "client_id": "approval-engine-operator",
        "live_jwks_signature_verified": true,
        "exact_claims_verified": true,
        "lifetime_seconds": 900,
        "maximum_future_iat_seconds": 30,
        "expiry_leeway_seconds": 0,
        "excess_scope_denied": true,
        "wrong_secret_denied": true,
        "pinned_artifact_verifier_passed": true,
        "verifier_location": "attended owner process",
        "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92",
        "real_predecessor_rotation_tested": false,
        "observed_wall_clock_expiry": false
      }
    ],
    "acceptance_client": "approval-engine-operator",
    "human_client_consume_denied": true,
    "existing_human_login_after": true,
    "receipt_written_at": "2026-09-09T00:11:59.113549+00:00"
  },
  "attended_envelope": {
    "all_attempted_sessions_revoked": true,
    "successful_activation_exit_code": 0,
    "post_rollout_login_exit_code": 0
  },
  "validation": {
    "local_openbao_tests": 8,
    "configuration_and_recovery_tests": 10,
    "credential_change_tests": 53,
    "pinned_image_synthetic_https_and_native_verifier": "passed"
  },
  "failed_attempt_receipts": [
    "net-kingdom:docs/evidence/2026-09-09-keycape-activation-attempts.json"
  ],
  "limits": {
    "client_side_read_admitted": false,
    "factory_spending_admitted": false,
    "wall_clock_jwt_expiry_observed": false,
    "actual_predecessor_rotation_observed": false
  },
  "temporary_probe_namespaces_remaining": 0,
  "owner_manifest_api_defaults_match_live": true
}