MASON-WP-0004-T02: founder accepts the 29 complete custody descriptions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0

manifests/custody-descriptions.yaml

@@ -30,7 +30,7 @@ platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets:
   on_loss: 'Re-issue per rotation: Replace OPENROUTER_API_KEY directly in OpenBao and record non-secret
     rotation evidence.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0003-llm-connect-openrouter-api-key.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0003-llm-connect-openrouter-api-key.yaml
@@ -43,7 +43,7 @@ platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance
   on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
     1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml
@@ -56,7 +56,7 @@ platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01:
   on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
     1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml
@@ -82,7 +82,7 @@ platform/workloads/approval-engine/audit-sender:
     only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
     helper refuses rotation and unexpected existing values.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0021-approval-engine-audit.yaml
@@ -96,7 +96,7 @@ platform/workloads/approval-engine/operator-client:
   on_loss: 'Re-issue per rotation: KeyCape mints a replacement client secret; platform writes the new
     KV version under the same attended authority. Rotation is independent of CCR-2026-0017.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml#lifecycle.rotate;
     railiance-platform/credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml#lifecycle.rotate
   sources:
@@ -113,7 +113,7 @@ platform/workloads/audit-core/senders:
   on_loss: audit-core re-mints sender tokens and every projected copy is reseeded; senders queue to their
     local outboxes meanwhile. See ops-mason/plans/audit-core-openbao-runtime-custody.md.
   owner: ops-mason
-  review: draft
+  review: accepted
   rotation: ops-warden/wiki/playbooks/audit-core-senders.md#worker-checklist
   sources:
   - ops-warden catalog audit-core-senders
@@ -129,7 +129,7 @@ platform/workloads/core-hub/forgejo-source-read:
     PAT for core-hub-source, write it to OpenBao from stdin, let ESO refresh (5m), pass make verify-publisher,
     then revoke the predecessor PAT and record evidence.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0031-core-hub-forgejo-source-read.yaml
@@ -147,7 +147,7 @@ platform/workloads/core-hub/runtime:
     the OpenBao field through attended custody, wait for ESO sync, roll Core Hub and consumers, verify
     protected calls, then invalidate the old token.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0013-core-hub-runtime-api-token.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0013-core-hub-runtime-api-token.yaml
@@ -162,7 +162,7 @@ platform/workloads/coulomb-social/backup-primary:
     required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
     acceptance, then revoke predecessor at provider.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0036-coulomb-social-backup-primary.yaml
@@ -188,7 +188,7 @@ platform/workloads/email-connect/backup-primary:
     required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
     acceptance, then revoke predecessor at provider.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0037-email-connect-backup-primary.yaml
@@ -202,7 +202,7 @@ platform/workloads/email-connect/transactional:
     wait for ESO refresh (or force sync); roll email-connect and user-engine as needed; revoke old provider
     password / retire old bearer.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0010-email-connect-transactional.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0010-email-connect-transactional.yaml
@@ -219,7 +219,7 @@ platform/workloads/forgejo/forgejo-admin:
   on_loss: 'Re-issue per rotation: Mint a new PAT in Forgejo, update API_TOKEN in OpenBao, record non-secret
     rotation evidence, and restart dependent automation after downstream consumers load from OpenBao.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0006-forgejo-admin-api-token-lane.yaml
@@ -234,7 +234,7 @@ platform/workloads/glas-harness/claude-agent-dev:
     stop old runs, verify new delivery and inference, then revoke the predecessor at Anthropic and prove
     its denial.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0016-glas-claude-anthropic.yaml
@@ -246,7 +246,7 @@ platform/workloads/inbound-library/imap:
   on_loss: 'rotate by ops-mason: bao write -f auth/approle/role/inbound-library/secret-id -> new secret_id;
     deliver mode-0600 to ~/.local/inbound-library/approle; shred old secret_id file.'
   owner: ops-mason
-  review: draft
+  review: accepted
   rotation: ops-warden/wiki/playbooks/inbound-library-imap-approle.md#worker-checklist
   sources:
   - ops-warden catalog inbound-library-imap-approle
@@ -261,7 +261,7 @@ platform/workloads/informed-decision/audit-sender:
     only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
     helper refuses rotation and unexpected existing values.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0022-informed-decision-audit.yaml
@@ -275,7 +275,7 @@ platform/workloads/informed-decision/sitting-requester:
   on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
     refusal proof.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml#lifecycle.rotate;
     railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml#lifecycle.rotate
   sources:
@@ -289,7 +289,7 @@ platform/workloads/issue-core/issue-core/issue-core-runtime:
   on_loss: 'Re-issue per rotation: Replace issue-core runtime secret values directly in OpenBao and record
     non-secret rotation evidence.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0002-issue-core-ingestion-api-key.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0002-issue-core-ingestion-api-key.yaml
@@ -304,7 +304,7 @@ platform/workloads/keycape/secrets-engine-openbao:
     under a standing rotation approval for this CCR (event-driven + 90d); never a read or restore of an
     old version'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0033.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0034.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0033.yaml
@@ -330,7 +330,7 @@ platform/workloads/net-kingdom/keycape-factor-read:
   on_loss: 'Re-issue per rotation: Issue replacement before expiry, CAS update exact KV, verify ESO projection
     and consumer acceptance; retain no plaintext artifacts.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0023-keycape-factor-read.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0023-keycape-factor-read.yaml
@@ -343,7 +343,7 @@ platform/workloads/policy-nexus/forgejo-source-read:
   on_loss: 'Re-issue per rotation: Mint a replacement read:repository-only PAT, update OpenBao and the
     Actions secret through attended custody, pass one candidate build, then revoke the predecessor.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0014-policy-nexus-forgejo-source-read.yaml
@@ -357,7 +357,7 @@ platform/workloads/railiance-clock/authority-signing:
   on_loss: 'Re-issue per rotation: Stop authority, perform separately versioned attended CAS rotation
     and atomic host replacement, then admit new public key and epoch for consumers.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0028-railiance-clock-authority-signing.yaml
@@ -380,7 +380,7 @@ platform/workloads/railiance/backup/object-storage:
   on_loss: 'Re-issue per rotation: Overlap-first. Put a new key in OpenBao, wait for ESO refresh, revoke
     the old Scaleway key.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0012-backup-object-storage.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0012-backup-object-storage.yaml
@@ -395,7 +395,7 @@ platform/workloads/railiance/backup/offsite-lane:
   on_loss: 'Re-issue per rotation: Mint a new Nextcloud upload token, update NC_WEBDAV_TOKEN in OpenBao,
     and record non-secret rotation evidence.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0004-railiance-backup-offsite-lane.yaml
@@ -407,7 +407,7 @@ platform/workloads/railiance/scaleway/bootstrap:
   missing: []
   on_loss: 'Re-issue per rotation: Put a new bootstrap key; do not reuse the scoped backup key.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0011-scaleway-object-storage-bootstrap.yaml
@@ -431,7 +431,7 @@ platform/workloads/reuse/reuse-surface/runtime-secrets:
   on_loss: 'Re-issue per rotation: Replace field values directly in OpenBao, wait for ESO refresh, rollout
     reuse-surface, then run make reuse-forgejo-webhook when rotating the webhook HMAC.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml
@@ -448,7 +448,7 @@ platform/workloads/secrets-engine/approval-client:
     KV version under the same attended authority; ESO refresh delivers it and KeyCape restarts or re-reads.
     Rotation is independent of the operator client.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml#lifecycle.rotate;
     railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml#lifecycle.rotate
   sources:
@@ -466,7 +466,7 @@ platform/workloads/secrets-engine/approval-requester:
   on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
     refusal proof.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0024-t03-requester-verifier.yaml#lifecycle.rotate;
     railiance-platform/credential-change-requests/CCR-2026-0025-t03-requester-reader.yaml#lifecycle.rotate
   sources:
@@ -480,7 +480,7 @@ platform/workloads/state-hub/repository-rename-preflight:
   on_loss: 'Re-issue per rotation: Stop every API replica and verify no matching pods before CAS rotation;
     wait ESO, recreate API replicas with one version, verify old token invalidation and health.'
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: railiance-platform/credential-change-requests/CCR-2026-0015-state-hub-preflight-signing.yaml#lifecycle.rotate
   sources:
   - CCR-2026-0015-state-hub-preflight-signing.yaml
@@ -507,7 +507,7 @@ platform/workloads/tenant-engine/audit-core-sender:
     audit-core re-mints if the registry entry is also gone; emission waits in tenant-engine's local outbox
     meanwhile.
   owner: railiance-platform
-  review: draft
+  review: accepted
   rotation: ops-mason/plans/tenant-engine-audit-core-sender-projection.md; reseed with railiance-platform/scripts/tenant_engine_audit_core_sender_seed.py
   sources:
   - ops-mason plan (hand-filled 2026-10-09)