Prove OpenBao isolated restore

docs/evidence/openbao-isolated-restore-2026-08-03.json

@@ -0,0 +1,41 @@
+{
+  "audit": {
+    "declarative_file_device_loaded": true,
+    "file_nonempty": true,
+    "path": "/openbao/audit/openbao-audit.log"
+  },
+  "authorization_probe": {
+    "credential": "existing external-secrets-rapp-qonto AppRole passed by stdin/reference",
+    "exact_path": "tenants/data/binky/qonto-api",
+    "exact_path_capabilities": ["read"],
+    "sibling_capabilities": ["deny"],
+    "sibling_path": "tenants/data/binky/not-qonto-api"
+  },
+  "captured_at": "2026-08-03",
+  "cluster_id": "fd28df5d-98ec-57dd-42ec-9b3e4f4e53bf",
+  "inventory": {
+    "approle_count": 7,
+    "auth_method_count": 5,
+    "kubernetes_role_count": 3,
+    "mount_count": 8,
+    "policy_count": 26,
+    "ssh_role_count": 3
+  },
+  "restart_unseal_cycles": 2,
+  "restored_active": true,
+  "seal": {
+    "shares": 3,
+    "threshold": 2,
+    "type": "shamir"
+  },
+  "snapshot": {
+    "bytes": 106836,
+    "sha256": "8ba31731131539e8070f24de1a8c3677998b417dacd5c5a6bdb94e7b7d20125d"
+  },
+  "source_remained_authoritative": true,
+  "target_version": "2.5.4",
+  "temporary_credentials_removed": true,
+  "temporary_plaintext_snapshot_removed": true,
+  "unseal_ceremony": "attended; rotated source shares entered through hidden prompts",
+  "secret_values_recorded": false
+}

docs/openbao-coulombcore-to-railiance01-runbook.md

@@ -36,9 +36,14 @@ approved offsite backup lane. Its non-secret fingerprints are:
 
 A second fresh snapshot restored successfully into an isolated OpenBao 2.5.4
 pod on railiance01. OpenBao correctly resealed immediately after restore under
-the source Shamir barrier. Full semantic and restart validation therefore
-requires the source 2-of-3 unseal quorum; the temporary instance was not made
-serving. The empty target Helm release has been aligned from 2.5.3 to 2.5.4.
+the source Shamir barrier. On 2026-08-03 the operator supplied the rotated
+2-of-3 quorum through hidden prompts. Two restart/unseal cycles passed; the
+restored cluster became active with the source cluster ID, its inventory
+matched, a scoped AppRole proved exact-path read and sibling denial, and the
+declarative file audit device wrote successfully. Evidence is in
+`docs/evidence/openbao-isolated-restore-2026-08-03.json`. The disposable
+instance and plaintext staging were then removed. The empty target Helm release
+has been aligned from 2.5.3 to 2.5.4.
 
 ## Preconditions and abort points