Prove OpenBao isolated restore

docs/evidence/openbao-isolated-restore-2026-08-03.json

@@ -0,0 +1,41 @@
+{
+  "audit": {
+    "declarative_file_device_loaded": true,
+    "file_nonempty": true,
+    "path": "/openbao/audit/openbao-audit.log"
+  },
+  "authorization_probe": {
+    "credential": "existing external-secrets-rapp-qonto AppRole passed by stdin/reference",
+    "exact_path": "tenants/data/binky/qonto-api",
+    "exact_path_capabilities": ["read"],
+    "sibling_capabilities": ["deny"],
+    "sibling_path": "tenants/data/binky/not-qonto-api"
+  },
+  "captured_at": "2026-08-03",
+  "cluster_id": "fd28df5d-98ec-57dd-42ec-9b3e4f4e53bf",
+  "inventory": {
+    "approle_count": 7,
+    "auth_method_count": 5,
+    "kubernetes_role_count": 3,
+    "mount_count": 8,
+    "policy_count": 26,
+    "ssh_role_count": 3
+  },
+  "restart_unseal_cycles": 2,
+  "restored_active": true,
+  "seal": {
+    "shares": 3,
+    "threshold": 2,
+    "type": "shamir"
+  },
+  "snapshot": {
+    "bytes": 106836,
+    "sha256": "8ba31731131539e8070f24de1a8c3677998b417dacd5c5a6bdb94e7b7d20125d"
+  },
+  "source_remained_authoritative": true,
+  "target_version": "2.5.4",
+  "temporary_credentials_removed": true,
+  "temporary_plaintext_snapshot_removed": true,
+  "unseal_ceremony": "attended; rotated source shares entered through hidden prompts",
+  "secret_values_recorded": false
+}