Record the callback-amendment re-applies of CCR-2026-0004/0019/0034 (decision 73fff3d3)

credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: Railiance offsite backup lane (Nextcloud WebDAV + age recovery)
 status: active
 created: '2026-07-07'
-updated: '2026-09-05'
+updated: '2026-10-07'
 requester:
   agent: grok
   reason: Move railiance-backup / forgejo-backup credentials from hardcoded script
@@ -23,9 +23,9 @@ review:
   - at: '2026-10-07'
     reviewer: platform-operator (founder Bernd Worsch)
     decision: approved
-    comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing the retired bao.coulomb.social
-      OIDC callback from allowed_redirect_uris and one delegated re-apply. Nothing else
-      changes.
+    comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing
+      the retired bao.coulomb.social OIDC callback from allowed_redirect_uris and
+      one delegated re-apply. Nothing else changes.
 target:
   domain: financials
   tenant: railiance
@@ -77,13 +77,13 @@ risk:
   classification: high
   notes:
   - NC_WEBDAV_TOKEN grants upload to the offsite backup file drop.
-  - Since 2026-09-05 the file drop belongs to Backup, folder /railiance-backups,
-    with create-only permissions and a server-enforced 10 GiB account quota.
-  - Operator credentials remain in KVv2 operators/nextcloud/backup, fields
-    BACKUP_USERNAME and BACKUP_PASSWORD; never deliver them to production.
-  - Existing Bernd-owned retained backups and recovery access remain separate;
-    predecessor file-drop unshared 2026-09-15 by operator attestation; age-key
-    exposure remains open.
+  - Since 2026-09-05 the file drop belongs to Backup, folder /railiance-backups, with
+    create-only permissions and a server-enforced 10 GiB account quota.
+  - Operator credentials remain in KVv2 operators/nextcloud/backup, fields BACKUP_USERNAME
+    and BACKUP_PASSWORD; never deliver them to production.
+  - Existing Bernd-owned retained backups and recovery access remain separate; predecessor
+    file-drop unshared 2026-09-15 by operator attestation; age-key exposure remains
+    open.
   - "AGE_PRIVATE_KEY decrypts all age-encrypted backup artifacts \u2014 recovery escrow\
     \ only."
   - Credentials must not be stored on production hosts with delete permission.
@@ -122,13 +122,20 @@ verification:
     kind: capabilities_safe_verify
     result: passed
     details:
-    - 'WP-0026 T07: capabilities-safe re-verify on bao.coulomb.social (no secret values read).'
-    - 'Positive: token with policy workload-kv-read-railiance-backup-offsite-lane → capabilities read on platform/data/workloads/railiance/backup/offsite-lane.'
-    - 'Negative: default-policy token → deny on the same data path; token revoked after check.'
-    - 'Agent boundary: policy agent-high-risk-boundary → deny on data path, read on metadata path.'
-    - 'Field presence via JSON key inventory only (NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY); lengths recorded, values not printed.'
-    - 'EXPOSED taint set: custom_metadata exposed_at=2026-07-16T00:00:00Z exposed_version=2 (WP-0026 T05).'
-    - 'ops-warden catalog promoted draft→active; fetch_command pinned to NC_WEBDAV_TOKEN; resolvable=true; risk=high.'
+    - 'WP-0026 T07: capabilities-safe re-verify on bao.coulomb.social (no secret values
+      read).'
+    - "Positive: token with policy workload-kv-read-railiance-backup-offsite-lane\
+      \ \u2192 capabilities read on platform/data/workloads/railiance/backup/offsite-lane."
+    - "Negative: default-policy token \u2192 deny on the same data path; token revoked\
+      \ after check."
+    - "Agent boundary: policy agent-high-risk-boundary \u2192 deny on data path, read\
+      \ on metadata path."
+    - Field presence via JSON key inventory only (NC_WEBDAV_TOKEN, NC_WEBDAV_URL,
+      AGE_PRIVATE_KEY); lengths recorded, values not printed.
+    - 'EXPOSED taint set: custom_metadata exposed_at=2026-07-16T00:00:00Z exposed_version=2
+      (WP-0026 T05).'
+    - "ops-warden catalog promoted draft\u2192active; fetch_command pinned to NC_WEBDAV_TOKEN;\
+      \ resolvable=true; risk=high."
   - at: '2026-09-05'
     actor: codex
     kind: dedicated_backup_account_cutover
@@ -136,8 +143,8 @@ verification:
     details:
     - User authorized dedicated Backup account and operator custody coordinates.
     - Verified 10737418240-byte quota and Backup-owned create-only share.
-    - Encrypted fixture PUT 201, owner download and escrow decryption passed;
-      runtime GET and DELETE returned 405 on the actual upload endpoint.
+    - Encrypted fixture PUT 201, owner download and escrow decryption passed; runtime
+      GET and DELETE returned 405 on the actual upload endpoint.
     - CAS advanced workload KV version 2 to 3, preserving age escrow and other fields.
     - Evidence docs/evidence/RPF-WP-0029-backup-account-2026-09-05.json.
   - at: '2026-09-15'
@@ -149,7 +156,15 @@ verification:
     - No predecessor value, fingerprint, length or shape was recorded.
     - HTTP 401/403 probe not run; predecessor must not be reconstructed.
     - Evidence docs/evidence/2026-09-15-rpf-wp-0029-predecessor-share-invalidated.json.
-
+  - at: '2026-10-07T13:10:39+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-railiance-backup-offsite-lane'
+    - 'Auth role metadata write: auth/netkingdom/role/railiance-backup-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
 lifecycle:
   deactivate: Disable ops-warden catalog entry and detach OIDC role policy; rotate
     Nextcloud file-drop token at provider.

credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: secrets-engine client-side read of its approval client secret
 status: applied
 created: '2026-09-09'
-updated: '2026-09-13'
+updated: '2026-10-07'
 requester:
   agent: claude
   reason: RPF-WP-0035-T06 residual from the completed verifier custody (CCR-2026-0017).
@@ -58,9 +58,9 @@ review:
   - at: '2026-10-07'
     reviewer: platform-operator, secrets-engine-owner (founder Bernd Worsch)
     decision: approved
-    comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing the retired bao.coulomb.social
-      OIDC callback from allowed_redirect_uris and one delegated re-apply. Nothing else
-      changes.
+    comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing
+      the retired bao.coulomb.social OIDC callback from allowed_redirect_uris and
+      one delegated re-apply. Nothing else changes.
 target:
   domain: financials
   tenant: platform
@@ -162,6 +162,15 @@ verification:
     - 'Policy metadata write: sys/policies/acl/workload-kv-read-secrets-engine-approval-client'
     - 'Auth role metadata write: auth/netkingdom/role/secrets-engine-approval-client-workload-kv-read'
     - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-10-07T13:10:43+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-secrets-engine-approval-client'
+    - 'Auth role metadata write: auth/netkingdom/role/secrets-engine-approval-client-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
 lifecycle:
   deactivate: Detach the policy from role secrets-engine-approval-client-workload-kv-read
     and disable the ops-warden catalog entry. The KeyCape verifier lane and its delivery

credential-change-requests/CCR-2026-0034.yaml

@@ -53,9 +53,9 @@ review:
   - at: '2026-10-07'
     reviewer: platform-owner, key-cape-owner, net-kingdom-owner (founder Bernd Worsch)
     decision: approved
-    comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing the retired bao.coulomb.social
-      OIDC callback from allowed_redirect_uris and one delegated re-apply. Nothing else
-      changes.
+    comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing
+      the retired bao.coulomb.social OIDC callback from allowed_redirect_uris and
+      one delegated re-apply. Nothing else changes.
 target:
   domain: infotech
   tenant: platform
@@ -155,6 +155,15 @@ verification:
     - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator'
     - 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read'
     - No secret values were read, written, printed, or accepted in argv.
+  - at: '2026-10-07T13:10:47+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator'
+    - 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
 lifecycle:
   deactivate: Delete the OIDC role first, then the policy; value-free receipt.
   rotate: Not applicable to the reader; the value rotates through the CCR-2026-0033