Record the MAS backup reader policy and role install.

The attended installer wrote a metadata receipt at 2026-11-02T09:02:50Z.
Delivery admission stays closed.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml

@@ -4,7 +4,7 @@
   "schema_version": 1,
   "request_type": "workload-kv-read",
   "title": "MAS evidence archive node-delivery reader",
-  "status": "approved",
+  "status": "applied",
   "created": "2026-11-02",
   "updated": "2026-11-02",
   "requester": {
@@ -80,7 +80,7 @@
   "access_frontdoor": {
     "type": "platform-owner",
     "catalog_id": "mas-backup-primary-delivery",
-    "readiness": "approved-pending-apply",
+    "readiness": "applied-pending-verify",
     "resolvable": false
   },
   "delivery": {
@@ -128,7 +128,18 @@
       "The provider denies sibling and native prefixes, retained object or version deletion, and IAM or bucket administration.",
       "Draft, unconfirmed, or source-changed contracts, the wrong cluster, symlinks, hard links, insecure modes, a changed KV version, unconfirmed token revocation, and a different existing file refuse delivery."
     ],
-    "evidence": [],
+    "evidence": [
+      {
+        "at": "2026-11-02T09:02:50Z",
+        "actor": "grok",
+        "kind": "metadata_apply",
+        "result": "passed",
+        "details": [
+          "Attended platform-admin login ran scripts/install-mas-backup-primary-reader.sh. The local receipt status is installed and the stage file is empty.",
+          "Readback bound backup-primary-delivery in namespace mas, one policy workload-kv-read-mas-backup-primary, role mas-backup-primary-workload-kv-read, ttl 300, token_max_ttl 300, token_explicit_max_ttl 300, token_num_uses 4, token_no_default_policy true, token_type service."
+        ]
+      }
+    ],
     "activation_conditions": [
       "Platform-owner and mas-owner reviews, confirmed native reader bindings, and an applied policy and role with live positive and negative evidence.",
       "A separate IAM application limited to platform-pg/application-archives/mas/, with a bucket policy that denies sibling prefixes. Project-wide object-storage IAM is not a prefix grant. An independent mirror project remains a founder choice and is not created by this draft.",

docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md

@@ -3,8 +3,9 @@
 Prepared for RPF-WP-0070. The founder approved CCR-2026-0062 on 2026-11-02
 as platform-owner and mas-owner. The Kubernetes binding is confirmed against
 ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with
-automount disabled. Delivery admission is still false. No provider identity,
-OpenBao policy, role, or value, node file, offsite upload, or timer exists yet.
+automount disabled. Delivery admission is still false. The OpenBao policy
+and role were installed at 2026-11-02T09:02:50Z. No provider identity, value,
+node file, offsite upload, or timer exists yet.
 
 The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS
 prefix is `platform-pg/application-archives/mas/` in bucket
@@ -14,11 +15,11 @@ local. It is not an offsite object.
 
 | Item | Prepared value | Live state |
 | --- | --- | --- |
-| Reader request | CCR-2026-0062 | approved; not applied |
+| Reader request | CCR-2026-0062 | applied; delivery admission false |
 | KV path | platform/workloads/mas/backup-primary | no value written |
 | Fields | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | absent |
-| Policy | workload-kv-read-mas-backup-primary | source only; install is silent and attended |
-| Role | mas-backup-primary-workload-kv-read | not created |
+| Policy | workload-kv-read-mas-backup-primary | installed; receipt status installed |
+| Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas |
 | ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding |
 | Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created |
 | Provider identity | proposed application mas-evidence-backup-primary | not created; this workstation has no Scaleway credential |
@@ -33,10 +34,9 @@ and is not created here.
 
 1. Founder review is recorded: platform-owner and mas-owner, source
    `founder-approval-2026-11-02`. The live account matches the binding.
-2. Apply the policy and role with the attended platform-admin login:
-   `python3 scripts/openbao-attended-exec.py -- /home/worsch/railiance-platform/scripts/install-mas-backup-primary-reader.sh`
-   The window is a new empty Playwright Chromium profile. Sign in as
-   platform-root. The helper is silent and writes only a receipt.
+2. The policy and role are installed. The attended command finished at
+   2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission
+   stays false.
 3. In the Scaleway console, create a new IAM application named
    `mas-evidence-backup-primary`. Do not add a key to email-connect or to a
    broad application. Then say that the application exists. This workstation

workplans/RPF-WP-0070-mas-evidence-recovery.md

@@ -40,7 +40,7 @@ status: progress
 priority: medium
 needs_human: true
 depends_on: [RPF-WP-0053-T05]
-intervention_note: "Founder approved CCR-2026-0062. The delivery account exists. OpenBao policy/role install still needs the attended platform-admin login in the empty Playwright Chromium profile. The IAM application is not created. Age-identity escrow remains separate."
+intervention_note: "CCR-2026-0062 is applied. The OpenBao policy and role were installed at 2026-11-02T09:02:50Z. Delivery admission stays false. The next founder act is to create IAM application mas-evidence-backup-primary in the Scaleway console. Age-identity escrow remains separate."
 state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8"
 ```
 
@@ -65,10 +65,9 @@ The profile is accepted by `scripts/primary_application_archive.py`.
 mas-owner. ServiceAccount `backup-primary-delivery` now exists in
 namespace `mas` with automount disabled and no RoleBinding. The binding
 is confirmed. Delivery admission stays false. The OpenBao policy and
-role are not installed: the local token is denied, so the install waits
-for `warden access openbao-platform-admin-login --exec` running
-`scripts/install-mas-backup-primary-reader.sh`. No Scaleway credential
-is configured here, so IAM application `mas-evidence-backup-primary`
-is not created. The KV pair and `/etc/mas-backup/primary.env` do not
-exist. Pair-custody lists still name only coulomb-social and email-connect.
+role were installed at 2026-11-02T09:02:50Z by the silent reader script.
+No Scaleway credential is configured here, so IAM application
+`mas-evidence-backup-primary` is not created. The KV pair and
+`/etc/mas-backup/primary.env` do not exist. Pair-custody lists still
+name only coulomb-social and email-connect.
 Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.