Close CCR drift and high-risk policy gaps

credential-change-requests/CCR-2026-0010-email-connect-transactional.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: email-connect transactional SMTP and ingest token lane
 status: active
 created: '2026-08-12'
-updated: '2026-08-12'
+updated: '2026-08-21'
 requester:
   agent: grok
   reason: >-
@@ -117,6 +117,15 @@ verification:
     railiance01, namespace-scoped to email-connect.
   - Secret value provisioned directly in OpenBao through approved operator custody.
   - Positive and negative verification recorded with non-secret audit ids or timestamps.
+  evidence:
+  - at: '2026-08-20T22:56:00+00:00'
+    actor: codex
+    kind: auth_path_reconciliation
+    result: passed
+    details:
+    - Live ClusterSecretStore openbao-email-connect uses tokenSecretRef external-secrets/openbao-email-connect-eso-token,
+      is namespace-limited to email-connect, and reports Valid.
+    - ExternalSecret email-connect-runtime reports SecretSynced. No Secret value was read.
 lifecycle:
   deactivate: Disable ops-warden catalog entry and detach ESO role policy.
   rotate: >-

credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml

@@ -3,9 +3,16 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Scaleway bootstrap API key for reef-storage / WP-0002 bucket create
-status: apply_pending
+status: in_flight
 created: '2026-08-14'
 updated: '2026-08-14'
+in_flight:
+  missing_fields:
+  - openbao.policy_file
+  - openbao.auth
+  blocking_reason: Founder bootstrap API key and final operator authentication design
+    are pending; do not invent metadata or fill placeholders.
+  owner: platform-operator
 requester:
   agent: grok
   reason: >-
@@ -47,7 +54,7 @@ access_frontdoor:
   selector: scaleway bootstrap api
   command: bao kv put platform/workloads/railiance/scaleway/bootstrap
   resolvable: false
-  readiness: waiting-on-ui-replace-of-xxx-placeholders
+  readiness: approved-pending-apply
 delivery:
   surface: operator-workstation
   target: reef-storage/tools/create-platform-audit-bucket.sh (reads, never prints)
@@ -62,6 +69,11 @@ verification:
   - Field names present on the KV path; values not printed.
   negative:
   - default-policy token denied on the data path.
+  activation_conditions:
+  - Founder supplies the bootstrap credential through attended custody outside Git,
+    chat, argv, and State Hub.
+  - Platform operator records the exact policy artifact and authentication method
+    before the request leaves in_flight status.
 lifecycle:
   deactivate: Delete bootstrap key at Scaleway after the scoped bucket key works.
   rotate: Put a new bootstrap key; do not reuse the scoped backup key.