diff --git a/credential-change-requests/CCR-2026-0052-net-kingdom-identity-provisioner-bind.yaml b/credential-change-requests/CCR-2026-0052-net-kingdom-identity-provisioner-bind.yaml
index 49daa40..0f8b43b 100644
--- a/credential-change-requests/CCR-2026-0052-net-kingdom-identity-provisioner-bind.yaml
+++ b/credential-change-requests/CCR-2026-0052-net-kingdom-identity-provisioner-bind.yaml
@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: NetKingdom identity-provisioner directory bind (svc-provisioner) delivery
-status: approved
+status: verified
 created: '2026-10-30'
 updated: '2026-10-30'
 requester:
@@ -126,3 +126,16 @@ verification:
     from the decrypted custody copy without display.
   - Policy, role and KV in place and equal to live before the ExternalSecret is applied.
   - Positive and negative results recorded in value-free receipts.
+  evidence:
+  - at: '2026-10-30T22:23:46+00:00'
+    actor: founder (attended), claude-code guiding
+    kind: verifier_custody_and_rollout
+    result: passed
+    details:
+    - '2026-10-30: bind-lane.py setup (custody equal to live, coding agents fenced,
+      KV v1 CAS=0, policy+role) and verify (exact policy/TTL, wrong SA and audience
+      denied, metadata/sibling/token-create denied, KV equals delivered Secret, reader
+      revoked) passed; identity-provisioner rolled out Ready. First ESO apply refused
+      by reject-secret-last-applied, fixed with target.template.metadata {} (net-kingdom
+      985cfc3). Evidence: net-kingdom docs/evidence/2026-10-30-nk56-svc-provisioner-bind/
+      (87e57aa).'