Complete live State Hub signing activation and rotation acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

credential-change-requests/CCR-2026-0015-state-hub-preflight-signing.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: State Hub repository-rename preflight signing read lane
-status: approved
+status: active
 created: '2026-09-05'
 updated: '2026-09-05'
 requester:
@@ -73,8 +73,8 @@ access_frontdoor:
   type: external-secrets
   catalog_id: state-hub-rename-preflight
   selector: State Hub API preflight signing delivery only
-  readiness: pending-review
-  resolvable: false
+  readiness: ready
+  resolvable: true
 delivery:
   surface: external-secrets
   target: Namespace SecretStore openbao-state-hub-rename-preflight -> ExternalSecret/Secret
@@ -82,7 +82,7 @@ delivery:
     Retain deletion policy.
   bootstrap_command: See docs/credential-lane-designs/state-hub-preflight-signing.md;
     scripts/state_hub_preflight_lane.py stages the attended protected writer separately
-    from this read grant. Owner acceptance and the activation runbook remain pending.
+    from this read grant. Accepted activation and rotation evidence is recorded in state-hub-preflight-activation.md.
 risk:
   classification: high
   notes:
@@ -108,7 +108,15 @@ verification:
   - Demand remains FLEX-WP-0020-T05; target primary/railiance01 and fixture confirmed.
   - CAS-zero protected generation, exact read grant, and API-only delivery verified.
   - Controlled-outage fence and recovery exercised before completion.
-  evidence: []
+  evidence:
+  - at: '2026-09-05T15:59:08+00:00'
+    actor: codex
+    kind: frontdoor_activation
+    result: passed
+    details:
+    - 'docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json: exact access
+      negatives, ESO delivery, API-only signing, CAS version 2, predecessor signature
+      denial and forward recovery passed; Helm revision 59.'
 lifecycle:
   deactivate: Fence API replicas, disable signing binding and ESO role, restart without
     signing; retain KV history by explicit retention decision.