From 5f30ddd90c33e7eb1b9efa1093c7324d83210cf2 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Fri, 16 Oct 2026 09:42:10 +0200
Subject: [PATCH] security: verify backup credential requests against recovered
 archive and live job

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
---
 .../CCR-2026-0048-net-kingdom-backup-publisher.yaml | 13 ++++++++++++-
 .../CCR-2026-0049-net-kingdom-backup-retention.yaml | 13 ++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
index ee9c91a..35f4c9f 100644
--- a/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
+++ b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
@@ -4,7 +4,7 @@
   "schema_version": 1,
   "request_type": "workload-kv-read",
   "title": "NetKingdom identity backup publisher delivery",
-  "status": "applied",
+  "status": "verified",
   "created": "2026-10-16",
   "updated": "2026-10-16",
   "requester": {
@@ -143,6 +143,17 @@
       "bounded_policy_ttl": true,
       "eso_equality_verified": true,
       "temporary_reader_revoked": true
+    },
+    "actual_archive_and_runtime_acceptance": {
+      "owner_repo": "net-kingdom",
+      "archive_recovery": "docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json",
+      "activation": "docs/evidence/2026-10-16-identity-backup-live/activation-review.json",
+      "recurring_job": "docs/evidence/2026-10-16-identity-backup-live/recurring-job-review.json",
+      "independent_owner_retrieval_and_key_recovery_passed": true,
+      "systemd_job_result": "success",
+      "timers_enabled": true,
+      "retention_pinned_and_newest_protected": true,
+      "native_full_service_authentication_claimed": false
     }
   },
   "state_hub": {
diff --git a/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
index b7deb85..255eef7 100644
--- a/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
+++ b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
@@ -4,7 +4,7 @@
   "schema_version": 1,
   "request_type": "workload-kv-read",
   "title": "NetKingdom identity backup retention delivery",
-  "status": "applied",
+  "status": "verified",
   "created": "2026-10-16",
   "updated": "2026-10-16",
   "requester": {
@@ -143,6 +143,17 @@
       "bounded_policy_ttl": true,
       "eso_equality_verified": true,
       "temporary_reader_revoked": true
+    },
+    "actual_archive_and_runtime_acceptance": {
+      "owner_repo": "net-kingdom",
+      "archive_recovery": "docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json",
+      "activation": "docs/evidence/2026-10-16-identity-backup-live/activation-review.json",
+      "recurring_job": "docs/evidence/2026-10-16-identity-backup-live/recurring-job-review.json",
+      "independent_owner_retrieval_and_key_recovery_passed": true,
+      "systemd_job_result": "success",
+      "timers_enabled": true,
+      "retention_pinned_and_newest_protected": true,
+      "native_full_service_authentication_claimed": false
     }
   },
   "state_hub": {