Record the CCR-2026-0044 metadata apply.

The delegated applier wrote the caller policy and auth/netkingdom role. No secret value was read or written.

Assistant: grok
Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6

credential-change-requests/CCR-2026-0044-reuse-surface-hub-writer-caller.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Name the dedicated reuse-surface hub-writer caller
-status: approved
+status: applied
 created: '2026-10-14'
 updated: '2026-10-14'
 requester:
@@ -126,6 +126,16 @@ verification:
   - Founder applies policy and role through the delegated applier. No KV write.
   - scripts/verify-reuse-surface-hub-writer.py member and non-member both pass. Receipts
     stay mode 0600 and contain no token or field value.
+  evidence:
+  - at: '2026-10-14T17:47:43+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-reuse-surface-runtime'
+    - 'Auth role metadata write: auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
 lifecycle:
   deactivate: delete auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read.
     Leave the KV path, the ESO role, and CCR-2026-0005 delivery in place.