Record founder approval 2ab717e1 on CCR-2026-0033/0034 and the ESO admission

The custody refusal test now checks proposed copies instead of the committed
CCRs, which are approved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

credential-change-requests/CCR-2026-0033.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: KeyCape secrets-engine-openbao issuer workload reader and authoritative custody
-status: proposed
+status: approved
 created: '2026-10-04'
 updated: '2026-10-06'
 requester:
@@ -18,7 +18,19 @@ review:
   - platform-owner
   - key-cape-owner
   - net-kingdom-owner
-  comments: []
+  comments:
+  - at: '2026-10-07'
+    reviewer: platform-owner (founder Bernd Worsch)
+    decision: approved
+    comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as platform-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.'
+  - at: '2026-10-07'
+    reviewer: key-cape-owner (founder Bernd Worsch)
+    decision: approved
+    comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as key-cape-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.'
+  - at: '2026-10-07'
+    reviewer: net-kingdom-owner (founder Bernd Worsch)
+    decision: approved
+    comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as net-kingdom-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.'
 target:
   domain: infotech
   tenant: platform
@@ -50,7 +62,7 @@ openbao:
       - external-secrets
       service_account_namespaces:
       - external-secrets
-    bound_claims_confirmed: false
+    bound_claims_confirmed: true
   kv_metadata:
     cas_required: true
     max_versions: 2

credential-change-requests/CCR-2026-0034.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: KeyCape secrets-engine-openbao attended operator reader (in-memory, per command)
-status: proposed
+status: approved
 created: '2026-10-06'
 updated: '2026-10-06'
 requester:
@@ -29,6 +29,18 @@ review:
       KeyCape asks that the role also bind the assurance claim (/assurance/level = aal2,
       issued only after a verified factor). This is an owner report, not an approval
       and not the founder confirmation of bound claims.'
+  - at: '2026-10-07'
+    reviewer: platform-owner (founder Bernd Worsch)
+    decision: approved
+    comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as platform-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.'
+  - at: '2026-10-07'
+    reviewer: key-cape-owner (founder Bernd Worsch)
+    decision: approved
+    comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as key-cape-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.'
+  - at: '2026-10-07'
+    reviewer: net-kingdom-owner (founder Bernd Worsch)
+    decision: approved
+    comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as net-kingdom-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.'
 target:
   domain: infotech
   tenant: platform
@@ -66,7 +78,7 @@ openbao:
       groups:
       - net-kingdom-admins
       /assurance/level: aal2
-    bound_claims_confirmed: false
+    bound_claims_confirmed: true
     policies:
     - workload-kv-read-keycape-secrets-engine-openbao-operator
     ttl: 5m

docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml

@@ -1,11 +1,11 @@
-# DRAFT REVIEW ARTIFACT. Do not apply. No custody/admission supplied.
+# Admission approved by founder decision 2ab717e1-7881-491e-aed4-28946550c289 (A2). Apply only under the separate step-2 go, after the custody run.
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
   name: openbao-keycape-secrets-engine-openbao
   annotations:
     railiance.io/credential-change: CCR-2026-0033
-    railiance.io/admission: pending-review
+    railiance.io/admission: approved
 spec:
   provider:
     vault:
@@ -32,7 +32,7 @@ metadata:
   namespace: sso
   annotations:
     railiance.io/credential-change: CCR-2026-0033
-    railiance.io/admission: pending-review
+    railiance.io/admission: approved
 spec:
   refreshInterval: 5m
   secretStoreRef:
@@ -46,7 +46,7 @@ spec:
       metadata:
         annotations:
           railiance.io/credential-change: CCR-2026-0033
-          railiance.io/admission: pending-review
+          railiance.io/admission: approved
   data:
   - secretKey: client-secret
     remoteRef:

tests/test_keycape_secrets_engine_openbao_custody.py

@@ -117,11 +117,17 @@ class CustodyChild(unittest.TestCase):
             self.assertEqual((code, receipt['error']), (1, reason))
         self.assertEqual(self.bao.calls, [])
 
-    def test_committed_proposed_ccrs_are_refused(self):
-        with patch.object(child, 'CCR_PATH', ROOT / 'credential-change-requests/CCR-2026-0033.yaml'):
+    def proposed_copy(self, name):
+        text = (ROOT / 'credential-change-requests' / name).read_text()
+        path = Path(self.tmp.name) / name
+        path.write_text(text.replace('\nstatus: approved\n', '\nstatus: proposed\n', 1))
+        return path
+
+    def test_proposed_ccrs_are_refused(self):
+        with patch.object(child, 'CCR_PATH', self.proposed_copy('CCR-2026-0033.yaml')):
             code, receipt = self.run_child()
         self.assertEqual((code, receipt['error']), (1, 'approved_ccr_required'))
-        with patch.object(child, 'SIBLING_PATH', ROOT / 'credential-change-requests/CCR-2026-0034.yaml'):
+        with patch.object(child, 'SIBLING_PATH', self.proposed_copy('CCR-2026-0034.yaml')):
             code, receipt = self.run_child()
         self.assertEqual((code, receipt['error']), (1, 'approved_ccr_required'))
         self.assertEqual(self.bao.calls, [])