CCR-2026-0051: binding confirmed on native evidence, status applied; RPF-WP-0061 follow-up D

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 306568@bnt-lap001
Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91

credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Temporary MAS Scaleway TEM relay SMTP ESO read lane
-status: approved
+status: applied
 created: '2026-10-18'
 updated: '2026-10-18'
 requester:
@@ -37,6 +37,15 @@ review:
       path=platform/suppliers/scaleway/mas-tem-relay policy=workload-kv-read-mas-tem-relay
       auth_role=auth/kubernetes/role/external-secrets-mas-tem-relay; rationale=temporary
       MAS TEM relay lane, read-only, namespace mas, torn down with mas'
+  - at: '2026-10-18T10:58:26+00:00'
+    reviewer: railiance-platform-owner (claude, native evidence)
+    decision: binding_confirmed
+    comment: 'Native 2026-10-18: SA mas-tem-relay-eso exists in ns mas (consumer mail-address-semantics
+      deploy/railiance/manifests.yaml 2e9a074, automount false). SecretStore mas/openbao-mas-tem-relay
+      references mount kubernetes, role external-secrets-mas-tem-relay, SA mas-tem-relay-eso,
+      audience openbao, and validated Ready at 10:49:56Z, i.e. a successful login
+      with exactly the CCR bound claims. ESO reads the path; the 10:56:56Z failure
+      is consumer-side admission, not auth.'
 target:
   domain: infotech
   tenant: platform
@@ -63,7 +72,7 @@ openbao:
       - mas-tem-relay-eso
       service_account_namespaces:
       - mas
-    bound_claims_confirmed: false
+    bound_claims_confirmed: true
     policies:
     - workload-kv-read-mas-tem-relay
     ttl: 15m
@@ -119,6 +128,17 @@ verification:
       no value read
     - 'pending: SA mas-tem-relay-eso not yet applied (bound_claims_confirmed false);
       confirm-binding and ESO sync next'
+  - at: '2026-10-18T10:58:27+00:00'
+    actor: railiance-platform (claude)
+    kind: native-binding
+    result: success
+    details:
+    - SecretStoreValid 2026-10-18T10:49:56Z with the exact CCR SA/namespace/audience/role;
+      ESO provider read succeeded; ops-mason apply readback 102668f.
+    - 'Open: ExternalSecret mas/mas-relay refused by admission policy reject-secret-last-applied
+      (client-side apply annotation copied to target); fix sent to mail-address-semantics
+      1a76a832. Negative checks (wrong SA/namespace/audience, sibling, list, metadata,
+      write) not yet run.'
 lifecycle:
   deactivate: Delete ExternalSecret and role external-secrets-mas-tem-relay, then
     policy workload-kv-read-mas-tem-relay, when namespace mas is torn down.

workplans/RPF-WP-0061-self-service-ccr-intake.md

@@ -172,6 +172,11 @@ MFA-backed OIDC login so clients can sync themselves; (C) separate Forgejo and
 OS identities per agent so `ccr/*` can be restricted. Both stem from the
 finding that every workstation agent pushes as Forgejo user `tegwick` with the
 key `workstation-automation`.
+(D, ops-mason point 5) Self-service teardown: deactivate lifecycle event filed
+by the client and applied under ops-mason-construct. Founder to decide whether a
+deactivate needs a decision. Until then teardown goes through a platform session.
+ops-mason points 1-4 were adopted in 7e7ca8b (`plan_ref`, `render-policy`,
+single hub decision, readback before `record-evidence`).
 
 ## T05 — Client documentation and first self-service CCR