From 8164c57467c225bb73cbe66a1154564a0b55b5bb Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 16 Oct 2026 09:21:38 +0200 Subject: [PATCH] security: record native backup reader and ESO delivery acceptance Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- ...026-0048-net-kingdom-backup-publisher.yaml | 19 ++++++++++++++++--- ...026-0049-net-kingdom-backup-retention.yaml | 19 ++++++++++++++++--- 2 files changed, 32 insertions(+), 6 deletions(-) diff --git a/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml index bb91554..ee9c91a 100644 --- a/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml +++ b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml @@ -4,7 +4,7 @@ "schema_version": 1, "request_type": "workload-kv-read", "title": "NetKingdom identity backup publisher delivery", - "status": "approved", + "status": "applied", "created": "2026-10-16", "updated": "2026-10-16", "requester": { @@ -79,7 +79,7 @@ "sso" ] }, - "bound_claims_confirmed": false + "bound_claims_confirmed": true } }, "provider": { @@ -130,7 +130,20 @@ "Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.", "First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.", "Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups." - ] + ], + "actual_native_receipt": { + "repository": "net-kingdom", + "path": "docs/evidence/2026-10-16-identity-backup-live/publisher-native-delivery-verified.json", + "source_ccr_sha256": "a7d5c356ce0c4df9de439a58ad3d36e1578f27cda327c9387e97cfc2e9dc7cdc", + "status": "reader_and_delivery_verified", + "kv_version": 1, + "wrong_service_account_denied": true, + "wrong_namespace_denied": true, + "wrong_audience_denied": true, + "bounded_policy_ttl": true, + "eso_equality_verified": true, + "temporary_reader_revoked": true + } }, "state_hub": { "workplan_id": "NK-WP-0049", diff --git a/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml index b3c50f7..b7deb85 100644 --- a/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml +++ b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml @@ -4,7 +4,7 @@ "schema_version": 1, "request_type": "workload-kv-read", "title": "NetKingdom identity backup retention delivery", - "status": "approved", + "status": "applied", "created": "2026-10-16", "updated": "2026-10-16", "requester": { @@ -79,7 +79,7 @@ "sso" ] }, - "bound_claims_confirmed": false + "bound_claims_confirmed": true } }, "provider": { @@ -130,7 +130,20 @@ "Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.", "First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.", "Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups." - ] + ], + "actual_native_receipt": { + "repository": "net-kingdom", + "path": "docs/evidence/2026-10-16-identity-backup-live/retention-native-delivery-verified.json", + "source_ccr_sha256": "d391018abbda0fbc1acec4b5a22c0f99ce65525de940431df376a7552b3746cf", + "status": "reader_and_delivery_verified", + "kv_version": 1, + "wrong_service_account_denied": true, + "wrong_namespace_denied": true, + "wrong_audience_denied": true, + "bounded_policy_ttl": true, + "eso_equality_verified": true, + "temporary_reader_revoked": true + } }, "state_hub": { "workplan_id": "NK-WP-0049",