CCR-2026-0029/0030: record positive verification (ExternalSecret synced)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml

@@ -171,6 +171,17 @@ verification:
       actcore-forgejo-admin force-synced at 18:06:45Z.
     - Positive and negative verification waits for activity-core to apply
       actcore-ops-run-worker-tokens (ACTIVITY-WP-0039-T04).
+  - at: '2026-09-23T20:35:35+00:00'
+    actor: railiance-platform
+    kind: positive_verification
+    result: passed
+    details:
+    - ExternalSecret activity-core/actcore-ops-run-worker-tokens (store
+      openbao-activity-core) reached SecretSynced at 20:35:35Z. It was
+      observed read-only by status only. No Secret data or metadata was read.
+    - The negative check (sibling path and list denied for role
+      activity-core-eso) is still to run. It follows from the exact-path
+      policy but has not been exercised live.
 lifecycle:
   deactivate: >-
     Detach the policy from the eventual role and disable the ops-warden catalog

credential-change-requests/CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml

@@ -110,6 +110,17 @@ verification:
       actcore-forgejo-admin force-synced at 18:06:45Z.
     - Positive and negative verification waits for activity-core to apply
       actcore-ops-run-worker-tokens (ACTIVITY-WP-0039-T04).
+  - at: '2026-09-23T20:35:35+00:00'
+    actor: railiance-platform
+    kind: positive_verification
+    result: passed
+    details:
+    - ExternalSecret activity-core/actcore-ops-run-worker-tokens (store
+      openbao-activity-core) reached SecretSynced at 20:35:35Z. It was
+      observed read-only by status only. No Secret data or metadata was read.
+    - The negative check (sibling path and list denied for role
+      activity-core-eso) is still to run. It follows from the exact-path
+      policy but has not been exercised live.
 lifecycle:
   deactivate: Remove the two path blocks from workload-kv-read-activity-core-eso
     and re-apply it.

credential-change-requests/CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml

@@ -110,6 +110,17 @@ verification:
       actcore-forgejo-admin force-synced at 18:06:45Z.
     - Positive and negative verification waits for activity-core to apply
       actcore-ops-run-worker-tokens (ACTIVITY-WP-0039-T04).
+  - at: '2026-09-23T20:35:35+00:00'
+    actor: railiance-platform
+    kind: positive_verification
+    result: passed
+    details:
+    - ExternalSecret activity-core/actcore-ops-run-worker-tokens (store
+      openbao-activity-core) reached SecretSynced at 20:35:35Z. It was
+      observed read-only by status only. No Secret data or metadata was read.
+    - The negative check (sibling path and list denied for role
+      activity-core-eso) is still to run. It follows from the exact-path
+      policy but has not been exercised live.
 lifecycle:
   deactivate: Remove the two path blocks from workload-kv-read-activity-core-eso
     and re-apply it.