CCR-2026-0060/0061/0063: delegated metadata apply (NK-WP-0056-T06)

credential-change-requests/CCR-2026-0060-nk-bind-executor-approval-keycape-eso-reader.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: 'nk-bind-executor-approval: keycape-reader-policy and eso-role (oidc-service-client@0.2)'
-status: approved
+status: applied
 created: '2026-10-31'
 updated: '2026-11-04'
 requester:
@@ -107,6 +107,16 @@ verification:
     fence) before the role exists.
   - platform-owner approval of this exact request and bound_claims_confirmed set to
     true.
+  evidence:
+  - at: '2026-11-04T22:09:41+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-nk-bind-executor-approval-eso'
+    - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-nk-bind-executor-approval'
+    - No secret values were read, written, printed, or accepted in argv.
 lifecycle:
   deactivate: delete ExternalSecret sso/keycape-nk-bind-executor-approval-client,
     then role external-secrets-keycape-nk-bind-executor-approval, then the policy

credential-change-requests/CCR-2026-0061-nk-bind-executor-approval-consumer-reader.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: 'nk-bind-executor-approval: consumer reader for sso/nk-bind-executor (oidc-service-client@0.2)'
-status: approved
+status: applied
 created: '2026-10-31'
 updated: '2026-11-04'
 requester:
@@ -138,6 +138,16 @@ verification:
   - Attended platform-admin (aal2) session or the delegated applier applies policy
     and role from a reviewed commit; positive and negative results recorded in value-free
     receipts.
+  evidence:
+  - at: '2026-11-04T22:09:46+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor'
+    - 'Auth role metadata write: auth/kubernetes/role/keycape-nk-bind-executor-approval-bounded-executor-workload-kv-read'
+    - No secret values were read, written, printed, or accepted in argv.
 security_case:
   case: nk-bind-executor-approval
   type: oidc-service-client@0.2

credential-change-requests/CCR-2026-0063-nk-bind-executor-audit-sender.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: NetKingdom bounded-executor audit sender custody and delivery
-status: approved
+status: applied
 created: '2026-11-03'
 updated: '2026-11-04'
 requester:
@@ -156,6 +156,16 @@ verification:
   - Record native positive and negative evidence before declaring verified or active.
     Custody alone admits no executor run; that stays with the founder-signed admission
     (NK-WP-0056-T06).
+  evidence:
+  - at: '2026-11-04T22:09:51+00:00'
+    actor: founder
+    kind: delegated_metadata_apply
+    result: passed
+    details:
+    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
+    - 'Policy metadata write: sys/policies/acl/workload-kv-read-nk-bind-executor-audit'
+    - 'Auth role metadata write: auth/kubernetes/role/external-secrets-nk-bind-executor-audit'
+    - No secret values were read, written, printed, or accepted in argv.
 lifecycle:
   deactivate: Stop the executor; remove only its token from the registry using CAS
     and reload and verify receiver refusal. Then detach the reader policy and remove