feat: verify live KeyCape custody and preserve versions on resume

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml

@@ -3,9 +3,9 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: KeyCape verifier custody for the secrets-engine-approval confidential client
-status: approved
+status: verified
 created: '2026-09-08'
-updated: '2026-09-08'
+updated: '2026-09-09'
 requester:
   agent: claude
   reason: "KEY-WP-0013-T02 (State Hub message 278a3ebe-b529-49f6-bd1a-e3ebcf318260)\
@@ -140,7 +140,29 @@ verification:
   - Policy, Kubernetes auth role and ClusterSecretStore applied before the ExternalSecret;
     sync confirmed before the KeyCape image is rolled out.
   - Positive and negative results recorded with non-secret request ids or timestamps.
-  evidence: []
+  evidence:
+  - at: '2026-09-09T00:14:27+00:00'
+    actor: the-custodian (codex)
+    kind: verifier_custody_and_rollout
+    result: passed
+    details:
+    - Named user approval recorded for platform-operator and key-cape-owner on 2026-09-09.
+    - Initial CAS=0 custody created version 1. Verified rollback/resume retained the
+      same values and versions.
+    - Both stores Valid and ExternalSecrets SecretSynced; exact native read, sibling/listing
+      and wrong service account/namespace/store-use denials passed; reader revocation
+      and coding-agent deny precedence passed.
+    - Pinned image 7ff54c54e63e has one ready replica; protected previous config/image
+      retained and signing key unchanged.
+    - Both clients passed live JWKS and exact audience/subject/tenant/role/scope/900-second
+      lifetime checks, excess-scope and wrong-secret denials; human client consume
+      denied.
+    - Native verifier from pinned image ran in the attended owner process with memory-only
+      credentials. Pod network policy remains unchanged. Future iat bound is the existing
+      30-second contract; expiry has zero leeway.
+    - Fresh post-rollout OpenBao OIDC login succeeded and self-revoked. No client-side
+      fetch front door or factory spending was admitted.
+    - 'Receipt: docs/evidence/2026-09-09-keycape-verifier-admission.json'
 lifecycle:
   deactivate: KeyCape disables the secrets-engine-approval registration; platform
     detaches the policy from role external-secrets-keycape-secrets-engine-approval

credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml

@@ -3,9 +3,9 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: KeyCape verifier custody for the approval-engine-operator confidential client
-status: approved
+status: verified
 created: '2026-09-08'
-updated: '2026-09-08'
+updated: '2026-09-09'
 requester:
   agent: claude
   reason: 'Second of the two registrations in KEY-WP-0013-T02 (State Hub message 278a3ebe-b529-49f6-bd1a-e3ebcf318260):
@@ -122,7 +122,29 @@ verification:
   - Policy, Kubernetes auth role and ClusterSecretStore applied before the ExternalSecret;
     sync confirmed before the KeyCape rollout.
   - Positive and negative results recorded with non-secret request ids or timestamps.
-  evidence: []
+  evidence:
+  - at: '2026-09-09T00:14:27+00:00'
+    actor: the-custodian (codex)
+    kind: verifier_custody_and_rollout
+    result: passed
+    details:
+    - Named user approval recorded for platform-operator and key-cape-owner on 2026-09-09.
+    - Initial CAS=0 custody created version 1. Verified rollback/resume retained the
+      same values and versions.
+    - Both stores Valid and ExternalSecrets SecretSynced; exact native read, sibling/listing
+      and wrong service account/namespace/store-use denials passed; reader revocation
+      and coding-agent deny precedence passed.
+    - Pinned image 7ff54c54e63e has one ready replica; protected previous config/image
+      retained and signing key unchanged.
+    - Both clients passed live JWKS and exact audience/subject/tenant/role/scope/900-second
+      lifetime checks, excess-scope and wrong-secret denials; human client consume
+      denied.
+    - Native verifier from pinned image ran in the attended owner process with memory-only
+      credentials. Pod network policy remains unchanged. Future iat bound is the existing
+      30-second contract; expiry has zero leeway.
+    - Fresh post-rollout OpenBao OIDC login succeeded and self-revoked. No client-side
+      fetch front door or factory spending was admitted.
+    - 'Receipt: docs/evidence/2026-09-09-keycape-verifier-admission.json'
 lifecycle:
   deactivate: KeyCape disables the approval-engine-operator registration; platform
     detaches the policy from role external-secrets-keycape-approval-engine-operator