{
  "schema": "railiance-openbao-restore-receipt/v2",
  "extends": "docs/openbao-restore-drill-evidence.example.json",
  "attempt_id": "RPF-WP-0064-T07-YYYYMMDD-01",
  "material": "original",
  "phase": "A",
  "admission_sha256": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
  "admission_namespace": "railiance-openbao-restore-attempt",
  "signer_principal": "founder",
  "signer_fingerprint": "replace-with-ssh-signer-fingerprint",
  "anchor_protected": true,
  "abort_operator": "founder",
  "adapter_commit": "replace-with-40-hex-adapter-commit",
  "source_sha256": {
    "docs/contracts/secrets-engine-openbao-jwt-login.yaml": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "openbao/auth/keycape-services-config.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "openbao/auth/netkingdom-oidc-config.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "openbao/auth/netkingdom-platform-admin-role.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "openbao/auth/secrets-engine-jwt-role.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "openbao/policies/secrets-engine-login-self.hcl": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "scripts/openbao-isolated-restore/preflight.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "scripts/openbao-isolated-restore/restore_adapter.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "scripts/openbao-isolated-restore/run-isolated-restore.sh": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
    "scripts/openbao-isolated-restore/verify-restore-receipt.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
  },
  "started_at": "YYYY-MM-DDTHH:MM:SSZ",
  "finished_at": "YYYY-MM-DDTHH:MM:SSZ",
  "not_after": "YYYY-MM-DDTHH:MM:SSZ",
  "deadline_seconds": 2700,
  "elapsed_seconds": 0,
  "image": "quay.io/openbao/openbao@sha256:0000000000000000000000000000000000000000000000000000000000000000",
  "image_id": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
  "snapshot": {
    "ciphertext_sha256": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
    "ciphertext_bytes": 0,
    "plaintext_sha256": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
    "source_cluster_id": "replace-with-source-cluster-id",
    "source_applied_index": 0,
    "source_receipt_sha256": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
    "ciphertext_verified": true,
    "plaintext_verified": true
  },
  "restored": {
    "cluster_id": "replace-with-restored-cluster-id",
    "applied_index": 0,
    "sealed_after_restore": true,
    "unsealed_with_original_shares": true,
    "cluster_id_match": true,
    "applied_index_not_behind": true,
    "throwaway_init_invalidated": true,
    "leader_wait": {
      "waited_seconds": 3,
      "polls": 4,
      "elected": true,
      "last_leader": {
        "ha_enabled": true,
        "is_self": true,
        "leader_address": "http://127.0.0.1:8200",
        "leader_cluster_address": "https://127.0.0.1:8201",
        "raft_committed_index": 6040620,
        "raft_applied_index": 6040620,
        "active_time": "2026-10-24T09:00:00Z"
      },
      "last_seal": {
        "sealed": null,
        "initialized": null,
        "storage_type": null,
        "version": null
      },
      "last_error": null
    }
  },
  "network": {
    "network_mode": "none",
    "docker_networks": [
      "none"
    ],
    "interfaces": [
      "lo"
    ],
    "published_ports": [],
    "mounts": [],
    "egress_refused": true
  },
  "objects": [
    {
      "object": "auth_mount_keycape_services",
      "path": "sys/auth",
      "present": true,
      "source_match": true,
      "source_path": null,
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "auth_mount_netkingdom",
      "path": "sys/auth",
      "present": true,
      "source_match": true,
      "source_path": null,
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "kv_mount_platform",
      "path": "sys/mounts",
      "present": true,
      "source_match": true,
      "source_path": null,
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "keycape_services_config",
      "path": "auth/keycape-services/config",
      "present": true,
      "source_match": true,
      "source_path": "openbao/auth/keycape-services-config.json",
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "secrets_engine_jwt_role",
      "path": "auth/keycape-services/role/secrets-engine-openbao",
      "present": true,
      "source_match": true,
      "source_path": "openbao/auth/secrets-engine-jwt-role.json",
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "netkingdom_oidc_config",
      "path": "auth/netkingdom/config",
      "present": true,
      "source_match": true,
      "source_path": "openbao/auth/netkingdom-oidc-config.json",
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "platform_admin_role",
      "path": "auth/netkingdom/role/platform-admin",
      "present": true,
      "source_match": true,
      "source_path": "openbao/auth/netkingdom-platform-admin-role.json",
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "policy_secrets_engine_login_self",
      "path": "sys/policies/acl/secrets-engine-login-self",
      "present": true,
      "source_match": true,
      "source_path": "openbao/policies/secrets-engine-login-self.hcl",
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    },
    {
      "object": "kv_registration_metadata",
      "path": "platform/metadata/workloads/keycape/secrets-engine-openbao",
      "present": true,
      "source_match": true,
      "source_path": null,
      "observed_sha256": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
    }
  ],
  "result": "restored",
  "reason": "all_required_objects_match",
  "teardown": {
    "container_removed": true,
    "container_absent_verified": true,
    "plaintext_memfd_closed": true,
    "custody_memfd_closed": true,
    "readback_credential_revoked": true,
    "docker_volumes_created": 0,
    "performed_by": "session"
  },
  "kv_data_read": false,
  "no_secret_material_recorded": true,
  "claims_not_made": [
    "consumer_continuity",
    "live_jwt_login",
    "phase_b_network",
    "owner_acceptance",
    "recurring_restore_assurance",
    "production_redirect"
  ]
}