{
  "observed_at": "2026-09-08T20:36:47.042499+00:00",
  "requests": [
    "CCR-2026-0017",
    "CCR-2026-0018"
  ],
  "operation": "capabilities-self only",
  "credential_data_read": false,
  "metadata_applied": false,
  "custody_activated": false,
  "upstream_issuer_proven": false,
  "status": "observed",
  "capabilities": {
    "sys/policies/acl/workload-kv-read-keycape-secrets-engine-approval": [
      "create",
      "delete",
      "list",
      "read",
      "sudo",
      "update"
    ],
    "sys/policies/acl/workload-kv-read-keycape-approval-engine-operator": [
      "create",
      "delete",
      "list",
      "read",
      "sudo",
      "update"
    ],
    "auth/kubernetes/role/external-secrets-keycape-secrets-engine-approval": [
      "create",
      "delete",
      "list",
      "read",
      "sudo",
      "update"
    ],
    "auth/kubernetes/role/external-secrets-keycape-approval-engine-operator": [
      "create",
      "delete",
      "list",
      "read",
      "sudo",
      "update"
    ],
    "platform/data/workloads/secrets-engine/approval-client": [
      "create",
      "delete",
      "list",
      "read",
      "update"
    ],
    "platform/data/workloads/approval-engine/operator-client": [
      "create",
      "delete",
      "list",
      "read",
      "update"
    ]
  },
  "required_metadata_capabilities_present": true,
  "paths_verified": 6,
  "login_lane": "openbao-platform-admin-login",
  "launcher": "scripts/openbao-attended-exec.py",
  "command": "scripts/keycape-approval-custody-preflight.py --receipt <new-private-file>",
  "wrapper_exit": 0,
  "session_self_revoked": true,
  "helper_root_removed": true,
  "attempt_notes": [
    {
      "attempt": 1,
      "result": "direct launcher unavailable; no child handoff; revocation unconfirmed",
      "credential_data_read": false
    },
    {
      "attempt": 2,
      "result": "owner wrapper login/self-revocation succeeded; capability command rejected unsupported multiple-path syntax",
      "credential_data_read": false
    },
    {
      "attempt": 3,
      "result": "six single-path capability queries succeeded; session self-revoked and helper removed",
      "credential_data_read": false
    }
  ]
}