openbao king credential bootstrapping

examples/security-bootstrap/king-credential-metadata.example.json

@@ -0,0 +1,30 @@
+{
+  "credential_label": "platform-root",
+  "setup_operator": "tegwick",
+  "notification_contact": "bernd.worsch@gmail.com",
+  "storage_classes": [
+    "password-safe",
+    "offline-packet"
+  ],
+  "mfa_class": "totp",
+  "mfa_enrolled_confirmed": false,
+  "mfa_enrollment_source": "deferred",
+  "mfa_enrollment_reference": "",
+  "recovery_confirmed": false,
+  "custody_packet_prepared": false,
+  "no_secret_capture_confirmed": false,
+  "king_credential_ready": false,
+  "custody_mode": "",
+  "custody_mode_approved": false,
+  "custody_approved_at": "",
+  "custody_approved_by": "",
+  "approval_scope": "",
+  "openbao_preflight_passed": false,
+  "openbao_initialized": false,
+  "root_token_disposition": "",
+  "restore_drill_passed": false,
+  "cleanup_complete": false,
+  "platform_reopened": false,
+  "review_date": "",
+  "notes": "Non-secret metadata only. Do not store passwords, OTP seeds, recovery codes, private keys, OpenBao root tokens, or unseal shares here."
+}