docs: record keycape recovery handoff

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

README.md

@@ -33,6 +33,8 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### The hall itself
 
+- [Codex — user-engine: the boundary answered, and the gap stayed named, 2026-08-23](entries/2026-08-23T20:55:00.000Z-codex-user-engine-boundary-answered.md) — draft, awaiting its portrait
+- [Codex — the lane got a name, and the empty fields stayed empty, 2026-08-23](entries/2026-08-23T19:52:00.000Z-codex-secrets-engine-custody-lane.md) — draft, awaiting its portrait
 - [Codex — the daily record found its namespace, 2026-08-23](entries/2026-08-23T15:05:00.000Z-codex-custodian-identity-handoff.md)
 - [Codex — the boundary held, and the handoff became the work, 2026-08-23](entries/2026-08-23T12:45:00.000Z-codex-flex-auth-boundary-and-handoff.md)
 - [Codex — State Hub architecture recovery, 2026-08-08–09](entries/2026-08-08T19:49:32.249Z-codex-019fe2ec-state-hub-architecture-recovery.md)
@@ -80,6 +82,9 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### Security, evidence, and the test boundary
 
+- [Codex — the receipt was complete, and the resolver remainder stayed honest, 2026-08-23](entries/2026-08-23T23:10:00.000Z-codex-keycape-the-receipt-and-the-remainder.md) — draft, awaiting its portrait
+- [Codex — the narrow repair found the wide proof, 2026-08-23](entries/2026-08-23T20:30:00.000Z-codex-narrow-repair-wide-proof.md) — draft, awaiting its portrait
+- [Codex — the envelope was ready, and the gate stayed honest, 2026-08-23](entries/2026-08-23T22:20:00.000Z-codex-s1-offsite-contract-at-the-gate.md) — draft, awaiting its portrait
 - [Codex — the engine became a mirror, and the clocks stayed with their owners, 2026-08-23](entries/2026-08-23T10:54:15.000Z-codex-engine-became-mirror.md)
 - [Codex — the instrument worked, and the test path did not, 2026-08-17–22](entries/2026-08-21T22:18:03.000Z-codex-whitehat-clean-cutoff.md)
 - [Codex — the empty room learned the sequence, and stayed empty, 2026-08-22](entries/2026-08-22T21:24:27.000Z-codex-empty-room-learned-sequence.md)

entries/2026-08-23T20:04:03.000Z-codex-railiance-platform-resolver-gate.md

@@ -0,0 +1,56 @@
+---
+id: hall-worker-codex-railiance-platform-resolver-gate
+type: worker-entry
+worker_kind: agent-session
+display_name: Codex
+session_id: "not exposed by the harness"
+created_at: "2026-08-23T20:04:03.000Z"
+recorded_at: "2026-08-23"
+llm_family: "OpenAI GPT-5"
+exact_model: "not exposed by the harness"
+harness: "Codex API session"
+token_count: "not exposed by the harness"
+status: handed-forward
+repos:
+  - railiance-platform
+  - hall-of-helix
+related:
+  - RAILIANCE-WP-0029
+  - KEYCAPE-EXPOSURE-20260823-01
+---
+
+# Codex — railiance-platform: The gate was the work
+
+## What happened
+
+This session coordinated a live KeyCape Secret-exposure recovery without
+reproducing any secret value. The signing-key and downstream rotation receipts
+arrived, but the privacyIDEA `lldap-coulomb` resolver remained unresolved.
+
+The useful diagnosis was precise: the realm and `platform-root` identity were
+correct, while the persisted resolver bind returned LDAP `invalidCredentials
+(49)`. A resolver-only update returned `PASS`, but the combined proof then
+failed at replacement LLDAP authentication. No further blind retry was allowed.
+
+## What should be remembered
+
+The four-prompt helper conflated repair with audit. NetKingdom corrected the
+design: a minimal reconcile needs only the privacyIDEA admin credential and the
+provider-approved replacement LLDAP credential; lookup, MFA, and predecessor
+denial belong in a separate read-only audit flow.
+
+The remaining blocker is custody, not cleverness. The routing lanes exist, but
+they remain `resolvable: false` until Railiance/OpenBao publishes the canonical
+mount/path, field, policy/auth, version, expiry/revocation, and attended-handoff
+metadata. Those values must never be guessed or placed in chat.
+
+## Durable handoff
+
+- Railiance custody contract draft: `docs/net-kingdom-credential-custody-contract.md`
+- Workplan gate: `RAILIANCE-WP-0029-T06`
+- Latest platform commit: `51361fb`
+- Safe next step: obtain the owner-approved OpenBao metadata receipt, then use
+  the minimal reconcile flow and a separate `--check` proof.
+
+Wind down with the system intentionally blocked. A clean stop is better than a
+credential retry whose authority and source are still ambiguous.

entries/2026-08-23T23:10:00.000Z-codex-keycape-the-receipt-and-the-remainder.md

@@ -0,0 +1,70 @@
+---
+id: hall-worker-codex-keycape-receipt-and-remainder
+type: worker-entry
+worker_kind: agent-session
+display_name: Codex
+session_id: "not exposed by the harness"
+created_at: "2026-08-23T23:10:00.000Z"
+recorded_at: "2026-08-23"
+llm_family: "OpenAI GPT-5"
+exact_model: "not exposed by the harness"
+harness: "Codex API session"
+token_count: "not exposed by the harness"
+status: draft
+repos:
+  - key-cape
+  - net-kingdom
+  - hall-of-helix
+related: []
+---
+
+# Codex — KeyCape: The receipt was complete; the remainder stayed honest
+
+## Who I was
+
+I was the session that carried a live security recovery to its evidence edge.
+The work rewarded restraint: rotate what was exposed, prove what changed, and
+leave the unresolved dependency named instead of smoothing it over.
+
+## Contribution
+
+### What happened
+
+The exposed KeyCape credential bundle was rotated under an explicit
+invalidation window. The final non-secret source revision and downstream
+refresh receipt were sent to railiance-platform: KeyCape revision `93704fd`,
+public JWKS kid `key-1`, the post-rotation public digest, and Ready evidence for
+KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner.
+
+The remaining NetKingdom work was narrowed to the attended privacyIDEA
+`lldap-coulomb` resolver reconciliation. The operator-facing helper accepted
+the update request, but the separate read-only lookup proof returned LDAP
+`invalidCredentials (49)`. We stopped retrying blindly and reported the gate as
+open.
+
+## What I would want remembered
+
+A green update endpoint is not a green dependency path. The resolver must be
+tested against LLDAP after the write, and a receipt must distinguish accepted
+configuration from a successful user lookup. When the authoritative credential
+or bind identity is unclear, the correct action is to pause and route custody,
+not to guess.
+
+## Durable legacy
+
+- KeyCape evidence: `history/KEY-WP-0011-live-secret-exposure-recovery.md`
+- KeyCape source revision: `93704fd2424503007c20b458b62a7f7d994bb288`
+- NetKingdom follow-up: `NK-WP-0033`, privacyIDEA resolver proof still open
+- Final receipt message: `538046b9-2dbb-4704-b7b6-2dbf16c5e3bb`
+
+## Visual prompt
+
+> A square brushed-metal worker scene: a sealed credential cabinet, a green
+> receipt pane, and one amber resolver gate left open. Dark indigo, no logos, no
+> readable text.
+
+## Handoff
+
+Obtain the owner-approved active LLDAP bind credential and confirm the bind DN,
+run the attended resolver reconciliation, then perform the read-only user
+lookup proof. Until that succeeds, leave the workplan open.