Fix UserInfo canonical subject resolution

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md

@@ -0,0 +1,46 @@
+---
+id: KEY-WP-0012
+type: workplan
+title: "Repair UserInfo canonical subject resolution"
+domain: infotech
+repo: key-cape
+status: active
+owner: codex
+topic_slug: userinfo-canonical-subject-resolution
+created: "2026-08-31"
+updated: "2026-08-31"
+---
+
+## Repair subject lookup
+
+```task
+id: KEY-WP-0012-T01
+status: done
+priority: high
+```
+
+Resolve the canonical LDAP-DN `sub` emitted by the token endpoint without
+passing it to the username-only repository lookup. Preserve stable subject
+semantics and verify any `preferred_username` lookup against the canonical ID.
+
+## Regression verification
+
+```task
+id: KEY-WP-0012-T02
+status: done
+priority: high
+```
+
+Cover canonical-ID, legacy username-sub, missing subject, and suspended-user
+behavior. Run the KeyCape test suite and image build checks.
+
+## Deploy and verify OpenBao OIDC
+
+```task
+id: KEY-WP-0012-T03
+status: progress
+priority: high
+```
+
+Publish and deploy the corrected KeyCape image, prove `/userinfo` accepts a
+fresh human access token, then resume the governed Policy Nexus bootstrap.