From 3ed3a391d6bc48269a5bf3709133793eb6cb5fc4 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 1 Sep 2026 01:36:12 +0200
Subject: [PATCH] docs: close canonical UserInfo repair

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
---
 ...WP-0012-userinfo-canonical-subject-resolution.md | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md b/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
index aa0ab44..37d4ac4 100644
--- a/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
+++ b/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Repair UserInfo canonical subject resolution"
 domain: infotech
 repo: key-cape
-status: active
+status: finished
 owner: codex
 topic_slug: userinfo-canonical-subject-resolution
 created: "2026-08-31"
-updated: "2026-08-31"
+updated: "2026-09-01"
 ---
 
 ## Repair subject lookup
@@ -38,9 +38,16 @@ behavior. Run the KeyCape test suite and image build checks.
 
 ```task
 id: KEY-WP-0012-T03
-status: progress
+status: done
 priority: high
 ```
 
 Publish and deploy the corrected KeyCape image, prove `/userinfo` accepts a
 fresh human access token, then resume the governed Policy Nexus bootstrap.
+
+Completed 2026-09-01. Forgejo Actions run 14 built commit
+`153258b9d39273d53ca7ab5d1bdc09961ea9026e`; image digest
+`sha256:4c7193efc3e50bd72a01812a583e823cc04f41ca96ef387b31ba9ae2533b80d0`
+rolled out successfully. A fresh OpenBao OIDC flow passed `/userinfo`, and the
+governed Policy Nexus bootstrap subsequently completed with deterministic
+session revocation.