Add bounded resource audiences and enforce browser scope grants

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b

workplans/ADHOC-2026-09-05.md

@@ -0,0 +1,27 @@
+---
+id: ADHOC-2026-09-05
+type: workplan
+title: "Repository review and layer declaration"
+domain: infotech
+repo: key-cape
+status: finished
+owner: codex
+created: "2026-09-05"
+updated: "2026-09-05"
+state_hub_workstream_id: "6f5a12f0-5dac-5e02-bbd9-9ab2263264ba"
+---
+
+## Resolve declaration intake and normalize repository records
+
+```task
+id: ADHOC-2026-09-05-T01
+status: done
+priority: low
+state_hub_task_id: "54c89abe-2539-550d-bc3a-649af8d4580a"
+```
+
+Reviewed KEY-IN-0001 against local security-layer-model_v0.4. Declared Tooling
+and the authentication/authorization boundary in INTENT.md and closed the intake.
+Normalized two legacy completed workplan frontmatter statuses to finished.
+Ignored the generated .repo-manager workstation cache. Existing task statuses
+already conform to the State Hub task lifecycle canon.

workplans/KEY-WP-0001-keycape-implementation.md

@@ -4,7 +4,7 @@ type: workplan
 title: "KeyCape Implementation — Lightweight IAM Profile"
 domain: infotech
 repo: key-cape
-status: done
+status: finished
 owner: Bernd
 topic_slug: netkingdom
 topic_id: a6c6e745-bf54-4465-9340-1534a2be493e

workplans/KEY-WP-0002-container-image-gitea.md

@@ -4,7 +4,7 @@ type: workplan
 title: "KeyCape Container Image — Build & Publish to Gitea OCI Registry"
 domain: infotech
 repo: key-cape
-status: done
+status: finished
 owner: netkingdom
 topic_slug: netkingdom
 created: "2026-03-22"

workplans/KEY-WP-0013-approval-engine-resource-audience.md

@@ -0,0 +1,47 @@
+---
+id: KEY-WP-0013
+type: workplan
+title: "Approval-engine resource audience and client registrations"
+domain: infotech
+repo: key-cape
+status: blocked
+owner: codex
+topic_slug: approval-engine-resource-audience
+created: "2026-09-05"
+updated: "2026-09-05"
+state_hub_workstream_id: "6e815d88-b0e3-5ce0-be5d-13ab15917f7f"
+---
+
+Source: approval-engine inbox request 5583e896-52f2-45bd-895f-02f227b7e836,
+reviewed against its local registration and caller-authentication contracts.
+
+## Implement static resource audiences
+
+```task
+id: KEY-WP-0013-T01
+status: done
+priority: high
+state_hub_task_id: "a92432a2-4e92-5b90-be2b-d82b784bf8f0"
+```
+
+Added optional static audience configuration for access tokens in both grants;
+ID tokens retain the relying-party audience. Added human access-token scope.
+Published bounded approval service fragments and the human registration contract.
+Regression tests cover the default audience, request override resistance, JWKS
+signature validation, ID-token separation and service registration scope isolation.
+Browser requests and token exchanges now enforce the client scope allow-list,
+including grants removed after authorization.
+
+## Provision and prove live registrations
+
+```task
+id: KEY-WP-0013-T02
+status: wait
+priority: high
+state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8"
+```
+
+Needs deployment-owned custody for both new secret references and an exact human
+callback registration. Deploy the implementation and registrations together,
+then prove live JWKS verification and denied excess scopes without logging values.
+Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md.

workplans/KEY-WP-0014-native-credential-lane-handoff.md

@@ -0,0 +1,45 @@
+---
+id: KEY-WP-0014
+type: workplan
+title: "Review native login and client credential lane handoffs"
+domain: infotech
+repo: key-cape
+status: proposed
+owner: codex
+topic_slug: native-credential-lane-handoff
+created: "2026-09-05"
+updated: "2026-09-05"
+state_hub_workstream_id: "0d003df3-f7d3-5063-8ca0-e1e33f7df74a"
+---
+
+Source: ops-warden inbox message 0dd9c7bd-0ecd-42d1-806f-7cc4ba9730ed.
+The issuer supports client_secret_basic exchange, but has no native exchange or
+rotation CLI. Existing machine issuance ownership does not complete this handoff.
+
+## Design owner command and custody boundaries
+
+```task
+id: KEY-WP-0014-T01
+status: todo
+priority: medium
+state_hub_task_id: "0c0a0b61-c19e-5631-9cda-8b2dc0f47d8f"
+```
+
+Review ops-warden's existing key-cape-oidc-login proxy and
+rapp-qonto-keycape-client route contracts. Specify the native interactive login
+and bounded exchange commands, token delivery, renewal and custody-mediated
+rotation before implementation. Keep secret custody with OpenBao and avoid
+retiring the proxy until replacement commands have equivalent verification.
+
+## Verify handoff delivery evidence
+
+```task
+id: KEY-WP-0014-T02
+status: todo
+priority: low
+state_hub_task_id: "d9a5de97-b7d5-5599-98c2-eaab32f51495"
+```
+
+Ops-warden reports KEY-WP-0009-T04's claimed reply did not arrive. Verify prior
+receipts for all four named recipients before claiming successful notification.
+No outbound coordination messages were sent during the 2026-09-05 repo review.