Add opt-in issuer-owned access-token status and scoped revocation

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7

workplans/ADHOC-2026-09-27.md

@@ -70,6 +70,7 @@ can approve after a fresh sign-in against this build.
 id: ADHOC-2026-09-27-T02
 status: done
 priority: high
+state_hub_task_id: "7fa0bfc7-0772-57c7-8d6f-641615cab82a"
 ```
 
 Rolling out T01 (image digest `sha256:248e449a...`) broke every KeyCape login,

workplans/KEY-WP-0042-online-access-token-status.md

@@ -0,0 +1,84 @@
+---
+id: KEY-WP-0042
+type: workplan
+title: "Provide issuer-owned current access-token status and scoped revocation"
+domain: infotech
+repo: key-cape
+status: proposed
+owner: codex
+topic_slug: custodian
+created: "2026-10-18"
+updated: "2026-10-18"
+flavor: extension
+depends_on: []
+state_hub_workstream_id: "e2eecd1c-45c7-5a7c-bd1c-d31c845e3d38"
+---
+
+CUST-WP-0080's current-operation/inverse requirement exposed a concrete missing
+issuer facility. KEY-WP-0025-T03 truthfully documents the expiry-only limit;
+KEY-WP-0038 owns Forgejo's existing client, not a token-liveness API. This is an
+explicit proposed scope extension in the existing issuer, not a silent change
+to that completed limit record. No new service or duplicate session authority.
+Consumer binding/authorization and native case acceptance stay in
+NK-WP-0048-T34/T42/T43 and RAPPS-WP-0016-T08/T09; they are not copied here.
+
+## Review the bounded issuer/profile extension
+
+```task
+id: KEY-WP-0042-T01
+status: progress
+priority: high
+state_hub_task_id: "d8af8e77-f6e5-5d0d-8b44-794af3dee5cf"
+```
+
+The reviewable contract is `docs/online-token-status.md`: opt-in RFC 7662/7009
+access-token status; registered owning-client authentication; private hash-only
+bounded state; unique access-token jti; no ID-token change; singleton store-loss
+refusal; disabled legacy behavior explicit. Source preparation is authorized by
+the full Custodian implementation goal. Independent issuer/profile/consumer
+assent remains required before admission; no such assent is inferred here.
+
+## Implement and verify the actual issuer paths
+
+```task
+id: KEY-WP-0042-T02
+status: done
+priority: high
+state_hub_task_id: "2cade51f-d25a-5719-96b4-b57d50c1b97d"
+```
+
+Wire the same issuer store to both actual grant types, UserInfo, introspection,
+revocation, configuration validation and implemented discovery. Verify distinct
+grants, exact expiry, replay/tombstones, capacity, malformed/unauthenticated and
+cross-client refusals, current registration and human disposition, revocation
+during directory lookup, process-store loss and absence of secret output. Keep
+the complete existing source suite, disabled profile and build passing.
+
+## Admit and accept the issuer lifecycle at native scope
+
+```task
+id: KEY-WP-0042-T03
+status: todo
+priority: high
+state_hub_task_id: "a5539bb0-2501-5774-a7d8-acddfb0938ab"
+```
+
+After independent contract review, admit exact issuer image/config/profile,
+HTTPS ingress/client custody and measured capacity/headroom. Exercise real
+human PKCE and service tokens, actual endpoint authentication, revoked-token
+UserInfo refusal, expiry, unavailable dependency, restart/store loss and fresh
+reauthentication. Preserve old offline-token semantics and document every
+consumer's selected mode. Review disabling/rollback explicitly; never silently
+fall back to offline acceptance for online-profile consumers. Provide owner
+receipts to existing NK48/Apps consumer tasks and Audit source admission.
+
+2026-10-18 source verification: all 659 test/subtest results in the complete
+race suite pass, with six preexisting native/external skips. The standalone
+binary passes 26 isolated process checks, including actual main/router/config,
+service issuance, capacity, revocation, process restart, fresh issuance and
+disabled-profile behavior; fixture diagnostics omit synthetic private inputs.
+The HTTPS human PKCE flow and revocation during directory lookups also pass.
+An isolated control omitting the revoked-state predicate fails seven intended
+checks. This closes source task T02 only. T01 independent issuer/profile review,
+T03 native admission and all existing consumer operation/effect bindings remain
+open. Evidence is retained by CUST-WP-0080 under keycape-token-status-r1.