Record the custody owner's confirmations and guard a receipt against misreading

railiance-platform replied on all three open threads. Recording what they add
rather than what we already knew.

T02: they reached the same reading of the verifier receipt independently and add
human_client_consume_denied: true for both clients, confirm the verifier ran
twice (activation and post-rollout) at generation 38 with the signing key
unchanged, and state T02 can close against that receipt. They also correct our
framing, rightly: the packet says client-side retrieval is unadmitted, which
stays true, but the attended operator path is not a client-side read and never
required one. This task had been treating those as the same constraint.

T04: the live approval clients mean this repo now holds a committed receipt that
looks like rotation evidence and is not. Both owners independently state the same
two gaps -- no real predecessor rotation, no observed wall-clock expiry. Recorded
in T04 rather than only in T02, because verify-client's predecessor rejection is
now implemented and unproven, which is a different state from missing or done,
and T04 is where that distinction belongs.

Answered their open question on CCR-2026-0020, which has no named presenting
actor. As issuer: the registration carries both approval:create and
approval:approve, so one presenter can create an entry and approve it. That is a
separation-of-duties property of the holder, not a defect in the token -- KeyCape
issues the grants approval-engine asked for. Recorded both shapes KeyCape can
support, and that who holds it is approval-engine's decision and the doctrine
question gate-house's, not ours.

Also narrowed the operations note: the deployed config has not been written since
the activation, so the inspected state is the state that will boot.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016uV8zoCKpA1WRAxsKRYbdH

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1182213@bnt-lap001
Assistant-Session: 966597b9-ae61-46a4-8b9e-1594ab3ec4ad

docs/approval-engine-provisioning-request.yaml

@@ -85,6 +85,30 @@ verification:
   - Preserve existing registrations and signing key; record versions and image digest.
   - Human consume denial is approval-engine's to verify at its resource; KeyCape
     proves only that the human client is never issued a consume grant.
+# Asked by railiance-platform 2026-09-09 (CCR-2026-0020 has no named presenting
+# actor in any owner source, and they declined to guess one). This is KeyCape's
+# view as the issuer of the identity, not a decision: who may hold the
+# credential is approval-engine's call and the doctrine question is
+# gate-house's.
+presenting_actor_note:
+  client_id: approval-engine-operator
+  observation: |
+    The registration as issued carries both approval:create and approval:approve,
+    so a single presenter can create an entry and then approve it. That is a
+    separation-of-duties property of the credential holder, not a defect in the
+    token -- KeyCape issues exactly the grants approval-engine requested, and
+    splitting them would be a change to that request rather than to issuance.
+  options_keycape_can_support:
+    - Two registrations with disjoint grants, one creating and one approving, if
+      approval-engine wants the split enforced at issuance. KeyCape can do this
+      today; it needs approval-engine to say so, since it changes their contract.
+    - Keep one registration and constrain the holder by custody instead, which is
+      where it sits now.
+  keycape_does_not_decide: |
+    Who presents this credential, and whether self-approval is acceptable for the
+    lifecycle operator, are not KeyCape's to settle. Recorded here so the question
+    is answered from the registration rather than reconstructed from it.
+
 blockers:
   - Admit exact custody paths, field delivery, consumer identities and lifecycle authority.
   - Resolve attended first-provision authority through the custody owner.