Close the KEY-WP-0009 handoff gap and deliver the two blocked admissions

KEY-WP-0009-T04 is done. Re-ran verification on main with an explicit Go 1.23.0
toolchain and a writable build cache: contract validator PASS, build, vet and the
full test suite pass, git diff --check clean. gofmt had drifted on
internal/server/telemetry/events.go and tests/migration/scenario_c_test.go
(comment alignment only, no semantic change); both reformatted so the task's
formatting claim holds. The four handoffs to netkingdom, secrets-engine,
ops-warden and railiance-platform were then actually sent -- the 2026-09-05 audit
had shown the earlier claimed delivery had no receipts -- and each receipt id is
recorded in the workplan and readable back from the hub.

KEY-WP-0013-T02 and KEY-WP-0014-T04 stay in wait. Their remaining work is not
ours to do, so what was owed was the request, and it is now delivered: custody
admission for the two approval clients to railiance-platform, the exact human
client id and callback URI to approval-engine, and the OpenBao-token vs
issuer-JWT split plus Qonto rotation execution authority to ops-warden. Each
message quotes the existing non-secret packet or reviewed sequence and states
what is explicitly not being treated as authorization.

No secret was read, no production resource changed, no route retired.
SCOPE.md updated to match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016uV8zoCKpA1WRAxsKRYbdH

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1182213@bnt-lap001
Assistant-Session: 966597b9-ae61-46a4-8b9e-1594ab3ec4ad

workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Provider capability declarations and bounded service identities"
 domain: infotech
 repo: key-cape
-status: blocked
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-23"
-updated: "2026-08-23"
+updated: "2026-09-08"
 depends_on:
   - NK-WP-0030
   - KEY-WP-0006
@@ -85,7 +85,7 @@ custody and platform owners and are not implied by this source registration.
 
 ```task
 id: KEY-WP-0009-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "6945c0c0-bbb6-552b-8d62-d806d3fd0018"
 ```
@@ -97,8 +97,32 @@ railiance-platform with revision-independent paths and exact ownership status.
 Both declarations pass NetKingdom's canonical validator. The full Go suite,
 vet, build, `gofmt`, YAML parsing, and `git diff --check` pass using an explicit
 Go 1.23 toolchain and writable local cache; the workstation's default Go cache
-is read-only and was not used. The earlier statement that State Hub handoffs were delivered was not supported
-by receipt IDs. The 2026-09-05 audit found no matching handoff receipts in the
-current Hub response; local implementation and validation were complete, but
-notification delivery is unverified. KEY-WP-0014 records the correction and
-remaining consumer handoff. Do not use this task as proof of message delivery.
+is read-only and was not used.
+
+2026-09-05 correction: the earlier statement that State Hub handoffs were
+delivered was not supported by receipt IDs. The audit found no matching handoff
+receipts in the Hub response. KEY-WP-0014-T02 records the correction.
+
+2026-09-08 closure. Verification re-run on `main` with `GOTOOLCHAIN=go1.23.0` and
+a writable `GOCACHE`: `make contract-test` PASS, `go build ./...`, `go vet ./...`
+and `go test ./...` all pass, `git diff --check` clean. `gofmt` had drifted on
+`src/internal/server/telemetry/events.go` and `src/tests/migration/scenario_c_test.go`
+(comment alignment only, no semantic change); both were reformatted so the
+formatting claim now holds.
+
+The four handoffs were then actually sent, and each receipt is readable back via
+`GET /messages/?from_agent=key-cape`:
+
+| Recipient | Receipt id |
+| --- | --- |
+| netkingdom | `692ed0d7-e21b-48e7-8600-5b32b551c627` |
+| secrets-engine | `479a1698-87dc-4ee2-a732-c2dc18bc4e84` |
+| ops-warden | `5bc58847-eed5-4164-bb0f-a0d8455e75b8` |
+| railiance-platform | `9c6a4e70-6bc0-4ad6-8293-35a56e507dfc` |
+
+Each names revision-independent paths, the 2026-09-08 verification result, and
+the same ownership split: KeyCape owns issuance, static registrations, client
+disablement and the claim set; secret custody, OpenBao roles/policies and token
+enforcement, privacyIDEA factor and token lifecycle, resource authorization and
+deployment remain with their named owners. C2a is not claimed. This closes the
+notification gap; it is still not evidence of live deployment or provider cutover.