Answer the approver-client questions, and fix what checking them turned up

informed-decision and approval-engine both asked to hear problems with the human
approver registration now rather than at handover. Checking their requested shape
against the source rather than agreeing it on paper turned up three things.

Scope gap, accepted: [openid, approval:approve] cannot render a decision, since
GET /v1/approvals/{id} and /claim both need approval:read -- the surface could
submit an entry it was never able to display. Published
[openid, approval:read, approval:approve]. Reading through a service identity was
the alternative and is worse: it weakens the evidence-of-what-this-person-saw
claim the component exists to make. approval:consume stays excluded.

Assurance shape, published and a defect fixed. Both asked for a documented shape
and KeyCape already emitted one, so it is written down rather than renegotiated.
Writing it down surfaced that `at` was the token mint time rather than the
authentication time. Those differ by hours whenever a browser session is reused,
and approval-engine persists this object verbatim as the only downstream record
that MFA happened -- so a stored approval could have evidenced MFA at a moment
the person proved nothing. PKCESession.AuthTime now carries the original login
instant through session reuse, with mint time as the fallback.

Blocker found before anyone built on it: a human token cannot carry
tenant:platform. effectiveTenant resolves the human tenant from the directory
user, no adapter populates User.Tenant, and the per-client tenant field is read
only on the client_credentials path -- so every human token defaults to
tenant:coulomb, which approval-engine refuses by exact string equality. It would
have presented as a failed approval rather than a registration defect. Two
resolutions sent to the owners and neither implemented here: the choice decides
whether a human's tenant is a property of the person or of the registration, and
that is not KeyCape's alone to make.

Also recorded ops-warden's answers to KEY-WP-0014-T04, including their finding
that `warden plan` returns `autonomous` for a need containing generate and
CAS-write, because it has no read-versus-mutate intent. Their standing
instruction -- treat a warden plan verdict on any write, rotate or provision need
as unreliable until WARDEN-WP-0038 lands -- is recorded in the workplan rather
than left in an inbox.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016uV8zoCKpA1WRAxsKRYbdH

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1182213@bnt-lap001
Assistant-Session: 966597b9-ae61-46a4-8b9e-1594ab3ec4ad

src/internal/server/oidc/assurance_time_test.go

@@ -0,0 +1,54 @@
+package oidc
+
+import (
+	"testing"
+	"time"
+)
+
+// approval-engine persists the assurance object verbatim and it is the only
+// downstream evidence that MFA happened (KEY-WP-0013-T05). A reused browser
+// session can be hours old, so reporting mint time would overstate how
+// recently the person actually proved anything.
+func TestAssuranceReportsAuthenticationTimeNotMintTime(t *testing.T) {
+	authenticated := time.Now().Add(-4 * time.Hour)
+	minted := time.Now()
+
+	claim := assuranceClaim(true, authenticated, minted)
+	if got := claim["at"].(int64); got != authenticated.Unix() {
+		t.Errorf("assurance.at = %d, want the authentication time %d", got, authenticated.Unix())
+	}
+	if claim["level"] != "aal2" || claim["mfa"] != true {
+		t.Errorf("MFA-verified authorization did not report aal2: %v", claim)
+	}
+}
+
+// A session stored before AuthTime existed has a zero value; falling back to
+// mint time keeps the claim present rather than emitting a 1970 timestamp.
+func TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset(t *testing.T) {
+	minted := time.Now()
+	claim := assuranceClaim(false, time.Time{}, minted)
+	if got := claim["at"].(int64); got != minted.Unix() {
+		t.Errorf("assurance.at = %d, want the mint-time fallback %d", got, minted.Unix())
+	}
+	if claim["level"] != "aal1" || claim["mfa"] != false {
+		t.Errorf("unverified authorization did not report aal1: %v", claim)
+	}
+}
+
+// The shape approval-engine and informed-decision consume. A missing key here
+// breaks a downstream record that cannot be reconstructed later.
+func TestAssuranceCarriesTheDocumentedShape(t *testing.T) {
+	claim := assuranceClaim(true, time.Now(), time.Now())
+	for _, key := range []string{"level", "methods", "mfa", "source", "at"} {
+		if _, ok := claim[key]; !ok {
+			t.Errorf("assurance object is missing %q: %v", key, claim)
+		}
+	}
+	methods, ok := claim["methods"].([]string)
+	if !ok || len(methods) != 2 || methods[0] != "pwd" || methods[1] != "otp" {
+		t.Errorf("aal2 methods = %v, want [pwd otp]", claim["methods"])
+	}
+	if claim["source"] != "key-cape" {
+		t.Errorf("source = %v, want key-cape", claim["source"])
+	}
+}

src/internal/server/oidc/authorize.go

@@ -317,7 +317,8 @@ func (h *AuthorizeHandler) ServeHTTPCallback(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
-	decision, err := h.decideAssurance(ctx, ps, result.Username, h.Logins.fromRequest(r))
+	existingLogin := h.Logins.fromRequest(r)
+	decision, err := h.decideAssurance(ctx, ps, result.Username, existingLogin)
 	if err != nil {
 		h.Emitter.Emit(ctx, telemetry.Event{
 			Timestamp: time.Now(),
@@ -441,6 +442,15 @@ func (h *AuthorizeHandler) completeAuthorization(w http.ResponseWriter, r *http.
 	if mfaVerified {
 		level = domain.AssuranceAAL2
 	}
+
+	// When an existing browser session for this same user carried the
+	// authorization, the authentication happened when that session was
+	// issued, not now. Creating the new login session below resets IssuedAt,
+	// so the original instant has to be read before that.
+	authTime := time.Now()
+	if prior := h.Logins.fromRequest(r); prior != nil && prior.Username == username && !prior.IssuedAt.IsZero() {
+		authTime = prior.IssuedAt
+	}
 	if login := h.Logins.Create(username, level); login != nil {
 		writeLoginCookie(w, login, issuerIsHTTPS(h.Issuer))
 	}
@@ -457,6 +467,7 @@ func (h *AuthorizeHandler) completeAuthorization(w http.ResponseWriter, r *http.
 		Scopes:              ps.Scopes,
 		ExpiresAt:           time.Now().Add(10 * time.Minute),
 		MFAVerified:         mfaVerified,
+		AuthTime:            authTime,
 	}
 	authCode := h.Sessions.Create(sess)
 

src/internal/server/oidc/session.go

@@ -26,6 +26,13 @@ type PKCESession struct {
 	// completeAuthorization -- never re-derived from stale enrollment state
 	// at token-exchange time.
 	MFAVerified bool
+	// AuthTime is when the user actually authenticated, which is not the
+	// same instant the token is minted: a reused browser session can be
+	// hours old. approval-engine persists the assurance object verbatim as
+	// the only downstream evidence that MFA happened (KEY-WP-0013-T05), so
+	// reporting mint time there would misdate that evidence. Zero means
+	// "authenticated during this authorization".
+	AuthTime time.Time
 }
 
 // SessionStore is an in-memory PKCE session store.

src/internal/server/oidc/token.go

@@ -201,7 +201,7 @@ func (h *TokenHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	claims["principal_type"] = "human"
 	claims["groups"] = nonNilStrings(user.Groups)
 	claims["roles"] = nonNilStrings(user.Roles)
-	claims["assurance"] = assuranceClaim(sess.MFAVerified, now)
+	claims["assurance"] = assuranceClaim(sess.MFAVerified, sess.AuthTime, now)
 
 	// Optional cached tenant_roles claim (KEY-WP-0005-T02). Fails open --
 	// see internal/adapters/tenantengine's package doc for why this is the
@@ -412,7 +412,18 @@ func nonNilStrings(s []string) []string {
 // was actually verified during this authorization (session.MFAVerified),
 // not from static enrollment state -- a user who has MFA enrolled but
 // wasn't challenged for it in this particular flow gets aal1, not aal2.
-func assuranceClaim(mfaVerified bool, at time.Time) map[string]interface{} {
+//
+// `at` is the time the user authenticated, not the time this token was
+// minted. Those differ whenever a browser session is reused, and the gap is
+// the whole point: approval-engine stores this object verbatim as the only
+// downstream record that MFA occurred (KEY-WP-0013-T05), so mint time would
+// overstate how recently the person proved anything. issuedAt is the
+// fallback for a session predating this field.
+func assuranceClaim(mfaVerified bool, authTime, issuedAt time.Time) map[string]interface{} {
+	at := authTime
+	if at.IsZero() {
+		at = issuedAt
+	}
 	level := "aal1"
 	methods := []string{"pwd"}
 	if mfaVerified {