Add native verified login and service-token commands

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b

workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Provider capability declarations and bounded service identities"
 domain: infotech
 repo: key-cape
-status: finished
+status: blocked
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-23"
@@ -85,7 +85,7 @@ custody and platform owners and are not implied by this source registration.
 
 ```task
 id: KEY-WP-0009-T04
-status: done
+status: wait
 priority: high
 state_hub_task_id: "6945c0c0-bbb6-552b-8d62-d806d3fd0018"
 ```
@@ -97,5 +97,8 @@ railiance-platform with revision-independent paths and exact ownership status.
 Both declarations pass NetKingdom's canonical validator. The full Go suite,
 vet, build, `gofmt`, YAML parsing, and `git diff --check` pass using an explicit
 Go 1.23 toolchain and writable local cache; the workstation's default Go cache
-is read-only and was not used. State Hub handoffs name only non-secret paths and
-ownership facts.
+is read-only and was not used. The earlier statement that State Hub handoffs were delivered was not supported
+by receipt IDs. The 2026-09-05 audit found no matching handoff receipts in the
+current Hub response; local implementation and validation were complete, but
+notification delivery is unverified. KEY-WP-0014 records the correction and
+remaining consumer handoff. Do not use this task as proof of message delivery.

workplans/KEY-WP-0013-approval-engine-resource-audience.md

@@ -45,3 +45,14 @@ Needs deployment-owned custody for both new secret references and an exact human
 callback registration. Deploy the implementation and registrations together,
 then prove live JWKS verification and denied excess scopes without logging values.
 Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md.
+
+
+2026-09-05 follow-up: read-only deployment metadata shows the current image is
+forgejo.coulomb.social/coulomb/key-cape:main-153258b and only the Qonto service
+secret environment reference is present. The two approval clients are not
+materialized through deployment environment references. Published a concrete
+non-secret admission packet at docs/approval-engine-provisioning-request.yaml.
+Custody routing has no exact admitted lane for these two clients. `warden plan`
+returned founder_required but matched an unrelated generic database lane; that
+mismatch is not authority to provision. Human callback clarification is pending.
+No secrets were read or production resources changed.

workplans/KEY-WP-0014-native-credential-lane-handoff.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Review native login and client credential lane handoffs"
 domain: infotech
 repo: key-cape
-status: proposed
+status: blocked
 owner: codex
 topic_slug: native-credential-lane-handoff
 created: "2026-09-05"
@@ -13,14 +13,14 @@ state_hub_workstream_id: "0d003df3-f7d3-5063-8ca0-e1e33f7df74a"
 ---
 
 Source: ops-warden inbox message 0dd9c7bd-0ecd-42d1-806f-7cc4ba9730ed.
-The issuer supports client_secret_basic exchange, but has no native exchange or
-rotation CLI. Existing machine issuance ownership does not complete this handoff.
+The native service exchange and public PKCE login commands are now implemented.
+Cross-owner rotation and consumer-specific route cutover remain outstanding.
 
 ## Design owner command and custody boundaries
 
 ```task
 id: KEY-WP-0014-T01
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "0c0a0b61-c19e-5631-9cda-8b2dc0f47d8f"
 ```
@@ -35,7 +35,7 @@ retiring the proxy until replacement commands have equivalent verification.
 
 ```task
 id: KEY-WP-0014-T02
-status: todo
+status: done
 priority: low
 state_hub_task_id: "d9a5de97-b7d5-5599-98c2-eaab32f51495"
 ```
@@ -43,3 +43,42 @@ state_hub_task_id: "d9a5de97-b7d5-5599-98c2-eaab32f51495"
 Ops-warden reports KEY-WP-0009-T04's claimed reply did not arrive. Verify prior
 receipts for all four named recipients before claiming successful notification.
 No outbound coordination messages were sent during the 2026-09-05 repo review.
+
+
+## Implement and verify native caller commands
+
+```task
+id: KEY-WP-0014-T03
+status: done
+priority: high
+state_hub_task_id: "4e46f474-a15e-594f-ae07-ad37a9667d89"
+```
+
+Implemented keycape service-token and login with HTTPS discovery, RS256/JWKS
+verification, exact audience bindings, PKCE/state/nonce, private out-of-Git file
+delivery and redacted errors. Service Basic authentication now form-decodes
+credentials. Integration tests exercise the real token/JWKS handlers and browser
+callback, including forged state, tampering, excess scope and unsafe output.
+See docs/native-authentication.md for invocation and ownership boundaries.
+
+## Admit rotation and verify consumer handoff
+
+```task
+id: KEY-WP-0014-T04
+status: wait
+priority: high
+state_hub_task_id: "e7632c71-9676-5837-a925-7f905e3015c5"
+```
+
+Qonto rotation requires admitted custody/provider transaction and rollback
+semantics; see the exact review sequence in docs/native-authentication.md.
+The current login proxy yields an OpenBao token, so it cannot be replaced by a
+JWT-writing command without adapting its consumer contract. Verify that split
+with the platform owner and ops-warden before route changes. No route was changed.
+
+2026-09-05 receipt audit: GET /messages/?from_agent=key-cape returned one
+2026-03 image-publication message and no KEY-WP-0009 handoff receipts for
+NetKingdom, secrets-engine, ops-warden or railiance-platform. Corrected the
+unsupported statement in KEY-WP-0009-T04. This proves only that no receipts
+are present in the current Hub response, not that no message ever existed.
+No replacement outbound messages were sent.