Add native verified login and service-token commands

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b

workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Provider capability declarations and bounded service identities"
 domain: infotech
 repo: key-cape
-status: finished
+status: blocked
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-23"
@@ -85,7 +85,7 @@ custody and platform owners and are not implied by this source registration.
 
 ```task
 id: KEY-WP-0009-T04
-status: done
+status: wait
 priority: high
 state_hub_task_id: "6945c0c0-bbb6-552b-8d62-d806d3fd0018"
 ```
@@ -97,5 +97,8 @@ railiance-platform with revision-independent paths and exact ownership status.
 Both declarations pass NetKingdom's canonical validator. The full Go suite,
 vet, build, `gofmt`, YAML parsing, and `git diff --check` pass using an explicit
 Go 1.23 toolchain and writable local cache; the workstation's default Go cache
-is read-only and was not used. State Hub handoffs name only non-secret paths and
-ownership facts.
+is read-only and was not used. The earlier statement that State Hub handoffs were delivered was not supported
+by receipt IDs. The 2026-09-05 audit found no matching handoff receipts in the
+current Hub response; local implementation and validation were complete, but
+notification delivery is unverified. KEY-WP-0014 records the correction and
+remaining consumer handoff. Do not use this task as proof of message delivery.