coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correct the T02 claim-contract record: the attended run already happened

Browse source 
A peer session recorded that T02's claim contract is unproven and waits on an
attended keycape verify-client run. The restraint behind that was right -- it
declined to read a client secret, which the provisioning packet does not admit --
but the conclusion was not: the attended run had already happened at
2026-09-09T00:10Z and its receipt is committed in this repo.

docs/evidence/2026-09-09-keycape-verifier-admission.json records, per client:
live_jwks_signature_verified, exact_claims_verified, excess_scope_denied and
wrong_secret_denied all true, lifetime 900s, run by a pinned verifier in an
attended owner process, with credential_values_emitted and
client_side_read_admitted both false. So it was run, and run the admitted way.
T02's status: done is correct and does not revert to wait.

The peer's paragraph is kept rather than deleted, with the correction appended
after it, so the record shows what was concluded and why it was wrong. The error
was reading "not admitted for me" as "not done by anyone" without checking
docs/evidence/ -- the third instance in two days of inferring repository state
from a partial view instead of reading it.

Also records what the receipt itself declines to claim, which nobody should
overstate later: real predecessor rotation and wall-clock expiry were not
exercised. Predecessor rejection is implemented and unit-tested in verify-client
but has never run against a real rotation, which remains KEY-WP-0014-T04 and
still has no admitted execution authority.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016uV8zoCKpA1WRAxsKRYbdH

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1182213@bnt-lap001
Assistant-Session: 966597b9-ae61-46a4-8b9e-1594ab3ec4ad
This commit is contained in:
tegwick 2026-09-09 16:38:20 +02:00
parent b9a251b16b
commit cb25ec2a8d
1 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/KEY-WP-0013-approval-engine-resource-audience.md
View file

@ -249,6 +249,37 @@ client-side retrieval, which the provisioning packet records as **not admitted**
attended operator action, not something to take by reading the secret. T02 stays
`wait` on that run, not on custody.
**Correction, same day.** The refusal above was right; the conclusion drawn from
it was not. The attended run had already happened, on 2026-09-09T00:10Z, and its
receipt is committed in this repository at
`docs/evidence/2026-09-09-keycape-verifier-admission.json`. Per client — both
`secrets-engine-approval` and `approval-engine-operator` —
`live_jwks_signature_verified: true`, `exact_claims_verified: true`,
`excess_scope_denied: true`, `wrong_secret_denied: true`,
`lifetime_seconds: 900`, `maximum_future_iat_seconds: 30`,
`pinned_artifact_verifier_passed: true`, `verifier_location: "attended owner
process"`. `credential_values_emitted: false` and
`client_side_read_admitted: false` throughout, so it was run the admitted way.
The claim contract is established and T02's `status: done` is correct; it does
not revert to `wait`.
The reasoning error is worth naming because it is the third of its kind here in
two days: "not admitted **for me**" was read as "not done **by anyone**", without
checking `docs/evidence/`. The preceding paragraph's read-only observations are
sound and its restraint about not reading the secret is exactly right — only the
final sentence was wrong, and it is retained above rather than deleted so the
correction has something to point at.
What the receipt itself declines to claim, which is the honest residual and
matches this task's earlier record: `real_predecessor_rotation_tested: false`,
`observed_wall_clock_expiry: false`, and under `limits`,
`actual_predecessor_rotation_observed: false` and
`wall_clock_jwt_expiry_observed: false`. Natural expiry and a real predecessor
rotation were not exercised by initial provisioning and are not claimed by
anyone. Predecessor rejection is implemented and unit-tested in
`keycape verify-client`; it has not been run against a real rotation, which is
KEY-WP-0014-T04's territory and still has no admitted execution authority.
## Assign and register the human approver browser client
```task