Consume verified owner configuration pin before custody rollout

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/approval-clients-rollout.md

@@ -28,9 +28,10 @@ verification. Provider response bodies and tokens are never printed.
    at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the
    Job exited 0 and every temporary resource was removed. See
    [the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
-   NetKingdom must now ensure that exact value is pinned in `authelia.issuer`
+   NetKingdom pinned that exact value in `authelia.issuer` on 2026-09-09
-   through its contained configuration path. This run left the config unchanged.
+   through its exercised issuer-only helper; Secret revision `58713343`.
-   Preserve the existing signing key and client registrations. Prove an existing
+   [Pin receipt](evidence/2026-09-09-upstream-issuer-pin.json) proves all other
+   config bytes and Secret data unchanged. The running Deployment was unchanged. Prove an existing
    human login before and after cutover; the probe established upstream identity
    only, while this image also changes redirect and grant binding.
 3. The platform-owned attended first-provision command uses only

docs/evidence/2026-09-09-upstream-issuer-pin.json

@@ -0,0 +1,93 @@
+{
+  "schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
+  "recorded_at": "2026-09-08T22:24:00.262369+00:00",
+  "authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
+  "source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
+  "signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
+  "check_before": {
+    "before": {
+      "resource_version": "51346058",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": false,
+    "deployment_changed": false,
+    "issuer_matches": false,
+    "mode": "issuer-check-live",
+    "observed_at": "2026-09-08T22:23:58.199881+00:00",
+    "prior_pin_state": "absent",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "pin": {
+    "after": {
+      "resource_version": "58713343",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "before": {
+      "resource_version": "51346058",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": true,
+    "deployment_changed": false,
+    "issuer_matches": true,
+    "mode": "issuer-pin-live",
+    "observed_at": "2026-09-08T22:23:58.727554+00:00",
+    "other_secret_data_unchanged": true,
+    "prior_pin_state": "absent",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "unrelated_config_bytes_preserved": true,
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "check_after": {
+    "before": {
+      "resource_version": "58713343",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": false,
+    "deployment_changed": false,
+    "issuer_matches": true,
+    "mode": "issuer-check-live",
+    "observed_at": "2026-09-08T22:23:59.920100+00:00",
+    "prior_pin_state": "matching",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "deployment_before": {
+    "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+    "resource_version": "55113259",
+    "generation": 29,
+    "images": [
+      {
+        "name": "keycape",
+        "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+      }
+    ],
+    "ready_replicas": 1,
+    "available_replicas": 1
+  },
+  "deployment_after": {
+    "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+    "resource_version": "55113259",
+    "generation": 29,
+    "images": [
+      {
+        "name": "keycape",
+        "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+      }
+    ],
+    "ready_replicas": 1,
+    "available_replicas": 1
+  },
+  "deployment_unchanged": true,
+  "tests_passed": 13,
+  "credential_values_emitted": false,
+  "custody_activated": false,
+  "ccr_reviews_completed": false,
+  "process_reload_or_new_image_proved": false
+}

workplans/KEY-WP-0013-approval-engine-resource-audience.md

@@ -8,7 +8,7 @@ status: blocked
 owner: codex
 topic_slug: approval-engine-resource-audience
 created: "2026-09-05"
-updated: "2026-09-08"
+updated: "2026-09-09"
 state_hub_workstream_id: "6e815d88-b0e3-5ce0-be5d-13ab15917f7f"
 ---
 
@@ -42,7 +42,8 @@ state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8"
 ```
 
 Needs deployment-owned custody for both new service secret references and the
-configuration-owner pin to the now-verified upstream issuer. Deploy the implementation and service registrations together,
+compatible image/configuration rollout. The upstream issuer is now verified and
+pinned by NetKingdom (2026-09-09). Deploy the implementation and service registrations together,
 then prove live JWKS verification and denied excess scopes without logging values.
 Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md.
 The separate human UI callback gate is retained in T05; a bearer-only resource
@@ -134,6 +135,19 @@ The diagnostic did not prove downstream KeyCape MFA/application login and did
 not activate custody. Do not repeat discovery or request another observation
 unless the provider/configuration or proof context changes.
 
+
+2026-09-09 configuration-owner return: NetKingdom's exercised, revision-guarded
+issuer-only helper inserted `authelia.issuer: https://auth.coulomb.social` into
+`sso/keycape-config`; resourceVersion `51346058` -> `58713343`. Independent
+readback matches. Every other configuration byte and Secret data entry, including
+the private key, was preserved. Thirteen tests passed. Receipt:
+`docs/evidence/2026-09-09-upstream-issuer-pin.json`.
+
+The stored issuer configuration prerequisite is closed. No process restart,
+image rollout, custody activation or downstream login proof occurred. T02 stays
+wait for the named CCR reviews, attended custody and compatible rollout. The
+single-instance replacement and existing-human-login checks remain mandatory.
+
 ## Reconcile tenant vocabularies across approval layers
 
 ```task