KEY-WP-0037-T04 done: live issuance verified for secrets-engine-openbao

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json

@@ -0,0 +1,61 @@
+{
+  "schema": "keycape.live-issuance-receipt.v1",
+  "task": "KEY-WP-0037-T04",
+  "date": "2026-10-07",
+  "client_id": "secrets-engine-openbao",
+  "issuer": "https://kc.coulomb.social",
+  "deployed_image": "forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8",
+  "deployed_source": "1164f65",
+  "verifier_binary_source": "key-cape main b2e1efc (workstation build)",
+  "decisions": {
+    "custody": "2ab717e1-7881-491e-aed4-28946550c289",
+    "eso_amendment": "1fdd993b-8899-4f87-8a8e-636346bb9692",
+    "live_registration_go": "caafe4be-4f68-47b4-9567-316d47b94992"
+  },
+  "custody": {
+    "kv_path": "platform/workloads/keycape/secrets-engine-openbao",
+    "kv_version": 1,
+    "kv_cas": 0,
+    "kv_request_id": "a79f53e5-4c79-88bf-3e64-493134253497",
+    "ccrs": ["CCR-2026-0033", "CCR-2026-0034"],
+    "issuer_delivery": "ESO sso/keycape-secrets-engine-openbao-client, Ready=True SecretSynced"
+  },
+  "registration": {
+    "target": "sso/keycape-config",
+    "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3",
+    "resource_version_before": "71471711",
+    "resource_version_after": "71655453",
+    "unrelated_config_bytes_preserved": true,
+    "env_binding": "KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET",
+    "net_kingdom_commit": "1fbb8db"
+  },
+  "verify_client": {
+    "runner": "founder workstation; secret read through the CCR-2026-0034 operator OIDC reader into the verify-client process env only; operator token revoked before verification",
+    "checks_passed": 10,
+    "checks_failed": 0,
+    "discovery_and_endpoint_origin": true,
+    "rs256_jwks_signature": true,
+    "claim_bindings_issuer_audience_validity": true,
+    "principal_type_service": true,
+    "sub_service_secrets_engine": true,
+    "tenant_platform": true,
+    "roles_secrets_engine": true,
+    "no_excess_scope": true,
+    "excess_scope_refused": "openbao:admin",
+    "wrong_secret_refused": true,
+    "wrong_secret_kind": "random value via -previous-secret-env (not a rotation)"
+  },
+  "operator_reader_positive_path": {
+    "role": "keycape-secrets-engine-openbao-operator-workload-kv-read",
+    "login": "netkingdom OIDC via openbao-admin with bound groups net-kingdom-admins and /assurance/level aal2",
+    "revoke_self": true
+  },
+  "human_login_after_restart": "founder OIDC login through KeyCape succeeded (the operator reader login above)",
+  "not_established": [
+    "the 900s token lifetime was not measured; it rests on the registration's tokenLifetime 15m",
+    "no in-pod verification: the deployed 1164f65 cannot fetch its own discovery document from inside the cluster (fixed in 8be8065)",
+    "the OpenBao JWT role and login proof remain RPF-WP-0035-T02",
+    "the secrets-engine probe-openbao end-to-end run remains SECRETS-WP-0012-T03"
+  ],
+  "values_emitted": false
+}

workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Secrets Engine OpenBao live registration and protected custody"
 domain: infotech
 repo: key-cape
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-10-04"
-updated: "2026-10-05"
+updated: "2026-10-07"
 state_hub_workstream_id: "62800ecf-064b-5546-a1e4-4521b5932973"
 ---
 
@@ -106,7 +106,7 @@ and has no consumer file. The custody approvals A1-A3 are decision
 
 ```task
 id: KEY-WP-0037-T04
-status: wait
+status: done
 priority: high
 depends_on:
   - KEY-WP-0037-T03
@@ -121,3 +121,15 @@ booleans and identities, immutable image/source coordinates and custody binding
 metadata. Hand off to RPF-WP-0035-T02 for isolated OpenBao metadata provisioning,
 claim/expiry/use-limit denial and self-revocation proof. Never report an example
 registration, discovery metadata or source test as live acceptance.
+
+**Done 2026-10-07.** `keycape verify-client` passed all 10 checks:
+- issuer, JWKS signature and claims (`service:secrets-engine`, tenant:platform,
+  role secrets-engine);
+- no excess scope;
+- `openbao:admin` and a wrong secret refused.
+
+The founder's KeyCape login after the restart also proved the CCR-2026-0034
+operator reader (net-kingdom-admins, aal2). Receipt:
+`docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json`. The 900s lifetime
+was not measured. Handed to RPF-WP-0035-T02 for the OpenBao JWT role and login
+proof.