KEY-WP-0037-T04 done: live issuance verified for secrets-engine-openbao

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Secrets Engine OpenBao live registration and protected custody"
 domain: infotech
 repo: key-cape
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-10-04"
-updated: "2026-10-05"
+updated: "2026-10-07"
 state_hub_workstream_id: "62800ecf-064b-5546-a1e4-4521b5932973"
 ---
 
@@ -106,7 +106,7 @@ and has no consumer file. The custody approvals A1-A3 are decision
 
 ```task
 id: KEY-WP-0037-T04
-status: wait
+status: done
 priority: high
 depends_on:
   - KEY-WP-0037-T03
@@ -121,3 +121,15 @@ booleans and identities, immutable image/source coordinates and custody binding
 metadata. Hand off to RPF-WP-0035-T02 for isolated OpenBao metadata provisioning,
 claim/expiry/use-limit denial and self-revocation proof. Never report an example
 registration, discovery metadata or source test as live acceptance.
+
+**Done 2026-10-07.** `keycape verify-client` passed all 10 checks:
+- issuer, JWKS signature and claims (`service:secrets-engine`, tenant:platform,
+  role secrets-engine);
+- no excess scope;
+- `openbao:admin` and a wrong secret refused.
+
+The founder's KeyCape login after the restart also proved the CCR-2026-0034
+operator reader (net-kingdom-admins, aal2). Receipt:
+`docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json`. The 900s lifetime
+was not measured. Handed to RPF-WP-0035-T02 for the OpenBao JWT role and login
+proof.