Implement KeyCape service-token issuance

workplans/KEY-WP-0006-client-credentials-service-tokens.md

@@ -0,0 +1,101 @@
+---
+id: KEY-WP-0006
+type: workplan
+title: "Client credentials and service-token issuance"
+domain: infotech
+repo: key-cape
+status: active
+owner: codex
+topic_slug: netkingdom
+created: "2026-07-27"
+updated: "2026-07-27"
+state_hub_workstream_id: "f2d5df23-9dd2-4995-b218-be5904e07508"
+---
+
+# KEY-WP-0006 - Client credentials and service tokens
+
+Implement the missing service-principal half of the IAM Profile so
+`KEY-WP-0004` can issue a least-privilege identity to `rapp-qonto`.
+
+## T01 - Model confidential service clients
+
+```task
+id: KEY-WP-0006-T01
+status: done
+priority: high
+state_hub_task_id: "4e7addc2-5773-499f-84e4-ffddc1800952"
+```
+
+Extend static client registration with an explicit service subject, tenant,
+roles, and an environment-backed secret reference. Refuse startup when a
+`client_credentials` client is public, lacks its identity fields, or cannot
+resolve its secret. Never serialize or log the resolved secret.
+
+2026-07-27: Added explicit service subject, tenant, roles, and in-memory-only
+resolved secret fields. Configuration validation rejects public or incomplete
+service clients, and startup resolves only `env:` secret references while
+reporting the variable name—not its value—on failure.
+
+## T02 - Implement secure client_credentials exchange
+
+```task
+id: KEY-WP-0006-T02
+status: done
+priority: high
+state_hub_task_id: "9fd408dc-6f71-4765-ace2-22ee7bb1cf57"
+```
+
+Accept confidential client authentication through HTTP Basic, compare secrets
+in constant time, restrict requested scopes to the registered allowlist, and
+issue a short-lived access token with `principal_type=service`,
+tenant-specific subject/roles, empty groups, `aal1` client-secret assurance,
+and optional cached `tenant_roles`. Do not issue an ID token for this
+non-human grant.
+
+2026-07-27: Implemented HTTP Basic confidential-client authentication with
+fixed-length SHA-256 constant-time comparison, allowlisted scopes, short-lived
+service claims, optional tenant-role cache, token-issued telemetry, and no ID
+token.
+
+## T03 - Prove positive and negative conformance
+
+```task
+id: KEY-WP-0006-T03
+status: done
+priority: high
+state_hub_task_id: "e37a346b-f6bc-4b29-9c13-94ec1c79a381"
+```
+
+Cover valid exchange, unknown client, public client, missing/wrong secret,
+unsupported grant, excess scope, tenant isolation, telemetry redaction, and
+discovery metadata. Run the full Go build, vet, and test suite.
+
+2026-07-27: Added positive service-claim and negative wrong-secret/excess-scope
+tests, updated discovery to advertise only implemented grants/auth methods,
+and verified `go test ./...`, `go vet ./...`, and `go build ./...` across the
+module.
+
+## T04 - Provision and verify rapp-qonto
+
+```task
+id: KEY-WP-0006-T04
+status: progress
+priority: high
+state_hub_task_id: "ba65d39f-63b8-42aa-87bb-99ec26821a8e"
+```
+
+Generate the client secret without disclosure, store it through the approved
+OpenBao lane, register the static `rapp-qonto` client, deploy KeyCape, and
+verify a real exchange yields only the documented Binky service claims.
+Publish non-secret evidence to `KEY-WP-0004-T03` through T05.
+
+## T05 - Closure review
+
+```task
+id: KEY-WP-0006-T05
+status: wait
+priority: low
+state_hub_task_id: "7c9cdac6-c53f-4a32-81d2-8d2e73de0039"
+```
+
+Close after T01-T04 pass and the repeatable verification path is documented.