---
id: KEY-WP-0012
type: workplan
title: "Repair UserInfo canonical subject resolution"
domain: infotech
repo: key-cape
status: finished
owner: codex
topic_slug: userinfo-canonical-subject-resolution
created: "2026-08-31"
updated: "2026-09-01"
state_hub_workstream_id: "2aca83d8-4e80-52c6-8929-f1e957576b47"
---

## Repair subject lookup

```task
id: KEY-WP-0012-T01
status: done
priority: high
state_hub_task_id: "bc1ee2c7-a321-5914-96d1-9cb871f0ee1b"
```

Resolve the canonical LDAP-DN `sub` emitted by the token endpoint without
passing it to the username-only repository lookup. Preserve stable subject
semantics and verify any `preferred_username` lookup against the canonical ID.

## Regression verification

```task
id: KEY-WP-0012-T02
status: done
priority: high
state_hub_task_id: "7073cc30-a518-5c27-acaf-1a323fd981c6"
```

Cover canonical-ID, legacy username-sub, missing subject, and suspended-user
behavior. Run the KeyCape test suite and image build checks.

## Deploy and verify OpenBao OIDC

```task
id: KEY-WP-0012-T03
status: done
priority: high
state_hub_task_id: "571c5237-93fa-5c61-87af-974e02fd8929"
```

Publish and deploy the corrected KeyCape image, prove `/userinfo` accepts a
fresh human access token, then resume the governed Policy Nexus bootstrap.

Completed 2026-09-01. Forgejo Actions run 14 built commit
`153258b9d39273d53ca7ab5d1bdc09961ea9026e`; image digest
`sha256:4c7193efc3e50bd72a01812a583e823cc04f41ca96ef387b31ba9ae2533b80d0`
rolled out successfully. A fresh OpenBao OIDC flow passed `/userinfo`, and the
governed Policy Nexus bootstrap subsequently completed with deterministic
session revocation.