NK-WP-0054-T04: auth/keycape alias disabled by the founder (receipt disabled_verified)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 149903@bnt-lap001
Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6

docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md

@@ -41,3 +41,20 @@ Undeclared observed roles: 1 non-conformant, 14 unknown.
 
 Not covered: KeyCape (its live view is KEY-WP-0045-T02, founder-run), LLDAP, Authelia and privacyIDEA. Posture
 feedback does not consume these findings yet.
+
+## Remediation: `auth/keycape` disabled, 2026-11-07 14:15:47Z
+
+By founder decision, the founder ran `tools/service-identity/keycape-alias-disable.sh --apply` through
+railiance-platform `scripts/openbao-attended-exec.py`, from a session on `auth/netkingdom/oidc/callback` (aal2,
+KeyCape OTP). Receipt `keycape-alias-disable-receipt.json` (sha256 `97a96dff…`): status `disabled_verified`.
+Before the change the alias had roles `[platform-admin]` and client `openbao-admin`. After it, `keycape/` is absent
+and `netkingdom/` is present, and the founder's own session was unaffected. Every token the alias had issued was
+revoked with the mount.
+
+Two earlier dry runs failed inside the helper, before any change: one left no receipt, and one failed with a
+`TypeError` on `bao list` output (`keycape-alias-dry-run-2-receipt.json`). Both are fixed in `9db7f5f` and
+`4d70743`. On the first attempt WSL interop timeouts kept Edge from opening. On another, Authelia once dropped the
+OIDC flow to its default URL, `users.coulomb.social`.
+
+Still open: railiance-platform removes the alias from its declarations (message `051b7391`), and a fresh export
+confirms the change with `make service-identity-observe`.

docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-disable-receipt.json

@@ -0,0 +1,38 @@
+{
+  "alias": {
+    "default_role": "platform-admin",
+    "oidc_client_id": "openbao-admin",
+    "roles": [
+      "platform-admin"
+    ]
+  },
+  "applied": true,
+  "credential_values_emitted": false,
+  "mounts_after": [
+    "approle/",
+    "keycape-services/",
+    "kubernetes/",
+    "netkingdom/",
+    "token/"
+  ],
+  "mounts_before": [
+    "approle/",
+    "keycape-services/",
+    "keycape/",
+    "kubernetes/",
+    "netkingdom/",
+    "token/"
+  ],
+  "observed_at": "2026-11-07T14:15:47.100701+00:00",
+  "schema": "net-kingdom.openbao-keycape-alias-disable.v1",
+  "session": {
+    "path": "auth/netkingdom/oidc/callback",
+    "policies": [
+      "default",
+      "operator-custody",
+      "platform-admin"
+    ]
+  },
+  "session_after_ok": true,
+  "status": "disabled_verified"
+}

docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-dry-run-2-receipt.json

@@ -0,0 +1,9 @@
+{
+  "applied": false,
+  "credential_values_emitted": false,
+  "error": "TypeError",
+  "observed_at": "2026-11-07T14:11:13.546965+00:00",
+  "schema": "net-kingdom.openbao-keycape-alias-disable.v1",
+  "status": "helper_failed",
+  "step": "list auth/keycape/role"
+}

workplans/NK-WP-0054-service-identity-policy.md

@@ -195,7 +195,7 @@ status: wait
 priority: medium
 assignee: claude-code
 depends_on: [NK-WP-0054-T03]
-blocking_reason: "First run 2026-11-07 (OpenBao, PostgreSQL): keycape/platform-admin alias is an undeclared admin login without aal2, routed to railiance-platform. Remaining: owner answers on that and the 14 undeclared roles, a fresh OpenBao export after the 2026-11-04 go-live, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed."
+blocking_reason: "First run 2026-11-07 (OpenBao, PostgreSQL); the keycape/platform-admin alias (admin login without aal2) was disabled by the founder the same day (receipt disabled_verified). Remaining: owner answers on that and the 14 undeclared roles, a fresh OpenBao export after the 2026-11-04 go-live, the founder's KeyCape live view (KEY-WP-0045-T02), then the posture-feedback feed."
 state_hub_task_id: "c8db4607-9306-572b-a3cb-c35ca5989ec7"
 ```
 
@@ -248,6 +248,10 @@ Founder-run helper: `tools/service-identity/keycape-alias-disable.sh` (5 tests),
 did not come from `auth/netkingdom`. railiance-platform removes the alias from its declarations
 (`openbao/auth/keycape-oidc-config.json`, `docs/openbao.md`) so that a restore cannot bring it back.
 
+**2026-11-07 14:15Z: disabled.** Founder-run, receipt `disabled_verified`
+([evidence](../docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md)): `keycape/` is gone, `netkingdom/`
+remains, and the session survived. A fresh export will confirm it.
+
 ## Split the directory bind from the human admin
 
 ```task