NK-WP-0054-T04: auth/keycape alias disabled by the founder (receipt disabled_verified)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 149903@bnt-lap001
Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6

docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/README.md

@@ -41,3 +41,20 @@ Undeclared observed roles: 1 non-conformant, 14 unknown.
 
 Not covered: KeyCape (its live view is KEY-WP-0045-T02, founder-run), LLDAP, Authelia and privacyIDEA. Posture
 feedback does not consume these findings yet.
+
+## Remediation: `auth/keycape` disabled, 2026-11-07 14:15:47Z
+
+By founder decision, the founder ran `tools/service-identity/keycape-alias-disable.sh --apply` through
+railiance-platform `scripts/openbao-attended-exec.py`, from a session on `auth/netkingdom/oidc/callback` (aal2,
+KeyCape OTP). Receipt `keycape-alias-disable-receipt.json` (sha256 `97a96dff…`): status `disabled_verified`.
+Before the change the alias had roles `[platform-admin]` and client `openbao-admin`. After it, `keycape/` is absent
+and `netkingdom/` is present, and the founder's own session was unaffected. Every token the alias had issued was
+revoked with the mount.
+
+Two earlier dry runs failed inside the helper, before any change: one left no receipt, and one failed with a
+`TypeError` on `bao list` output (`keycape-alias-dry-run-2-receipt.json`). Both are fixed in `9db7f5f` and
+`4d70743`. On the first attempt WSL interop timeouts kept Edge from opening. On another, Authelia once dropped the
+OIDC flow to its default URL, `users.coulomb.social`.
+
+Still open: railiance-platform removes the alias from its declarations (message `051b7391`), and a fresh export
+confirms the change with `make service-identity-observe`.

docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-disable-receipt.json

@@ -0,0 +1,38 @@
+{
+  "alias": {
+    "default_role": "platform-admin",
+    "oidc_client_id": "openbao-admin",
+    "roles": [
+      "platform-admin"
+    ]
+  },
+  "applied": true,
+  "credential_values_emitted": false,
+  "mounts_after": [
+    "approle/",
+    "keycape-services/",
+    "kubernetes/",
+    "netkingdom/",
+    "token/"
+  ],
+  "mounts_before": [
+    "approle/",
+    "keycape-services/",
+    "keycape/",
+    "kubernetes/",
+    "netkingdom/",
+    "token/"
+  ],
+  "observed_at": "2026-11-07T14:15:47.100701+00:00",
+  "schema": "net-kingdom.openbao-keycape-alias-disable.v1",
+  "session": {
+    "path": "auth/netkingdom/oidc/callback",
+    "policies": [
+      "default",
+      "operator-custody",
+      "platform-admin"
+    ]
+  },
+  "session_after_ok": true,
+  "status": "disabled_verified"
+}

docs/evidence/2026-11-07-nk-wp-0054-t04-conformance/keycape-alias-dry-run-2-receipt.json

@@ -0,0 +1,9 @@
+{
+  "applied": false,
+  "credential_values_emitted": false,
+  "error": "TypeError",
+  "observed_at": "2026-11-07T14:11:13.546965+00:00",
+  "schema": "net-kingdom.openbao-keycape-alias-disable.v1",
+  "status": "helper_failed",
+  "step": "list auth/keycape/role"
+}