NK-WP-0048-T34: integrate the corrected F3 owner configuration inverse text into 1.3

Applies the Custodian nk48-r5-f3-implementation-r2 type candidate (addresses
RAPPS-F3-SESSION-1). Descriptors unchanged; validator and suites pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6

security-case-type-revisions/1.3/oidc-browser-relying-party/type.yaml

@@ -362,16 +362,30 @@ spec:
       Secret values.
   - id: hand-over
     owner: '{consumer_owner_repo}'
-    entry_point: The consumer owner first makes its own Helm change configuring {consuming_service}
-      with issuer {issuer}, client {client_id} and custody bao:platform/workloads/keycape/{client_id},
-      requiring one of {access_groups} in the groups claim before sign-in completes.
-      Then reviewed adapter net-kingdom/keycape-hand-over, dispatched by Warden's case
-      kernel inside the attended consumer-owner session, verifies the consumer with
-      four value-free probes (member-login, non-member-refused, membership-add-grants,
-      membership-remove-revokes) and records the hand-over receipt.
+    entry_point: The consumer owner's reviewed deployment entry wraps its own Helm
+      configuration and the admitted hand-over in one owner configuration transaction,
+      for public clients as well as confidential clients even when delivery is NO_CHANGE.
+      Before changing {consuming_service}, durably bind exact case, acceptance, human
+      principal, owner configuration source, cluster/release and before revision;
+      authenticate the case-created post revision under the owner's release-writer
+      exclusion before verification. Configure issuer {issuer}, client {client_id}
+      and, only for confidential clients, custody bao:platform/workloads/keycape/{client_id},
+      requiring one of {access_groups} before sign-in completes. Preserve identical
+      preexisting configuration as NO_CHANGE and refuse conflicts. Then the reviewed
+      adapter net-kingdom/keycape-hand-over, dispatched by Warden's case kernel inside
+      the attended consumer-owner session, verifies the four value-free probes
+      (member-login, non-member-refused, membership-add-grants, membership-remove-revokes)
+      and records the receipt. The owner wrapper's separate configuration inverse is
+      reachable on failure before a receipt exists and on later owner case unwind;
+      it does not depend on delivery-created objects or receipt creation. Missing or
+      ambiguous configuration provenance requires owner reconciliation, never replay.
     auth: the attended consumer-owner session on lane apps-consumer-handover (actor human,
       parent-session revoked per attempt); the consumer configuration itself is the
-      owner's own deployment path
+      owner's own deployment path. Every configuration inverse is a distinct fresh
+      authorized attended owner operation, bound to operation, exact principal, case,
+      source, release and transaction, with its own per-attempt revocation on every
+      exit. Never reuse the already revoked hand-over parent session. Missing current
+      inverse authority retains pending owner reconciliation evidence
     lane: apps-consumer-handover
     warden_executes: false
     attended: true
@@ -437,13 +451,22 @@ spec:
     reads_secret_value: false
   rollback:
   - reverses: hand-over
-    action: the adapter removes only its hand-over receipt. Removing the OIDC source
-      for {client_id} from {consuming_service} is the owner's Helm rollback (owner
-      {consumer_owner_repo}), done inside deliver-consumer-secret's owner_remove
-      before any consumer object is removed
+    action: the adapter removes only its authenticated case-created hand-over receipt.
+      Independently, the consumer owner's configuration transaction inverse restores
+      only this case's configuration change through the noted before Helm revision,
+      after authenticating exact case/principal/source/release binding and checking
+      the unchanged post revision under exclusion of all release writers. It runs
+      on owner unwind for public and confidential cases, including skipped or NO_CHANGE
+      delivery and failures before receipt creation. Preserve preexisting configuration;
+      drift or ambiguous provenance requires owner reconciliation. This owner inverse
+      is outside the receipt adapter and precedes any delivery-object removal;
+      receipt removal alone never proves configuration rollback.
   - reverses: deliver-consumer-secret
     when: client_type == confidential
-    action: After reverting consumer secret reference, delete only authenticated created
+    action: First verify the owner configuration transaction inverse and absence of
+      remaining consumer secret references; NO_CHANGE configuration alone is not proof of
+      deactivation. Do not repeat an unguarded Helm rollback inside owner_remove.
+      Then delete only authenticated created
       ExternalSecret/owned target by UID and ownerReference, then SecretStore and
       dedicated SA; preserve preexisting-matched resources and never delete a shared
       target. Retain audit and ownership receipts; removing SecretStore/SA alone is

workplans/NK-WP-0048-security-case-types.md

@@ -1676,6 +1676,22 @@ and `nk48-r5-f3-review-r1/`. Source review, owner acknowledgment and native proo
 remain distinct. T16's final composition/admission and T06's native first case
 are not completed by this refinement.
 
+2026-10-23: the F3 type text is integrated. The corrected r2 candidate (Custodian
+`nk48-r5-f3-implementation-r2/type-owner-configuration-inverse.candidate.patch`,
+which addresses review RAPPS-F3-SESSION-1) is applied to the 1.3 type. The
+hand-over entry_point and auth now describe one owner configuration transaction
+around the consumer's Helm change, for public clients and NO_CHANGE delivery
+alike, with an independently reachable inverse. Every inverse is a distinct
+fresh attended owner operation that never reuses the revoked hand-over session.
+The hand-over rollback stays receipt-only; delivery removal stays created-only
+after deactivation is proven.
+- Type validator: `OK oidc-browser-relying-party@1.3 (proposed)`. 22 package
+  tests and 363 adapter tests pass. The seven descriptors are unchanged by this
+  text.
+- Still owed: railiance-apps adopting the revised C3 placement, then
+  RAPPS-WP-0016-T05's real wrapper, journal, inverse session and all-writer
+  release exclusion. After that, coordinator r7 and the owner re-checks.
+
 ## T35 — Align source admission fixtures with the authenticated catalog and attended-session API
 
 ```task