NK-WP-0054-T04: KeyCape client scopes declared from key-cape source (a1ab8ff)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56

tools/service-identity/declarations/keycape.yaml

@@ -23,10 +23,10 @@ identities:
     status: active
   - name: secrets-engine-approval
     principal_type: SERVICE
-    purpose: "Confidential OIDC client; its token scopes are not established in the repository"
+    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
     grants:
       - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
-      - {mode: unknown, scope: "token scopes", note: "not established in the repository"}
+      - {mode: USE, scope: "approval-engine: approval:read, approval:consume", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff service-clients.example.yaml L27-39, token.go:355-363"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]
@@ -36,10 +36,10 @@ identities:
     status: active
   - name: secrets-engine-requester
     principal_type: SERVICE
-    purpose: "Confidential OIDC client; its token scopes are not established in the repository"
+    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
     grants:
       - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
-      - {mode: unknown, scope: "token scopes", note: "not established in the repository"}
+      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L106-119; subject lacks service: prefix"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]
@@ -49,10 +49,10 @@ identities:
     status: active
   - name: approval-engine-operator
     principal_type: SERVICE
-    purpose: "Confidential OIDC client; its token scopes are not established in the repository"
+    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
     grants:
       - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
-      - {mode: unknown, scope: "token scopes", note: "not established in the repository"}
+      - {mode: OPERATE, scope: "approval-engine: approval:create, read, approve, revoke, supersede, observe, emit", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L57-69; withdrawn 2026-09-09, still registered; SI-11 retirement candidate"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]
@@ -62,10 +62,10 @@ identities:
     status: active
   - name: informed-decision-sitting-requester
     principal_type: SERVICE
-    purpose: "Confidential OIDC client; its token scopes are not established in the repository"
+    purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
     grants:
       - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
-      - {mode: unknown, scope: "token scopes", note: "not established in the repository"}
+      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L122-135"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]
@@ -78,7 +78,7 @@ identities:
     purpose: "Confidential OIDC client; its token scopes are not established in the repository"
     grants:
       - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
-      - {mode: unknown, scope: "token scopes", note: "not established in the repository"}
+      - {mode: unknown, scope: "token scopes", note: "reference config: rapp-qonto-client, qonto:read; confirm live (KEY-WP-0045-T02)"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]

workplans/NK-WP-0054-service-identity-policy.md

@@ -208,6 +208,15 @@ feedback (`tools/posture-feedback`) with an evidence-freshness bound. It changes
 **Done when:** a dated run reports conformant, non-conformant and unknown per identity,
 with each owner named for every finding.
 
+**2026-10-28 (KeyCape):** key-cape `a1ab8ff` (KEY-WP-0045) adds `keycape identity-facts`, a value-safe
+JSON export of the client registry, directory bind, factor service and admin surfaces. Four of
+the five KeyCape unknowns are now declared from source (scopes limited to registered scopes,
+`token.go:355-363`); `rapp-qonto` stays `unknown` until the live view (reference config names it
+`rapp-qonto-client`, `qonto:read`). Findings handed on: KeyCape's LLDAP bind is the directory
+admin (scope of T05, KEY-WP-0045-T03); `approval-engine-operator` is withdrawn but registered
+(SI-11, KEY-WP-0013-T02). The founder's live view streams the deployed config through the
+exporter without writing it to disk; the exact command is in key-cape KEY-WP-0045-T02.
+
 ## Split the directory bind from the human admin
 
 ```task