NK-WP-0048: adopt {client_id:env} in bind-env and its rollback (1.0 patch)

ops-warden's case planner renders the spec since 23ba584.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8

security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py

@@ -175,13 +175,9 @@ def test_forgejo_reference_case_is_accepted_and_matches_the_example():
 
 def test_env_format_spec_renders_the_keycape_env_name():
     # {client_id:env} gives the name keycape-client.py derives (env_name): upper
-    # case, '-' as '_'. The type adopts it once ops-warden's planner renders it
+    # case, '-' as '_'. Adopted in 1.0 once ops-warden's planner rendered it too
-    # too (ops-warden message 06303d1d); until then it keeps the literal form.
+    # (ops-warden 23ba584, message c1df14b7).
     t = as_implemented()
-    for item in t["spec"]["follow_through"] + t["spec"]["rollback"]:
-        for key in ("entry_point", "action"):
-            if key in item:
-                item[key] = item[key].replace("KEYCAPE_<CLIENT_ID>_CLIENT_SECRET", "KEYCAPE_{client_id:env}_CLIENT_SECRET")
     assert msgs(v.validate_type(t)) == []
     issues, r = v.render_case(with_params(FORGEJO, client_id="my-forge"), t, DECLS)
     assert msgs(issues) == []

security-case-types/oidc-browser-relying-party/type.yaml

@@ -190,7 +190,7 @@ spec:
     - id: bind-env
       owner: net-kingdom
       when: "client_type == confidential"
-      entry_point: "patch Deployment sso/keycape: env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from sso/keycape-{client_id}-client"
+      entry_point: "patch Deployment sso/keycape: env KEYCAPE_{client_id:env}_CLIENT_SECRET from sso/keycape-{client_id}-client"
       auth: "operator kube credentials for namespace sso"
       lane: key-cape-oidc-login
       warden_executes: false
@@ -264,7 +264,7 @@ spec:
       action: "keycape-client.py apply --operation remove for {client_id}"
     - reverses: bind-env
       when: "client_type == confidential"
-      action: "remove env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed"
+      action: "remove env KEYCAPE_{client_id:env}_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed"
     - reverses: deliver-secret
       when: "client_type == confidential"
       action: "delete ExternalSecret sso/keycape-{client_id}-client and its target"

workplans/NK-WP-0048-security-case-types.md

@@ -373,6 +373,14 @@ text is now checked for unknown placeholders too (patch-level, canon section 6).
 The type keeps the literal until ops-warden's planner (`text.format`) renders the
 spec as well; asked of ops-warden. 53 tests pass.
 
+2026-10-10: ops-warden rendered `{param:env}` in `warden case plan`
+(23ba584, message `c1df14b7`; other specs and `!conversion` refused). The type
+adopts it as a 1.0 patch (canon section 6): `bind-env` and its rollback now read
+`KEYCAPE_{client_id:env}_CLIENT_SECRET`. ops-mason reports the Forgejo case
+rendered and built (message `1ebddae9`; CCR drafts handed to railiance-platform),
+so T06 now waits on the platform apply, the mint-secret lane and the attended
+register-client session.
+
 ```task
 id: NK-WP-0048-T07
 status: wait