From bea425cf78668c0dde3aa63712fee1d04f312f56 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 14 Sep 2026 00:10:26 +0200
Subject: [PATCH] Record deployed P06 policy and completed platform acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
---
 sso-mfa/k8s/keycape/deployment.yaml | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index 7159a82..f955a86 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -2,7 +2,8 @@
 #
 # KeyCape orchestrates OIDC. Pending logins and authorization codes are process-local;
 # use one replica with Recreate during replacement. Persistent identity state remains
-# in Authelia, LLDAP and privacyIDEA. No PVC is required.
+# in Authelia, LLDAP and privacyIDEA. Scoped authentication policy and receipts
+# persist separately in the keycape-authentication-policy PVC.
 #
 # Configuration is stored entirely in the keycape-config Secret, which holds
 # a complete config.yaml and the RSA private key used to sign OIDC tokens
@@ -11,8 +12,9 @@
 # Prerequisites (apply in order):
 #   1. keycape-config Secret     — run keycape/create-secrets.sh
 #   2. keycape-factor-read Secret — ESO delivery owned by railiance-platform RPF-WP-0040
-#   3. This file
-#   4. middleware.yaml + ingress.yaml
+#   3. policy-pvc.yaml
+#   4. This file
+#   5. middleware.yaml + ingress.yaml
 #
 # Container image:
 #   KeyCape publishes immutable main-<short-sha> tags through Forgejo Actions.
@@ -50,7 +52,7 @@ spec:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
           # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
-          image: forgejo.coulomb.social/coulomb/key-cape@sha256:d3c358ec793b59d519ea6b1dbe4172449745a57504474399984de6cd8703024d
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5
           imagePullPolicy: IfNotPresent
 
           ports:
@@ -59,6 +61,8 @@ spec:
               protocol: TCP
 
           env:
+            - name: KEYCAPE_POLICY_PATH
+              value: /var/lib/keycape-policy/policy.json
             - name: KEYCAPE_ACCOUNT_PORTAL_URL
               value: https://users.coulomb.social
             - name: KEYCAPE_BROWSER_LOGOUT_URL
@@ -83,6 +87,8 @@ spec:
                   key: client-secret
 
           volumeMounts:
+            - name: authentication-policy
+              mountPath: /var/lib/keycape-policy
             - name: factor-token
               mountPath: /etc/keycape-factor
               readOnly: true
@@ -122,6 +128,9 @@ spec:
               memory: "128Mi"
 
       volumes:
+        - name: authentication-policy
+          persistentVolumeClaim:
+            claimName: keycape-authentication-policy
         - name: factor-token
           secret:
             secretName: keycape-factor-read