Service identity: informed-decision-sitting-requester approval:read live (2026-11-01)

Founder-run keycape-client.py remove-then-add (rv 83164002 -> 83589983 ->
83590099), check-config valid throughout, one KeyCape restart, issuer ready.
Acceptance hub decision 21a557a9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

tools/service-identity/declarations/keycape.yaml

@@ -65,7 +65,8 @@ identities:
     purpose: "Confidential OIDC client (client_credentials); token scopes limited to its registered scopes"
     grants:
       - {mode: USE, scope: keycape, activation: STANDING, environments: [PRODUCTION], note: "client credentials"}
-      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L122-135; approval:read prepared in key-cape 82b471f (founder decision 2026-11-01, informed-decision present_existing), live only after the attended registry change"}
+      - {mode: USE, scope: "approval-engine: approval:create", activation: STANDING, environments: [PRODUCTION], note: "key-cape a1ab8ff L122-135"}
+      - {mode: USE, scope: "approval-engine: approval:read", activation: STANDING, environments: [PRODUCTION], note: "key-cape 82b471f; live 2026-11-01 (founder-run keycape-client.py remove-then-add, sso/keycape-config rv 83590099, acceptance hub decision 21a557a9, CCR-2026-0026/0027 amendment); for informed-decision present_existing intake"}
     interactive_login: false
     second_factor: not_applicable
     custody: [delivered-secret]