ESO role audience + explicit max TTL and ESO policy self-lifecycle (ops-mason
R3/R4, railiance-platform R3); consumer role renamed to differ from its policy
(railiance-platform R4); default SA and external-secrets/openbao namespaces
refused (ops-mason R6); consumer-cannot-read-delivered-secret verification
(ops-warden R7, ops-mason R7); excess scope invalid_profile_usage (key-cape
R3); attended rotation, broker admission pending, one rollout per case;
catalog fields (ops-warden R6). First case consumer_owner_repo
rapp-bounded-executor. CCR-2026-0060/0061 names checked by test. Memo r2
validated against informed-decision intake and State Hub dispatcher.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
Confidential client_credentials service clients: one audience, closed
resource scopes, fixed service subject and tenant, at most 15m; secret minted
in custody, read only by KeyCape (ESO) and the consumer's own bound
Kubernetes-auth role (no Secret copy). First case nk-bind-executor-approval
(approval-engine create/read/consume as service:nk-bind-executor). Capability
net-kingdom.keycape-service-client-registration; keycape-client.py renders
service clients in key-cape's shape (adoption of secrets-engine-approval
reproduces key-cape's record). Acknowledgement memo r1 validated against
informed-decision intake and State Hub dispatcher; hub decision f8044f81.
Test fixture's synthetic signing key is now computed, not a literal (secret
scan generic-api-key).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
