{
  "_template": "UNSIGNED PROPOSAL. Placeholders in <angle brackets> are unknown until the files exist and are reviewed. Signing it is the founder's act; this file authorizes nothing.",
  "schema": "netkingdom.keycape-phase-b-attempt-admission.v1",
  "namespace": "netkingdom-keycape-phase-b-attempt",
  "attempt_id": "<new unique id>",
  "not_before": "<YYYY-MM-DDTHH:MM:SSZ>",
  "not_after": "<at most 24 h after not_before>",
  "abort_operator": "<founder>",
  "case": "secrets15-nk49-readiness",
  "issuer": "https://kc.coulomb.social",
  "network": {
    "name": "<created by the named network owner, e.g. nk49-phase-b-<attempt_id>>",
    "owner": "<railiance-platform | net-kingdom>",
    "internal": true,
    "alias_for_keycape": "kc.coulomb.social",
    "attached_containers_exactly": ["keycape-worker", "restored-openbao", "consumer-runner"],
    "egress_refusal_probe_sha256": "<reviewed probe>"
  },
  "bound_receipts": {
    "t18_keycape_attempt_receipt_sha256": "16d72f7c…1651 (truncated in the public record; full digest from the founder workstation)",
    "restored_openbao_receipt_sha256": "4e048dee…579d (same)",
    "ciphertext_sha256": "7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30"
  },
  "tls": {
    "decision": "<reissue | retain key from earlier attempt>",
    "trust_sha256": "<ISRG Root X1 trust bytes, as in the T18 admission>",
    "acme_duplicate_count_confirmed_by": "railiance-cluster"
  },
  "consumer": {
    "client_id": "secrets-engine-openbao",
    "secret_env": "KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET",
    "audience": "secrets-engine-openbao",
    "scope": "openbao:login",
    "subject": "service:secrets-engine",
    "tenant": "tenant:platform",
    "roles": "secrets-engine",
    "deny_scope": "openbao:admin",
    "secret_custody": "<secrets-engine proposal; never a value in this document>"
  },
  "source_closure_sha256": {
    "isolated-keycape-phase-b.py": "<after review>",
    "run-isolated-keycape-phase-b.sh": "<after review>",
    "verify-keycape-phase-b-receipt.py": "<after review>",
    "unchanged_t38_pinned_sources": "<hash list from prepare-isolated-keycape.py>"
  },
  "not_authorized": [
    "production redirect or new client grant",
    "live OpenBao read of secret data",
    "human login or MFA",
    "any contact with railiance01 or the cluster"
  ]
}