{
  "admitted": false,
  "canonical_default": {
    "type": "oidc-browser-relying-party@1.1",
    "type_yaml_digest": "sha256:f705c64e4875e9b8e18a912fb51c135e77898926d6a451f5cb74ab3c0cbe4d1c",
    "unchanged": true
  },
  "check_config_digest": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5",
  "complete_executable_descriptor_set": false,
  "dispatch_permitted": false,
  "execution_descriptors": null,
  "owner_review": false,
  "params": {
    "consumer_owner_repo": "railiance-apps"
  },
  "refusal": "ensure-groups: lane 'keycape-attended-case-change' does not match the 1.2 type",
  "review_requirement": "successor candidate only: new descriptor bytes need a reviewed successor revision under canon section 6 and owner review (NK-WP-0048-T16) before pinning",
  "schema": "netkingdom.descriptor-composition-candidate.v1",
  "selection": "explicit version root 1.2=security-case-type-revisions/1.2; default root unchanged",
  "status": "not_an_admission",
  "steps": [
    {
      "candidate_descriptor_digest": "sha256:ebc9d5b9167d18e6015f4bbeb9699e8d396d64fbfaf195142781f84f4f47a70a",
      "descriptor": {
        "actor": "human",
        "adapter": "net-kingdom/ensure-groups@v1",
        "adapter_source": "sha256:f93e68e1932c7ca293c9e69e2d0e1843d58d06a8d4892158fe7d1e0393a21ba0",
        "allowed_created": [
          "service-group",
          "service-group-membership"
        ],
        "effect": "change",
        "lane": "keycape-attended-case-change",
        "owner": "net-kingdom",
        "retry_safe": false,
        "revocation_scopes": [
          "parent-session"
        ],
        "step": "ensure-groups",
        "target_parameter": "client_id",
        "version": "warden.case.execution.v1"
      },
      "findings": [
        "lane 'keycape-attended-case-change' != type lane 'key-cape-oidc-login'"
      ],
      "names_confirmed": null,
      "owner_confirmation_required": null,
      "step": "ensure-groups",
      "type_lane": "key-cape-oidc-login",
      "type_owner": "net-kingdom"
    },
    {
      "candidate_descriptor_digest": "sha256:c92957227235db04953809d92b260d32c8b947472a8e8fd17a258ade3ae8da70",
      "descriptor": {
        "actor": "human",
        "adapter": "net-kingdom/keycape-mint-secret@v1",
        "adapter_source": "sha256:34f79944204a2cf5b2a22baecbee4bde77cbdc0e3f9fc87bc98fa12a9c2c0bc1",
        "allowed_created": [
          "custody-secret-version"
        ],
        "effect": "mint",
        "lane": "keycape-client-secret-generate",
        "owner": "railiance-platform",
        "retry_safe": false,
        "revocation_scopes": [
          "parent-session",
          "broker-grant"
        ],
        "step": "mint-secret",
        "target_parameter": "client_id",
        "version": "warden.case.execution.v1"
      },
      "findings": [],
      "names_confirmed": {
        "by": "founder",
        "on": "2026-10-17",
        "schema": "railiance-platform.custody-mint.v1",
        "task": "NK-WP-0048-T25"
      },
      "owner_confirmation_required": null,
      "step": "mint-secret",
      "type_lane": "keycape-client-secret-generate",
      "type_owner": "railiance-platform"
    },
    {
      "candidate_descriptor_digest": "sha256:75aaa7346aebdea2a0eb0ba993995515b5248ffefc34caf8e713525e9b58da85",
      "descriptor": {
        "actor": "human",
        "adapter": "net-kingdom/deliver-secret@v1",
        "adapter_source": "sha256:df609bb93ebdfffb12cde213381a77eb7ac82670f814ff73623c1d98262cc90e",
        "allowed_created": [
          "delivered-secret"
        ],
        "effect": "change",
        "lane": "platform-secret-delivery",
        "owner": "railiance-platform",
        "retry_safe": false,
        "revocation_scopes": [
          "parent-session"
        ],
        "step": "deliver-secret",
        "target_parameter": "client_id",
        "version": "warden.case.execution.v1"
      },
      "findings": [],
      "names_confirmed": {
        "by": "founder",
        "lane": "platform-secret-delivery",
        "on": "2026-10-17",
        "schema": "netkingdom.deliver-secret.v1",
        "task": "NK-WP-0048-T26"
      },
      "owner_confirmation_required": null,
      "step": "deliver-secret",
      "type_lane": null,
      "type_owner": "railiance-platform"
    },
    {
      "candidate_descriptor_digest": "sha256:d5fcb20cf15bf7454890d2529180c582218e3df12584a99162e4b664b899caa0",
      "descriptor": {
        "actor": "human",
        "adapter": "net-kingdom/keycape-bind-env@v1",
        "adapter_source": "sha256:dcd43f5ce1c4e829e1198faffc6bfb9cc610509f5176658f42c133accc0a7305",
        "allowed_created": [
          "keycape-env-binding"
        ],
        "effect": "change",
        "lane": "keycape-attended-case-change",
        "owner": "net-kingdom",
        "retry_safe": false,
        "revocation_scopes": [
          "parent-session"
        ],
        "step": "bind-env",
        "target_parameter": "client_id",
        "version": "warden.case.execution.v1"
      },
      "findings": [
        "lane 'keycape-attended-case-change' != type lane 'key-cape-oidc-login'"
      ],
      "names_confirmed": {
        "by": "founder",
        "on": "2026-10-17",
        "schema": "netkingdom.keycape-bind-env.attempt.v1",
        "task": "NK-WP-0048-T27"
      },
      "owner_confirmation_required": null,
      "step": "bind-env",
      "type_lane": "key-cape-oidc-login",
      "type_owner": "net-kingdom"
    },
    {
      "candidate_descriptor_digest": "sha256:434c53e88d4dd86a0325603468c3d6618570f38155484a76ed37d2f1550d43cb",
      "descriptor": {
        "actor": "human",
        "adapter": "net-kingdom/keycape-registration@v1",
        "adapter_source": "sha256:212172e34155d1852375b4c6c2868c3da82f5f8e7c7957f6c9eab1430880f6d3",
        "allowed_created": [
          "keycape-client"
        ],
        "effect": "change",
        "lane": "keycape-attended-case-change",
        "owner": "net-kingdom",
        "retry_safe": false,
        "revocation_scopes": [
          "parent-session"
        ],
        "step": "register-client",
        "target_parameter": "client_id",
        "version": "warden.case.execution.v1"
      },
      "findings": [
        "lane 'keycape-attended-case-change' != type lane 'key-cape-oidc-login'"
      ],
      "names_confirmed": null,
      "owner_confirmation_required": null,
      "step": "register-client",
      "type_lane": "key-cape-oidc-login",
      "type_owner": "net-kingdom"
    },
    {
      "candidate_descriptor_digest": "sha256:36281df8139fb1ec64b226d94f80eb592de5addab7063ff54c691c641e275fc7",
      "descriptor": {
        "actor": "human",
        "adapter": "net-kingdom/deliver-consumer-secret@v1",
        "adapter_source": "sha256:66f16dcb665216d09ef63a5ca654283a0292005ba4fb4d79c27eeb54b886a385",
        "allowed_created": [
          "consumer-eso-sa",
          "consumer-secretstore",
          "consumer-externalsecret"
        ],
        "effect": "change",
        "lane": "consumer-owner-deployment",
        "owner": "railiance-apps",
        "retry_safe": false,
        "revocation_scopes": [
          "parent-session"
        ],
        "step": "deliver-consumer-secret",
        "target_parameter": "client_id",
        "version": "warden.case.execution.v1"
      },
      "findings": [],
      "names_confirmed": {
        "by": "founder",
        "lane": "consumer-owner-deployment",
        "on": "2026-10-17",
        "schema": "netkingdom.consumer-secret-delivery.v1",
        "task": "NK-WP-0048-T28"
      },
      "owner_confirmation_required": null,
      "step": "deliver-consumer-secret",
      "type_lane": null,
      "type_owner": "{consumer_owner_repo}"
    },
    {
      "candidate_descriptor_digest": "sha256:1bce07a3229b7d0c7c730f35ce5b40fe471009a82de8dd53788ed970a9be1224",
      "descriptor": {
        "actor": "human",
        "adapter": "net-kingdom/apps-handover@v1",
        "adapter_source": "sha256:4439305b3edcd5d51c73e6438744d8895d69c1ccb58854aac79bb489d868cf48",
        "allowed_created": [
          "handover-receipt"
        ],
        "effect": "change",
        "lane": "apps-consumer-handover",
        "owner": "railiance-apps",
        "retry_safe": false,
        "revocation_scopes": [
          "parent-session"
        ],
        "step": "hand-over",
        "target_parameter": "client_id",
        "version": "warden.case.execution.v1"
      },
      "findings": [],
      "names_confirmed": {
        "by": "founder",
        "lane": "apps-consumer-handover",
        "on": "2026-10-17",
        "schema": "netkingdom.apps-handover.attempt.v1",
        "task": "NK-WP-0048-T29"
      },
      "owner_confirmation_required": null,
      "step": "hand-over",
      "type_lane": null,
      "type_owner": "{consumer_owner_repo}"
    }
  ],
  "task": "NK-WP-0048-T30",
  "type": "oidc-browser-relying-party@1.2"
}