tegwick 0e86f957a2 NK-WP-0048-T05: take ops-warden R8 option 1; ensure-groups attended; memo r4 ... ensure-groups and its rollback run attended in the register-client session (key-cape-oidc-login), inside the identity-provisioner pod: the provisioner's only HTTP credential is user-engine's runtime token, so a caller-proxy lane would act as user-engine. Lane identity-provisioner-groups is dropped. Memo r4 supersedes r3; acknowledges ops-warden's WARDEN-WP-0044-T01 review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469893@bnt-lap001 Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb		2026-10-09 11:47:34 +02:00
..
_template	NK-WP-0048-T05: fold ops-warden's review into the type; build memo r3	2026-10-09 00:22:04 +02:00
oidc-browser-relying-party	NK-WP-0048-T05: take ops-warden R8 option 1; ensure-groups attended; memo r4	2026-10-09 11:47:34 +02:00