tegwick 61ab6bcc33 NK-WP-0048: key-cape type review R1-R4 as a 1.0 patch ... R1: redirect URIs refuse '?' and '#' in the type and keycape-client.py. R2: allowed_scopes always includes groups; access_groups is enforced by the consumer, not KeyCape. R3/R4: mfa_required false and restart-for-all-clients documented. The consumer-enforcement verification step (1.1) awaits a decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 736651@bnt-lap001 Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8		2026-10-10 13:18:11 +02:00
..
_template	NK-WP-0048-T05: fold ops-warden's review into the type; build memo r3	2026-10-09 00:22:04 +02:00
oidc-browser-relying-party	NK-WP-0048: key-cape type review R1-R4 as a 1.0 patch	2026-10-10 13:18:11 +02:00