tegwick 61ab6bcc33 NK-WP-0048: key-cape type review R1-R4 as a 1.0 patch ... R1: redirect URIs refuse '?' and '#' in the type and keycape-client.py. R2: allowed_scopes always includes groups; access_groups is enforced by the consumer, not KeyCape. R3/R4: mfa_required false and restart-for-all-clients documented. The consumer-enforcement verification step (1.1) awaits a decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 736651@bnt-lap001 Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8		2026-10-10 13:18:11 +02:00
..
bootstrap	NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof	2026-07-02 22:08:33 +02:00
k8s	NK-WP-0048: key-cape type review R1-R4 as a 1.0 patch	2026-10-10 13:18:11 +02:00
WORKPLAN.md	docs(sso-mfa): record T04 blocker — wrong image reference (ImagePullBackOff)	2026-03-20 17:16:35 +00:00