keycape-client-secret-generate: issuer-role login step and T05 probe evidence; stays draft

railiance-platform bound the issuer role (CCR-2026-0043) and passed the T05
probe (21b8af3). The playbook gains the bao login step for that role. The lane
stays draft at the owner's request until key-cape confirms the secret format.
WP-0044 notes net-kingdom's {client_id:env} patch (9a9b8e3) and the Forgejo
case's materialization status.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8

registry/routing/catalog.yaml

@@ -1542,6 +1542,10 @@ entries:
     # until: the issuer policy is bound to the operator OIDC role (founder),
     # key-cape confirms the secret format, and the RPF-WP-0054-T05 disposable
     # probe passes. Then railiance-platform confirms and ops-warden activates.
+    # 2026-10-10: issuer role bound (CCR-2026-0043) and T05 probe passed
+    # (railiance-platform 21b8af3: generated v1, second run exit 3, grant token
+    # revoked, value_reads 0). Still draft at the owner's request until
+    # key-cape confirms the secret format.
     # How warden case run executes it is WARDEN-WP-0044-T03.
     risk: high
     workload_ref:
@@ -1560,7 +1564,7 @@ entries:
       intended_owner: railiance-platform
       reviewed: "2026-10-10"
       verified: owner-confirmed
-    auth_method: "caller's own OIDC session holding policy credential-broker-keycape-client-secret-generate-issuer; broker mints a 5m create-only grant token (keycape/client-secret-generate). Agents and root refused."
+    auth_method: "bao login -method=oidc -path=netkingdom role=credential-broker-keycape-client-secret-generate (net-kingdom-admins, aal2, 15m; token holds only the issuer policy, CCR-2026-0043); broker then mints a 5m create-only grant token (keycape/client-secret-generate). Agents and root refused."
     path_template: "platform/workloads/keycape/<client_id>"
     exec_owner: railiance-platform
     exec_command: "scripts/credential.py generate --grant keycape/client-secret-generate --client-id <client_id> --case-file <case.yaml> --case-ref <case_id>@sha256:<hex64> [--receipt <file>] [--dry-run]"

wiki/playbooks/keycape-client-secret-generate.md

@@ -10,7 +10,15 @@ This page is a pointer. ops-warden does not generate, read or hold the value.
 
 1. The case must be `materialized`, `client_type: confidential`, with a
    `case-ref` from `warden case plan <case.yaml>`.
-2. Run the owner command from `~/railiance-platform` in your own terminal:
+2. Log in to the issuer role. You must be in `net-kingdom-admins` at aal2. The
+   token lasts 15m and holds only the issuer policy. Its uses are unlimited,
+   because a limited-use token cannot mint the grant token:
+
+   ```bash
+   bao login -no-print -method=oidc -path=netkingdom role=credential-broker-keycape-client-secret-generate
+   ```
+
+3. Run the owner command from `~/railiance-platform` in the same terminal:
 
    ```bash
    scripts/credential.py generate --grant keycape/client-secret-generate \
@@ -21,14 +29,15 @@ This page is a pointer. ops-warden does not generate, read or hold the value.
    The broker re-derives the case-ref, checks status, type and `client_id`,
    proves the path is absent, and writes once with CAS 0 to
    `platform/workloads/keycape/<client_id>`. It prints nothing.
-3. Exit codes: 0 generated (or dry-run ok), 2 precondition, 3 already present
+4. Exit codes: 0 generated (or dry-run ok), 2 precondition, 3 already present
    (never overwritten), 4 token or write failure, 5 verify failure.
-4. Verify from the receipt and metadata only (version 1). Never read the value.
+5. Verify from the receipt and metadata only (version 1). Never read the value.
 
 Refused for agent sessions (`WARDEN_AGENT_ID`), root, and callers without the
 issuer policy.
 
-Status: draft. The lane is live only once the issuer policy is bound to the
-operator OIDC role (founder), key-cape has confirmed the secret format, and the
-RPF-WP-0054-T05 disposable probe has passed. railiance-platform confirms, and
-ops-warden then activates the entry.
+Status: draft. The issuer role is bound (CCR-2026-0043), and the RPF-WP-0054-T05
+disposable probe passed on 2026-10-10 (railiance-platform
+`docs/evidence/2026-10-10-keycape-client-secret-generate-probe.json`). The lane
+still waits for key-cape to confirm the secret format (length and alphabet).
+railiance-platform then sends the go-ahead, and ops-warden activates the entry.

workplans/WARDEN-WP-0044-security-case-follow-through.md

@@ -177,6 +177,17 @@ activated:
 - key-cape confirms the secret format
 - the RPF-WP-0054-T05 probe passes
 
+2026-10-10 (later):
+- **Broker lane.** The issuer role is bound (CCR-2026-0043) and the T05 probe
+  passed (railiance-platform `21b8af3`). Only key-cape's format confirmation is
+  left. The playbook now includes the issuer-role login, a 15m token with
+  unlimited uses that `warden case run` must group with the attended session.
+- **Env spec.** net-kingdom adopted `{client_id:env}` as a 1.0 patch
+  (`9a9b8e3`). The plan renders `KEYCAPE_FORGEJO_CLIENT_SECRET`.
+- **Forgejo case.** Rendered and built by ops-mason. It is not yet
+  `materialized`: MASON-WP-0010-T03 waits on the railiance-platform CCRs and
+  their founder apply.
+
 ```task
 id: WARDEN-WP-0044-T04
 status: wait