Record final KeyCape recovery receipt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

docs/keycape-exposure-rotation-approval.example.json

@@ -25,13 +25,13 @@
   },
   "post_rotation_observation": {
     "jwks_kid": "key-1",
-    "jwks_sha256": "3d46c07b649432eb41112b9e5f5a929460027766127d1eb419ebac8eb9858c06",
+    "jwks_sha256": "c6faac5dfeef2453daf9cfc14671f62b535dd321befdf6014e3ee5c2cf1f1156",
     "observed_at": "2026-08-23",
-    "source_revision_binding": "REQUIRED",
-    "downstream_refresh_confirmation": "REQUIRED"
+    "source_revision_binding": "93704fd2424503007c20b458b62a7f7d994bb288",
+    "downstream_refresh_confirmation": "keycape-authelia-lldap-privacyidea-identity-provisioner-ready-1-1"
   },
   "revisions": {
-    "key_cape": "REQUIRED",
+    "key_cape": "93704fd2424503007c20b458b62a7f7d994bb288",
     "net_kingdom": "REQUIRED",
     "railiance_platform": "453fed3"
   },
@@ -45,8 +45,8 @@
     "abort": "root-admin"
   },
   "acknowledgements": {
-    "key_cape_message_id": null,
-    "net_kingdom_message_id": null
+    "key_cape_message_id": "05b49688-76a8-4be9-a00d-95408c798697",
+    "net_kingdom_message_id": "71b1008a-7fd7-4500-85c6-e8893a6d80d4"
   },
   "authorization": {
     "human_go": true,

docs/keycape-live-secret-exposure-recovery.md

@@ -80,6 +80,17 @@ A fresh public JWKS read on 2026-08-23 found kid `key-1` and SHA-256
 Treat this as an observation only until KeyCape binds it to the source
 revision and confirms downstream cache refresh.
 
+KeyCape subsequently supplied source revision
+`93704fd2424503007c20b458b62a7f7d994bb288`, final public JWKS kid `key-1`,
+and SHA-256
+`c6faac5dfeef2453daf9cfc14671f62b535dd321befdf6014e3ee5c2cf1f1156`.
+KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner were reported
+Ready 1/1, with replacement/negative checks recorded. The persistent
+privacyIDEA `lldap-coulomb` resolver remains an attended provider-admin
+follow-up and is explicitly not complete; do not declare the incident closed
+or perform further bundle mutation until that owner action is separately
+authorized and evidenced.
+
 ## Ownership
 
 | Boundary | Owner | Required contribution |