Establish scoped KeyCape factor custody and verified automatic renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

docs/evidence/2026-09-13-keycape-factor-custody.md

@@ -0,0 +1,55 @@
+# KeyCape factor credential custody — 2026-09-13
+
+User-authorized attended setup is live under RPF-WP-0040 / CCR-2026-0023.
+The operator authenticated through the contained OpenBao login lane. No
+credential value was included in source, receipts, chat or ordinary logs.
+
+Dedicated privacyIDEA identity `keycape-factor-reader` has `tokenlist` permission
+for `coulomb`. Its password is in a separate OpenBao issuer path; KeyCape
+receives only a provider-issued, expiring JWT via External Secrets. Explicit
+fallback policy preserves existing administrators' prior rights and excludes
+this service identity. The service cannot read provider administration policy.
+
+Live checks passed:
+
+- Exact OpenBao policy/role readback, audience and service-account bindings.
+- Provider-issued credential, cross-user factor visibility, and the actual
+  KeyCape `user` + `realm` + `active=True` lookup shape.
+- Wrong service account rejected; issuer password and sibling KV reads denied.
+- ExternalSecret `sso/keycape-factor-read`: Ready=True / SecretSynced.
+- Initial renewal Job published KV version 2 and revoked its OpenBao session.
+  A second Job published version 3; the existing mounted file received the
+  replacement and provider lookup accepted it without a pod restart.
+- KeyCape config activation passed server dry-run and UID/resource-version CAS;
+  readback confirmed all other Secret data and configuration bytes preserved.
+  Deployment rolled out successfully with the existing image
+  `sha256:c9eb584d60efecfe00e1745a7e8cd3ebb4ae0f94faa715ef9594cd58a5dcebb6`.
+- Fourteen offline tests cover identity/expiry/status rejection, scope boundaries,
+  failed-provider preservation, CAS failure, session-cleanup failure, retry,
+  ambiguous config rejection and byte-preserving activation.
+
+Runtime source: `manifests/keycape-factor-custody.yaml`; renewal every ten minutes,
+ESO refresh every minute. Renewal runs as non-root with an immutable ConfigMap,
+digest-pinned image, dedicated service account and restricted network policy.
+The reader has no issuer-password permission; the renewer cannot write that
+password. OpenBao sessions last at most fifteen minutes (ESO) or five minutes
+(renewer). Successful renewal workers revoke their sessions explicitly.
+
+Repeat: `make keycape-factor-tests` and `make keycape-factor-live-acceptance`.
+Exact-commit CI is `.forgejo/workflows/keycape-factor-acceptance.yaml`.
+The first proof Job was `keycape-factor-delivery-acceptance`; its short-lived
+reader session expires by its fifteen-minute maximum TTL. The final reusable
+proof also revokes its session; its result is recorded below after execution.
+
+Limits: this establishes credential custody, renewal and native delivery.
+Genuine provider JWT expiry/revocation drills remain RPF-WP-0040-T04; renewing a
+JWT does not revoke its predecessor. Optional-after-enrollment policy remains
+unchanged. OTP onboarding, lost-factor recovery and their complete platform-admin
+browser journeys remain KEY-WP-0035 / USER-WP-0030. Historical resolver incident
+NK-WP-0033 is not closed by this new service lane.
+
+Final reusable proof passed: `keycape-factor-proof-0c4a6929`. All eight checks
+were true: wrong-SA rejection, issuer-password denial, sibling-secret denial,
+mounted-token/custody equality, KeyCape per-user lookup, provider administration
+denial, renewed projection acceptance, and explicit reader-session revocation.
+KeyCape remained Ready 1/1 at deployment generation 46. CCR validation passed.