Close issuer pin prerequisite and prepare named custody review decisions

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: KeyCape verifier custody for the secrets-engine-approval confidential client
 status: proposed
 created: '2026-09-08'
-updated: '2026-09-08'
+updated: '2026-09-09'
 requester:
   agent: claude
   reason: >-
@@ -165,6 +165,8 @@ lifecycle:
     Disable the registration at KeyCape first (that is what stops token issuance),
     then rotate the KV version and confirm no other namespace consumed the store.
 state_hub:
+  decision_id: b533a271-b704-4c5c-98a2-9a5951aadfb6
+  decision_api_url: http://127.0.0.1:8000/decisions/b533a271-b704-4c5c-98a2-9a5951aadfb6
   workplan_id: RPF-WP-0035
   task_id: RPF-WP-0035-T05
   related_message: 278a3ebe-b529-49f6-bd1a-e3ebcf318260

credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml

@@ -5,7 +5,7 @@ request_type: workload-kv-read
 title: KeyCape verifier custody for the approval-engine-operator confidential client
 status: proposed
 created: '2026-09-08'
-updated: '2026-09-08'
+updated: '2026-09-09'
 requester:
   agent: claude
   reason: >-
@@ -142,6 +142,8 @@ lifecycle:
     Disable the registration at KeyCape, rotate the KV version, and refer emitted
     approval actions to approval-engine for audit review.
 state_hub:
+  decision_id: efa90517-0cae-4eb6-a68d-5b0489c84d65
+  decision_api_url: http://127.0.0.1:8000/decisions/efa90517-0cae-4eb6-a68d-5b0489c84d65
   workplan_id: RPF-WP-0035
   task_id: RPF-WP-0035-T05
   related_message: 278a3ebe-b529-49f6-bd1a-e3ebcf318260

docs/credential-lane-designs/keycape-approval-clients-review.md

@@ -0,0 +1,42 @@
+# KeyCape approval-client custody: review packet
+
+Prepared 2026-09-09 by the-custodian. Both requests are **proposed**; no named
+approval or custody mutation has been recorded. This is the review gate for
+RPF-WP-0035-T05, consumed by HFACT-WP-0001-T03.
+
+| Request | Secret path and field | Client authority | Pending decision |
+| --- | --- | --- | --- |
+| [CCR-2026-0017](../../credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml) | `platform/workloads/secrets-engine/approval-client`, `CLIENT_SECRET` | `approval:read`, `approval:consume` | `b533a271-b704-4c5c-98a2-9a5951aadfb6` |
+| [CCR-2026-0018](../../credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml) | `platform/workloads/approval-engine/operator-client`, `CLIENT_SECRET` | create/read/approve/revoke/supersede/observe/emit; no consume | `efa90517-0cae-4eb6-a68d-5b0489c84d65` |
+
+Both require **platform-operator and key-cape-owner** review. Each has its own
+exact-path policy, Kubernetes auth role and ClusterSecretStore, bound to
+`external-secrets/external-secrets`, limited to `sso`. ESO owns the resulting
+Secret; authentication tokens have a 15-minute TTL. Client secrets require
+explicit rotation or registration disablement; token expiry does not revoke them.
+
+The approved object would authorize verifier-side custody only. Client-side
+retrieval, audit sender/receiver custody, operator `approval:consume`, adoption
+of the Qonto Secret and factory spending remain outside these two requests.
+
+Technical review completed: both CCRs validate, their generated policies match
+the two source HCL files, and the delivery manifests map exactly to the declared
+paths and fields. The signed upstream issuer is verified; NetKingdom's exact live
+pin is independently read back at Secret revision `58713343`. The compatible
+KeyCape image and rollout patch are prepared. These checks are evidence for the
+review, not substitutes for either named approval.
+
+Execution still follows the [owner rollout sequence](keycape-approval-clients.md)
+through the founder-attended Warden/OpenBao envelope: policy/roles, CAS=0 initial
+custody, Valid stores, SecretSynced delivery, compatible config/image replacement,
+then positive and negative acceptance and metadata-only receipts. The generated
+plan leaves initial secret provisioning to the contained owner procedure; it is
+not an already exercised end-to-end activation command. Finish and exercise that
+procedure before opening the activation window. Current proposed requests refuse
+`apply-plan`; no status has been changed to get around that refusal.
+
+Review outcome: approve, deny or needs changes, naming the reviewer and the role
+they are accepting. Both required role confirmations must be recorded for each
+CCR before execution. A generic CLI status change alone is insufficient evidence
+that both reviews occurred. No owner messages or browser login were triggered
+by preparation of this packet.

docs/credential-lane-designs/keycape-approval-clients.md

@@ -117,9 +117,11 @@ Prerequisites before the window opens:
    The admitted probe passed signature/audience/time/nonce verification on
    2026-09-08 at 21:44:44 UTC, exited 0 and removed every temporary resource.
    [Receipt](../evidence/2026-09-08-keycape-upstream-issuer-proof.json).
-   The configuration owner must still ensure `authelia.issuer` is pinned to
+   NetKingdom completed the exact `authelia.issuer` pin on 2026-09-09,
-   that exact value before this window. The probe left normal configuration
+   with unchanged signing key and unrelated configuration; Secret revision
-   unchanged. Keep the existing-human-login regression in the rollout checks.
+   `58713343`. [Pin receipt](../evidence/2026-09-09-keycape-upstream-issuer-pin.json).
+   This prerequisite is closed. Keep the existing-human-login regression in
+   the separately admitted image/configuration rollout checks.
 
 In-window order:
 
@@ -178,3 +180,8 @@ Use an absolute path to the owner command if invoking from another directory.
 It emits no output or values; inspect its allowlisted capability metadata only
 after Warden has completed revocation and cleanup. No custody activation or
 approval is performed by this preflight.
+
+
+2026-09-09: the live issuer pin is complete. The next review is captured in
+[keycape-approval-clients-review.md](keycape-approval-clients-review.md), with
+one pending Hub decision per existing CCR and both required reviewer roles.

docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json

@@ -0,0 +1,93 @@
+{
+  "schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
+  "recorded_at": "2026-09-08T22:24:00.262369+00:00",
+  "authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
+  "source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
+  "signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
+  "check_before": {
+    "before": {
+      "resource_version": "51346058",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": false,
+    "deployment_changed": false,
+    "issuer_matches": false,
+    "mode": "issuer-check-live",
+    "observed_at": "2026-09-08T22:23:58.199881+00:00",
+    "prior_pin_state": "absent",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "pin": {
+    "after": {
+      "resource_version": "58713343",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "before": {
+      "resource_version": "51346058",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": true,
+    "deployment_changed": false,
+    "issuer_matches": true,
+    "mode": "issuer-pin-live",
+    "observed_at": "2026-09-08T22:23:58.727554+00:00",
+    "other_secret_data_unchanged": true,
+    "prior_pin_state": "absent",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "unrelated_config_bytes_preserved": true,
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "check_after": {
+    "before": {
+      "resource_version": "58713343",
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
+    },
+    "config_changed": false,
+    "deployment_changed": false,
+    "issuer_matches": true,
+    "mode": "issuer-check-live",
+    "observed_at": "2026-09-08T22:23:59.920100+00:00",
+    "prior_pin_state": "matching",
+    "schema": "netkingdom.keycape-issuer-pin.v1",
+    "secret_values_emitted": false,
+    "target": "sso/keycape-config",
+    "verified_issuer": "https://auth.coulomb.social"
+  },
+  "deployment_before": {
+    "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+    "resource_version": "55113259",
+    "generation": 29,
+    "images": [
+      {
+        "name": "keycape",
+        "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+      }
+    ],
+    "ready_replicas": 1,
+    "available_replicas": 1
+  },
+  "deployment_after": {
+    "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+    "resource_version": "55113259",
+    "generation": 29,
+    "images": [
+      {
+        "name": "keycape",
+        "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
+      }
+    ],
+    "ready_replicas": 1,
+    "available_replicas": 1
+  },
+  "deployment_unchanged": true,
+  "tests_passed": 13,
+  "credential_values_emitted": false,
+  "custody_activated": false,
+  "ccr_reviews_completed": false,
+  "process_reload_or_new_image_proved": false
+}

workplans/RPF-WP-0035-credential-lane-implementation.md

@@ -146,6 +146,8 @@ closure: `history/2026-09-05-preflight-signing-activation-complete.md`.
 ```task
 id: RPF-WP-0035-T05
 status: wait
+needs_human: true
+intervention_note: "Review CCR-2026-0017 and CCR-2026-0018 as platform-operator and key-cape-owner; both pending decisions are linked from the CCRs and the review packet. Signed issuer and exact configuration pin are proved."
 priority: high
 state_hub_task_id: "e15d62c9-e5da-5721-a135-87c050f7851c"
 ```
@@ -203,6 +205,19 @@ custody mutation or client-side read. Keep the current authority preflight and
 this signed-token proof as separate receipts. Live ESO/client/approval and
 separate audit/client-side custody acceptance remain open.
 
+
+2026-09-09 configuration and review-queue return: NetKingdom pinned the verified
+HTTPS issuer, using an atomic UID/resourceVersion test and independent readback.
+Secret revision `58713343`; unrelated configuration and signing key unchanged;
+no Deployment rollout. Receipt: `docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json`.
+
+The two existing CCRs remain proposed. They now link to concrete pending review
+decisions, with platform-operator and key-cape-owner named explicitly. See
+`docs/credential-lane-designs/keycape-approval-clients-review.md`. T05 owns this
+human dependency; HFACT consumes it without a duplicate approval request.
+Custody/ESO activation, client verification and the separate client-side/audit
+lanes remain open. Current CLI apply plans refuse the proposed requests.
+
 ## Dependency review — 2026-09-06
 
 SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented