RPF-WP-0054-T05: fix issuer binding after the first probe

CCR-2026-0043 applied cleanly, but generate could not mint the grant token
(OpenBao refuses child tokens from a limited-use token; the role had
token_num_uses 8) and revoke-self was denied (missing from the issuer
policy). The role now uses 0, which the validator requires, and the issuer
policy grants revoke-self. Nothing was written by the probe.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9

tests/test_broker_grant_lane.py

@@ -93,6 +93,8 @@ class BrokerGrantLaneTests(unittest.TestCase):
         issuer = stanzas((ROOT / ccr()["openbao"]["issuer_policy_file"]).read_text())
         creates = [p for p in issuer if p.startswith("auth/token/create")]
         self.assertEqual(creates, ["auth/token/create/keycape-client-secret-generate"])
+        # Probe 2026-10-10: the operator must be able to end its own session.
+        self.assertEqual(issuer["auth/token/revoke-self"], '"update"')
 
     def test_validator_rejects_drift(self):
         cases = [

tests/test_issuer_binding_lane.py

@@ -54,11 +54,15 @@ json.dump(state, open(path, "w"))
 
 
 class IssuerBindingLaneTests(unittest.TestCase):
-    def test_ccr_validates_and_waits_for_approval_and_binding(self):
+    def test_ccr_validates_and_is_ready_to_reapply(self):
         _ccr, errors, _w = cc.validate_ccr(CCR_PATH)
         self.assertEqual(errors, [])
-        blockers = cc.applier_readiness_blockers(_ccr)
-        self.assertIn("applier requires confirmed OpenBao auth binding", blockers)
+        self.assertEqual(cc.applier_readiness_blockers(_ccr), [])
+
+    def test_unconfirmed_binding_blocks_the_applier(self):
+        c = ccr()
+        c["openbao"]["auth"]["bound_claims_confirmed"] = False
+        self.assertIn("applier requires confirmed OpenBao auth binding", cc.applier_readiness_blockers(c))
 
     def test_role_carries_only_the_issuer_policy(self):
         role = json.loads((ROOT / ccr()["openbao"]["auth"]["role_file"]).read_text())
@@ -73,6 +77,8 @@ class IssuerBindingLaneTests(unittest.TestCase):
             ("no aal2", {"bound_claims": {"groups": ["net-kingdom-admins"]}}),
             ("public callback", {"allowed_redirect_uris": ["https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback"]}),
             ("long ttl", {"token_ttl": "1h"}),
+            # Probe 2026-10-10: a limited-use token cannot create the grant token.
+            ("limited uses", {"token_num_uses": 8}),
         ]
         for label, change in cases:
             with self.subTest(label):