Record KeyCape exposure owner receipts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

docs/keycape-live-secret-exposure-recovery.md

@@ -62,6 +62,19 @@ Recheck these fields before a window using metadata-only columns and public
 OIDC endpoints. A changed UID, resource version, source revision, image, or
 JWKS digest invalidates the prepared approval receipt and requires review.
 
+## Owner receipt update (2026-08-23)
+
+KeyCape reports that its emergency signing-key rotation completed with
+deliberate JWT invalidation; consumers must refresh JWKS/re-authenticate. The
+receipt contains no secret values, but it does not yet identify the reviewed
+non-secret client-config revision or the post-rotation public JWKS digest.
+NetKingdom published the value-safe dependency and provider sequence at
+`c24d67b`, noting that the LLDAP admin account is persistent and that the
+privacyIDEA admin token is an expiring session JWT without individual
+revocation. Use expiry-based predecessor denial unless a separate global
+signing-secret invalidation is explicitly approved. These acknowledgements do
+not constitute a live GO; the approval template remains pending.
+
 ## Ownership
 
 | Boundary | Owner | Required contribution |
@@ -174,4 +187,3 @@ provider access, unsafe helper output, an unverified cleanup trap, or no exact
 human GO. Abort forward after mutation on failed readiness, missing negative
 proof, an unexpected JWKS result, any captured value, or elapsed window. The
 abort operator may stop the sequence at any time.
-