Record post-rotation public JWKS observation

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

docs/keycape-exposure-rotation-approval.example.json

@@ -23,6 +23,13 @@
     "predecessor_jwt": "reject-after-cutover",
     "forward_only": true
   },
+  "post_rotation_observation": {
+    "jwks_kid": "key-1",
+    "jwks_sha256": "3d46c07b649432eb41112b9e5f5a929460027766127d1eb419ebac8eb9858c06",
+    "observed_at": "2026-08-23",
+    "source_revision_binding": "REQUIRED",
+    "downstream_refresh_confirmation": "REQUIRED"
+  },
   "revisions": {
     "key_cape": "REQUIRED",
     "net_kingdom": "REQUIRED",

docs/keycape-live-secret-exposure-recovery.md

@@ -75,6 +75,11 @@ revocation. Use expiry-based predecessor denial unless a separate global
 signing-secret invalidation is explicitly approved. These acknowledgements do
 not constitute a live GO; the approval template remains pending.
 
+A fresh public JWKS read on 2026-08-23 found kid `key-1` and SHA-256
+`3d46c07b649432eb41112b9e5f5a929460027766127d1eb419ebac8eb9858c06`.
+Treat this as an observation only until KeyCape binds it to the source
+revision and confirms downstream cache refresh.
+
 ## Ownership
 
 | Boundary | Owner | Required contribution |