Finalize proposed CCR-2026-0033 and its attended custody child (source only).

Correct the KV path into platform/workloads/, record secrets-engine consumer
coordinates (D1-D4 pending), rotation ownership, live order and rollback, and
add a decision-gated custody child with fake-only tests. Nothing executed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml

@@ -22,7 +22,7 @@ target:
     through sso-only ESO
 openbao:
   mount: platform
-  kv_path: platform/services/keycape/secrets-engine-openbao
+  kv_path: platform/workloads/keycape/secrets-engine-openbao
   fields:
   - CLIENT_SECRET
   policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso

docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md

@@ -44,8 +44,14 @@ the refusal. This is separate from actual provider registration/custody.
 
 ## Implemented platform issuer-reader preparation
 
-The KeyCape packet's candidate path is accepted here for proposed source review:
-`platform/services/keycape/secrets-engine-openbao`, field CLIENT_SECRET.
+The KeyCape packet's candidate path `platform/services/keycape/secrets-engine-openbao`
+is outside the platform-mount applier scope (`platform/workloads/` only) and was
+corrected on 2026-10-06 to `platform/workloads/keycape/secrets-engine-openbao`,
+field CLIENT_SECRET. Consumers bind to the sso Secret and the consumer file, not
+the KV path. The attended custody child
+`scripts/keycape_secrets_engine_openbao_custody.py` (source only, never run) and
+the secrets-engine consumer copy (SECRETS-WP-0012, a3897c2) are recorded in
+CCR-2026-0033 with the explicit live order.
 Proposed CCR-2026-0033 and input
 `docs/credential-lane-designs/keycape-secrets-engine-openbao-issuer-input.yaml`
 declare only the issuer reader. Policy

docs/provisioning-windows/2026-10-04-1000/keycape/eso.draft.yaml

@@ -50,5 +50,5 @@ spec:
   data:
   - secretKey: client-secret
     remoteRef:
-      key: services/keycape/secrets-engine-openbao
+      key: workloads/keycape/secrets-engine-openbao
       property: CLIENT_SECRET

docs/provisioning-windows/2026-10-04-1000/keycape/receipt-contract.json

@@ -5,7 +5,7 @@
   "status": "not-executed",
   "draft_only": true,
   "verified": false,
-  "request_sha256": "380a5cbb6a5be887d77e7c9aa57eda18da8a7059568b2c5143e2555ed8ab9fdb",
+  "request_sha256": "ade2e10b0f65341051b955900c68931bdd56fd3a81bf452ae81229cc2390ad63",
   "required_owner_checks": [
     "Exact revision/digest and required owner reviews",
     "Identity/auth claims confirmed separately; no inferred workload identity",