{
  "schema": "platform-key39-coding-client-custody-proposal/v1",
  "status": "proposed_source_only",
  "formal_owner_agreement": false,
  "native_authorized": false,
  "credential_access_authorized": false,
  "source_pins": [
    {
      "path": "/home/worsch/railiance-platform/AGENTS.md",
      "sha256": "8d2f1a165e3f4eecf2e6e1d6a19c4bac9e8dcb64a76650e7185d55722f233c8b"
    },
    {
      "path": "/home/worsch/railiance-platform/INTENT.md",
      "sha256": "12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c"
    },
    {
      "path": "/home/worsch/railiance-platform/openbao/auth/coding-agent-jwt-role.json",
      "sha256": "c72e836ab72713a49aa8fb84faa26e824ff1263b5a184600fca0c0284720ee3b"
    },
    {
      "path": "/home/worsch/railiance-platform/openbao/policies/agent-high-risk-boundary.hcl",
      "sha256": "ca3f27d8c099011ca44498ba1f50dea3eb6063c4a3bbbf9130e6881dd4e972f5"
    },
    {
      "path": "/home/worsch/railiance-platform/openbao/policies/workload-kv-read-issue-core-runtime.hcl",
      "sha256": "54b9f864f3435910143a860352aac5ecb3aa2cd7afb5e161bb304c12d821c55e"
    },
    {
      "path": "/home/worsch/railiance-platform/docs/platform-tenant-essentials-review.md",
      "sha256": "0b023c7a1bd58b1fac9b7ae746645dcf80fd3e5224c8399447fb90acbaba5c5c"
    },
    {
      "path": "/home/worsch/key-cape/config/service-clients.example.yaml",
      "sha256": "b7e17698a0946f387c481b7e27fe9ddea22cdd9db2e34e32a50457e02a34b18e"
    },
    {
      "path": "/home/worsch/key-cape/src/internal/authclient/cli.go",
      "sha256": "376a8e0d1d60825a8b3ef21d371e3fc353c0a34e461712a6899e264278edbe7f"
    },
    {
      "path": "/home/worsch/key-cape/src/internal/authclient/client.go",
      "sha256": "61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5"
    },
    {
      "path": "/home/worsch/key-cape/docs/proposals/2026-10-11-key39-next-execution-prerequisites.json",
      "sha256": "78288f6991910715b7ee8fdb2a32654418dd9becd5fccd254bab8d150420cfd3"
    },
    {
      "path": "/home/worsch/net-kingdom/sso-mfa/k8s/keycape/deployment.yaml",
      "sha256": "b21c04841245263861273133ac8bde06653deb88be3afef9596ed2fba9db631b"
    },
    {
      "path": "/home/worsch/ops-warden/registry/routing/catalog.yaml",
      "sha256": "09ee40df21b0ad8cad420be4613afcb1731967f68128631a94f9b96f3f31b318"
    }
  ],
  "identity": {
    "issuer": "https://kc.coulomb.social",
    "client_id": "codex-railiance-platform",
    "audience": "codex-railiance-platform",
    "subject": "service:codex:railiance-platform",
    "tenant": "tenant:platform",
    "principal_type": "service",
    "roles": [
      "coding-agent"
    ],
    "scope": "openbao:login",
    "max_lifetime_seconds": 900,
    "issuer_env_reference": "KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
  },
  "existing_role": {
    "path": "auth/netkingdom/role/coding-agent",
    "policies": [
      "agent-high-risk-boundary",
      "workload-kv-read-issue-core-runtime"
    ],
    "ttl_seconds": 900,
    "max_uses": 8,
    "no_default_policy": true,
    "source_is_not_native_observation": true
  },
  "proposed_coordinates": {
    "binding_status": "new_candidate_not_admitted_or_observed",
    "kv_mount": "platform",
    "kv_path": "workloads/keycape/codex-railiance-platform",
    "field": "CLIENT_SECRET",
    "issuer_namespace": "sso",
    "issuer_secret_name": "keycape-codex-railiance-platform-client",
    "issuer_secret_key": "client-secret",
    "issuer_serviceaccount_candidate": "keycape-codex-client-eso",
    "coding_secret_direct_delivery_to_agent": false,
    "founder_delivery": "separate exact attended one-use private custody-to-service-token invocation; only verified coding JWT JSON participates in reviewed KEY39 paired handoff"
  },
  "source_observations": {
    "deployment_has_named_env_reference": false,
    "exact_named_CCR_grant_catalog_receipt_found_in_bounded_search": false,
    "current_live_client_registration_proven": false,
    "current_custody_version_proven": false,
    "current_issuer_matching_version_proven": false,
    "current_delivery_host_profile_admitted": false,
    "new_CCR_assigned": false
  },
  "missing_admission_gates": [
    "Platform exact CCR/grant/catalogue and approved source revision for named client; no reuse of CCR0040 browser generation",
    "Net issuer registration and exact env Secret reference; live value-free matched-version projection",
    "Net dedicated namespace SecretStore/ExternalSecret serviceaccount, TokenRequest RBAC, issuer controller and Argo readiness ownership",
    "Platform exact founder custody-reader role/capability denial and token budget/cleanup; no standing coding-role read grant",
    "Founder host/process isolation from coding runtime, exact session/cert profile, continuous exclusive tmpfs and private environment/file custody",
    "Key exact verified claim producer including all identity coordinates and finite lifetime; existing CLI alone does not bind subject/tenant/type/roles/max900",
    "Fresh authenticated founder native revision and production maintenance exception when required",
    "Actual node route/role/plugin and all effective leeway observation, negative refusal correlation, known-token revoke and unknown recovery"
  ],
  "candidate_value_free_receipt_fields": [
    "source_revision",
    "CCR_id_and_digest",
    "grant_id_and_digest",
    "catalogue_id_and_digest",
    "issuer_client_projection_digest",
    "issuer_Secret_UID_resourceVersion_key_name_only",
    "custody_logical_path_and_version_only",
    "matched_version_attestation_no_value_or_secret_hash",
    "ESO_role_ServiceAccount_namespace_UID_audience_policy_digests",
    "founder_host_profile_process_isolation_attestation",
    "exact_execution_envelope_digest",
    "cleanup_status_and_unknown_effects"
  ],
  "standing_doc_correction": "tenant:coulomb -> tenant:platform only; dated historical proof unchanged"
}