codex f3ba7ca882 Admit KeyCape approval-engine client custody paths and delivery ... Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the field name is corrected to CLIENT_SECRET for the platform uppercase convention and the CCR validator. Kubernetes delivery references are confirmed against the live sso namespace. Attended authority is the governed openbao-platform-admin-login lane, and the rollout is one attended window ordered after the Authelia issuer precondition. Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05. Nothing is applied and no value exists: both CCRs remain proposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5		2026-09-08 14:53:32 +02:00
..
auth	Finish coding-agent high-risk boundary coverage	2026-08-22 10:03:54 +02:00
eso-auth-recovery	Prepare bounded Kubernetes authentication recovery for three ESO lanes	2026-09-05 18:38:19 +02:00
policies	Admit KeyCape approval-engine client custody paths and delivery	2026-09-08 14:53:32 +02:00
ssh	fix(openbao): complete SSH apply script for OpenBao 2.5.x issuers	2026-06-18 01:18:56 +02:00
state-hub-preflight	fix: preserve unrelated live boundary rules during signing lane apply	2026-09-05 16:43:47 +02:00