codex f3ba7ca882 Admit KeyCape approval-engine client custody paths and delivery ... Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the field name is corrected to CLIENT_SECRET for the platform uppercase convention and the CCR validator. Kubernetes delivery references are confirmed against the live sso namespace. Attended authority is the governed openbao-platform-admin-login lane, and the rollout is one attended window ordered after the Authelia issuer precondition. Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05. Nothing is applied and no value exists: both CCRs remain proposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5		2026-09-08 14:53:32 +02:00
..
applications	Add ArgoCD Application for target-revenue Trust Service	2026-08-05 16:41:00 +02:00
bootstrap	Point npm handoff and ArgoCD sourceRepos at Forgejo	2026-07-09 11:38:14 +02:00
platform-addons/openbao-secretstore	Admit KeyCape approval-engine client custody paths and delivery	2026-09-08 14:53:32 +02:00
repositories	Repoint ArgoCD GitOps to Forgejo (RAIL-HO-WP-0005 T11)	2026-07-08 15:35:28 +02:00