Reflect the published service-JWT login contract and proven login

SCOPE, layer.yaml and the custody doc said the platform JWT role was
unpublished. The role is applied, its consumer contract is published
(railiance-platform 21b8af3) and login was proven on 2026-10-10. The role
is login-only, so engine actions still use the named providers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 544698@bnt-lap001
Assistant-Session: 279b8520-335f-4041-ba2a-9491335473db

SCOPE.md

@@ -177,10 +177,17 @@ do not replace exact-action authorization or OpenBao audit logs.
 The CLI now has a named `service-jwt` provider that logs in through that
 scaffold when the platform JWT mount/role contract is present, then
 self-revokes the issued OpenBao token. Signature verification and token
-issuance remain with the platform-owned exact-bound OpenBao JWT role, whose
-mount/role contract is still outstanding. Until it is published, `--auth auto`
-keeps named bootstrap/env providers and never treats them as a fallback from
-service-jwt failure.
+issuance stay with the platform-owned, exact-bound OpenBao JWT role
+`keycape-services`/`secrets-engine-openbao` (CCR-2026-0038). Its consumer
+contract is published as railiance-platform
+`docs/contracts/secrets-engine-openbao-jwt-login.yaml`. The founder-run login
+proof passed on 2026-10-10 (`docs/evidence/2026-10-10-keycape-openbao-probe.json`).
+The role is login-only: its policy grants lookup-self, capabilities-self and
+revoke-self, with no KV read and no policy/auth write. So service-jwt cannot yet
+carry engine actions. `--auth auto` selects service-jwt only when
+`SECRETS_ENGINE_OPENBAO_JWT_LOGIN` is set. Otherwise it keeps the named
+bootstrap/env providers, and it never uses them as a fallback when service-jwt
+fails. The CCR negative checks remain open under RPF-WP-0035-T02.
 Treat their output as operational guidance, not complete attestation for
 high-risk lanes.
 
@@ -245,8 +252,8 @@ metadata. `secrets-engine wrap` implements response-wrapped operator handoff.
 ## Not Implemented
 
 - A service API, daemon, UI, queue, scheduler, or remote multi-user service.
-- Platform JWT mount/role materialization for the implemented KeyCape
-  service-auth / `service-jwt` provider.
+- Engine-action authority for the `service-jwt` identity. The platform JWT
+  role is login-only, and its CCR negative checks (RPF-WP-0035-T02) are open.
 - Provider-side / workload consumer rotation. Overlay lane state is local and
   non-secret only; it is not an OpenBao-side state machine.
 - Protocol step 1 in production: approval-engine does not yet serve the
@@ -341,7 +348,7 @@ Working companion: `net-kingdom/SECURITY-COMPANION.md`.
 | Evidence bound | `evidence-classification.yaml`; load-bearing local outbox; heartbeat command | Drain to `audit-core` once that sender is admitted |
 | SSH-CA surface | Contract at `docs/ssh-ca-signing-contract.md`; not shipped | Engine API after ops-warden assent |
 | Secret-use evidence | Contract at `docs/secret-use-evidence-contract.md`; not shipped | Engine surface after kings-guard assent |
-| Agent credential | Bootstrap token file still accepted; KeyCape scaffold unwired to OpenBao | Per-task, time-bounded service identity; no standing engine credential |
+| Agent credential | Bootstrap token file still accepted; service-JWT OpenBao login proven (login-only role, 2026-10-10) | Per-task, time-bounded service identity; no standing engine credential |
 
 ## Where Current Work Lives
 

WORK-RECORDS.md

@@ -20,7 +20,7 @@
 | workplan | SECRETS-WP-0009 | blocked | — | workplans/SECRETS-WP-0009-glas-claude-native-delivery.md |
 | workplan | SECRETS-WP-0010 | finished | — | workplans/SECRETS-WP-0010-openrouter-native-access.md |
 | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
-| workplan | SECRETS-WP-0012 | blocked | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+| workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
 | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
 | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
@@ -80,7 +80,7 @@
 | task | SECRETS-WP-0011-T05 | done | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
 | task | SECRETS-WP-0012-T01 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
-| task | SECRETS-WP-0012-T03 | wait | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+| task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
 | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |

docs/keycape-openbao-consumer-custody.md

@@ -84,8 +84,11 @@ YAML
 )
 ```
 
-This file is the probe's input, not the platform's publication. railiance-platform
-replaces or confirms it after the proof passes.
+The proof passed on 2026-10-10
+(`docs/evidence/2026-10-10-keycape-openbao-probe.json`). railiance-platform then
+published the consumer contract as `docs/contracts/secrets-engine-openbao-jwt-login.yaml`
+(21b8af3). That contract is identical to this probe input, so the local file
+stays as it is.
 
 ```bash
 cd /home/worsch/secrets-engine && \

layer.yaml

@@ -164,8 +164,9 @@ non_tooling_clients:
       key-cape is catalogued Tooling. The consumer exchanges a service JWT and
       logs in only when SECRETS_ENGINE_OPENBAO_JWT_LOGIN names a published
       mount/role contract. Failure never falls back to bootstrap or BAO_TOKEN.
-      The platform-owned role remains unpublished, so auto still uses the
-      named bootstrap/env providers.
+      The platform role is applied and its contract is published (CCR-2026-0038,
+      railiance-platform 21b8af3). Login was proven on 2026-10-10, but the role
+      is login-only, so engine actions still use the named bootstrap/env providers.
 
   - id: audit-core-outbox-drain
     target: audit-core