chore(registry,workplans): refresh reuse-surface entry; record WP14/WP15 upstream critical paths

Capability summary/artifacts now cover exec-file, wrap, rotate, lifecycle,
founder-signed trust admission and the service-JWT boundary verifier (maturity
unchanged). SCOPE exec block corrected. WP14/WP15 T04 notes name the upstream
decisions and owner tasks; NK49 pins confirmed unchanged at HEAD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 17890@bnt-lap001
Assistant-Session: 7d96d43c-0154-4a22-af71-71c349ac6dc3

registry/capabilities/capability.security.credential-lifecycle.md

@@ -29,8 +29,10 @@ external_evidence:
     confidence: low
     basis: No longitudinal consumer reliability measurement established by this review.
 name: Cataloged credential lifecycle
-summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
-  delivery and revoke.
+summary: Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan, exact metadata
+  apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file), wrapped
+  handoff, rotate, revoke and lifecycle, with founder-signed trust admission and a local
+  evidence outbox.
 tags:
 - security
 - netkingdom
@@ -56,6 +58,10 @@ availability:
   current_artifacts:
   - SCOPE.md
   - src/secrets_engine/decision_check.py
+  - src/secrets_engine/founder_admission.py
+  - docs/founder-admission.md
+  - tools/verify_service_jwt_boundary.py
+  - tools/check-keycape-recovery-selector.py
   consumption_modes:
   - CLI
   - source
@@ -69,6 +75,10 @@ evidence:
   documentation:
   - SCOPE.md
   - src/secrets_engine/decision_check.py
+  - src/secrets_engine/founder_admission.py
+  - docs/founder-admission.md
+  - tools/verify_service_jwt_boundary.py
+  - tools/check-keycape-recovery-selector.py
 consumer_guidance:
   recommended_for:
   - Protected operation obtains and consumes exact human approval before its side
@@ -82,13 +92,17 @@ consumer_guidance:
   known_limitations:
   - Production protected execution and independently anchored PDP authentication remain
     incomplete
+  - 'Founder-signed admission of the PDP trust file and recovery attempts is source only
+    (2026-10-21); the real producer key admission (SECRETS-WP-0014-T04) and native rollout
+    (T03) are outstanding.'
+  - service-jwt is login-only; it cannot carry engine actions yet.
   - 2026-10-14 architecture review estimates operational maturity separately; a registry
     entry does not authorize execution or establish deployment.
 ---
 
 # Cataloged credential lifecycle
 
-CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.
+Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan, exact metadata apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file), wrapped handoff, rotate, revoke and lifecycle, with founder-signed trust admission and a local evidence outbox.
 
 ## Reuse boundary
 
@@ -104,5 +118,7 @@ Production protected execution and independently anchored PDP authentication rem
 
 - [SCOPE.md](../../SCOPE.md)
 - [src/secrets_engine/decision_check.py](../../src/secrets_engine/decision_check.py)
+- [docs/founder-admission.md](../../docs/founder-admission.md)
+- [tools/verify_service_jwt_boundary.py](../../tools/verify_service_jwt_boundary.py)
 
-Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
+Assessment: CUST-WP-0081, 2026-10-14; summary and artifacts refreshed 2026-10-21 (maturity unchanged). Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.