Read the secrets-engine-openbao client secret in memory from OpenBao

Founder direction 2026-10-06 and ops-mason plan
keycape-secrets-engine-openbao-client-custody (658cdbc): no workstation copy.
service-jwt now gets CLIENT_SECRET from platform/workloads/keycape/
secrets-engine-openbao through one attended OIDC login on
keycape-secrets-engine-openbao-operator-workload-kv-read (-no-store, token from
a pipe, header-only GET, unconditional revoke-self). The consumer file is
refused for this profile and kept for the approval client.
service-auth probe-openbao prints value-free first-use evidence.

SECRETS-WP-0012: T02 cancelled (D1-D4 superseded), T04 done, T03 is the
founder-run first live use. Synthetic tests only; 524 passed, 1 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b

src/secrets_engine/openbao.py

@@ -88,10 +88,13 @@ class ScopedTokenSession:
     closed: bool = False
     revocation_attempted: bool = False
     revocation_succeeded: bool = False
+    # Value-free evidence of the in-memory client-secret read, if any.
+    source_evidence: dict[str, object] = field(default_factory=dict)
 
     def evidence(self) -> dict[str, object]:
         """Return non-secret lifecycle evidence for this issued session."""
         return {
+            **self.source_evidence,
             "session_handle": self.accessor_fingerprint,
             "established": True,
             "revocation_attempted": self.revocation_attempted,