Record verified live upstream issuer and completed probe cleanup

docs/assessments/2026-09-08-helixforge-factory-critical-path.md

@@ -2,7 +2,7 @@
 
 Implemented and published prerequisite corrections in ops-warden, key-cape,
 approval-engine and audit-core, followed by local runtime installation and an
-attended OpenBao capability preflight. The canonical integration workplan and next
+attended OpenBao capability preflight, then verified the actual upstream issuer. The canonical integration workplan and next
 admission sequence remain in
 [prj-helixforge-factory](/home/worsch/prj-helixforge-factory/operations/identity-admission.md).
 
@@ -25,7 +25,7 @@ RPF-WP-0035-T05 / proposed CCR-2026-0017/0018 and WARDEN-WP-0039-T03.
 The two CCRs explicitly cover verifier-side delivery only. Client-side read
 lanes and linked approval audit receiver/sender custody remain distinct returns.
 
-The immediate sequence is: verify the actual upstream ID-token issuer; obtain
+The immediate sequence is: ensure the now-verified upstream issuer is pinned; obtain
 the named custody reviews and run the contained attended first provision;
 deploy and verify KeyCape; admit audit/consumer credentials; prove deployed
 approval claim/consume and native model credential delivery. Exact policy
@@ -119,3 +119,40 @@ custody/rollout reviews. No live issuer result is inferred from preparation.
 This replaces an unspecified manual observation with a tested command and
 bounded execution packet. The current receipt is
 [key-cape/docs/evidence/upstream-issuer-probe.json](/home/worsch/key-cape/docs/evidence/upstream-issuer-probe.json).
+
+
+## Live issuer observation completed
+
+The user admitted the prepared ten-minute probe. At **2026-09-08 21:44:44 UTC**
+it verified an actual signed upstream token with issuer exactly
+**`https://auth.coulomb.social`**. Signature, audience, validity window and nonce
+checks passed. The pinned container exited 0. This closes the unknown-issuer
+observation in KEY-WP-0013-T02 and RPF-WP-0035-T05; the earlier preparation-only
+state above is superseded by this live return.
+
+Cleanup removed the dedicated route, Job/Pod, Service and both temporary network
+policies. Deletion used the recorded object UIDs; every temporary resource is
+absent. Normal KeyCape Deployment/config Secret metadata and image remained
+unchanged. The probe retained no token and issued no downstream credential.
+It did not prove downstream MFA/application login or activate custody.
+
+KeyCape `41f6916` and Platform `8f40d73` published the owner returns. Project
+`89041ec` consumes the live proof and records HFACT-DEC-2026-002 (Hub decision
+`1c0d9fd1-4790-4d9a-be6c-0ed4c4890549`). The concrete probe approval is resolved;
+its pending human-needed flag is cleared. HFACT-WP-0001-T03 remains wait for
+the configuration owner to ensure `authelia.issuer` equals the verified HTTPS
+value, named CCR-2026-0017/0018 reviews, and the admitted custody/compatible
+KeyCape rollout. Separate client-side/audit/native delivery remains open.
+
+The efficiency gain is one fewer unknown on the activation path and a retained
+repeatable check for relevant provider/configuration changes. No renewed token
+observation is needed for this unchanged proof context. Autonomous throughput,
+spend and the fourteen-day factory observation are still unproved.
+
+Final readback found stale KeyCape T02 and Platform T05 task descriptions despite
+applied repository reconciliation receipts. Both were repaired from the published
+source and verified. HFACT-WP-0001-T02 retains the underlying source/projection
+parity work; these repairs do not establish that automatic synchronization is fixed.
+
+[Live issuer and synchronization receipt](2026-09-08-helixforge-factory/live-upstream-issuer-continuation.json)
+records the proof, cleanup, source/Hub parity and progress IDs.