diff --git a/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r5/completion-audit.json b/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r5/completion-audit.json
new file mode 100644
index 0000000..398516c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/cust80-completion-r5/completion-audit.json
@@ -0,0 +1,246 @@
+{
+  "objective": "Finish what you found missing and finish CUST-WP-0080",
+  "status": "active",
+  "observed_at": "2026-10-18T09:38:12.862654+00:00",
+  "full_scope_baseline": {
+    "path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r1/completion-audit.json",
+    "sha256": "sha256:9bdee9a790db598956fe35d5954137bb4582c9f3810d2392f7ef3236c369b065",
+    "all_requirements_retained": true
+  },
+  "normative_architecture": {
+    "path": "docs/netkingdom-target-security-architecture.md",
+    "sha256": "ec2079be18c7cdb8a1e4fdbd22131c08c83721d7a1bf18b4802bc5e229520f35"
+  },
+  "acceptance_gates": [
+    {
+      "id": "TSA-01",
+      "required_outcome": "Every inventoried privileged PEP authenticates its decision",
+      "required_evidence": "PEP denominator; admitted signer/channel; forged, altered, wrong-key/pin, unsigned/downgrade, expired and rotation refusals. Start SECRETS-WP-0014.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-02",
+      "required_outcome": "Exact approval produces one bounded protected operation",
+      "required_evidence": "SECRETS-WP-0013/RPF-WP-0035-T12 native effect; Approval T01/T05 issuer/tenant provenance; wrong actor/tenant/body, expiry, replay and unavailable refusal.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-03",
+      "required_outcome": "Crashes preserve uncertainty and cleanup",
+      "required_evidence": "Actual ledger restart/concurrency, consumed-before-effect failure, target reconciliation, scoped cleanup and revocation evidence; no blind replay.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-04",
+      "required_outcome": "First reusable browser case is accepted",
+      "required_evidence": "NK-WP-0048 and named Mason/Warden/KeyCape adapters; independent native structure, sign-in/denial, delivery, revocation and rollback.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-05",
+      "required_outcome": "Human and browser consumers can use the delivered identity",
+      "required_evidence": "KEY-WP-0040/U08 real-factor recovery; User Engine journey; NK-WP-0050 and CUST-WP-0080-T05 human/agent Playwright acceptance.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-06",
+      "required_outcome": "Actual agent and runner authority is bounded",
+      "required_evidence": "CUST-WP-0073/GLAS-WP-0012 admitted runtime read-denial/tool-effect proof; Forge/Platform per-job credential and repository-workflow abuse tests.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-07",
+      "required_outcome": "Credential lifecycle is inventoried and simplified",
+      "required_evidence": "Current owner/consumer denominator, unknown/orphan findings, native-identity elimination candidates; sampled replacement/adoption/old-refusal and deletion semantics. G04/G09/G12.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-08",
+      "required_outcome": "Recovery is independent and measured",
+      "required_evidence": "NK-WP-0049 plus platform/root owners; isolated recovery with ordinary issuer unavailable, restore/reconnect/audit continuity and measured RTO/RPO. G08/G11.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-09",
+      "required_outcome": "Security effects have independently reconciled evidence",
+      "required_evidence": "Admitted source/class inventory, atomic outbox, receiver readback, lag/duplicate/boundary accounting and missing-class findings. Approval/Audit/Tenant/Secrets owners.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-10",
+      "required_outcome": "Source and delivery controls cover declared entry paths",
+      "required_evidence": "FORGE-WP-0006/RMGR-WP-0021: denominator, SSH/HTTP/UI/new repo/import/mirror coverage, required checks/provenance, private synthetic finding through resolution.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-11",
+      "required_outcome": "Discovery remains accurate",
+      "required_evidence": "All reviewed IDs exactly once, owner/index parity, usable source links, current limits/version aliases, drift checks and package-family disposition. Reuse/Repo Manager/provider owners.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-12",
+      "required_outcome": "Improvement operates without repeated manual polling",
+      "required_evidence": "CUST-WP-0079/Activity accepted schedule, unassisted firing, checkpoint and changed-state notifications; adopted cadence runtime/receiver receipts; owner change and native remeasurement.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-13",
+      "required_outcome": "Shared adapters reduce per-consumer implementation",
+      "required_evidence": "Producer-format cross-language fixtures, two real consumers, version compatibility, denied-path parity, upgrades and rollback; no second PDP.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-14",
+      "required_outcome": "Minimal profiles are independently reusable",
+      "required_evidence": "Version/provider lock, dependency and optional-provider declaration, provider adapters, second clean installation, complete positive/negative journeys and upgrade/recovery instructions.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-15",
+      "required_outcome": "Optimization improves measured operations",
+      "required_evidence": "Baseline and repeat measurements of onboarding time/touches, p50/p95 decision/effect latency, scanner throughput/failure, resources/headroom and owner effort with unchanged control coverage.",
+      "status": "incomplete",
+      "completion_evidence": []
+    },
+    {
+      "id": "TSA-16",
+      "required_outcome": "Governance and exceptions remain truthful",
+      "required_evidence": "Existing SEC-DSM ledger and close-down controls reconciled to exact evidence; real authority for changes, explicit residual promotions, preserved deferrals and no invented owner assent.",
+      "status": "incomplete",
+      "completion_evidence": []
+    }
+  ],
+  "sec_dsm_requirements": {
+    "path": "docs/evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json",
+    "sha256": "sha256:ad81f7186ada04aa1cc410932fc8669d69dc2232f3c0be00657b17f3aa3a8184",
+    "count": 116,
+    "status_counts": {
+      "unverified": 84,
+      "incomplete": 12,
+      "reference": 20
+    },
+    "closure_status_unchanged": true
+  },
+  "gap_ids": [
+    "G01",
+    "G02",
+    "G03",
+    "G04",
+    "G05",
+    "G06",
+    "G07",
+    "G08",
+    "G09",
+    "G10",
+    "G11",
+    "G12",
+    "G13"
+  ],
+  "separate_required_deliverables": [
+    "G01-G13 current closure evidence or already applicable approved exceptions",
+    "SEC-DSM requirement ledger reconciled with exact evidence",
+    "T05 real human and agent Playwright acceptance and supported discovery",
+    "Second real consumer and clean installation proves reuse",
+    "Residual handoffs before workplan finish; no required work left only in prose"
+  ],
+  "source_progress": {
+    "packet": "docs/changes/netkingdom-target-2026-10-18/forgejo-postgres-source-r1",
+    "producer_source_commit": "git:ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
+    "consumer_owner_commit": "git:308e83fcfbf9ec98dbe6b0286cbe8ec7be8899b3",
+    "consumer_paths": 40,
+    "patch_sha256": "sha256:feb1079399a43989742ae0a946c1ada50113d1821e6541f97f0b5592ee1fc20c",
+    "postgreSQL_test_subtest_passes": 37,
+    "database_schema_profiles": [
+      "default",
+      "explicit-public",
+      "named"
+    ],
+    "separate_client_crash_recovery": true,
+    "actual_database_server_restart_recovery": true,
+    "controlled_missing_lock_and_private_marker_counterexamples": true,
+    "following_query_hook_context_panic_corrected": true,
+    "selected_composed_passes_including_subtests": 94,
+    "source_skips": 0,
+    "release": {
+      "frontend_and_static_backend": "passed",
+      "release_version": "11.0.3+cust80.feb10793",
+      "binary_sha256": "sha256:92efb26614d3fca22c400920d92c4cd022e32ab86c1f562f60699ab5f750cd28",
+      "embedded_assets_exact": 2234,
+      "actual_release_CLI_checks": 48,
+      "exact_local_OCI_exports": 2,
+      "manifest": "sha256:9d127b0a75d3d53b1598e7f380dce29f23f42c2e69056fdfc9a42122d98c41c7",
+      "native_admission": false
+    },
+    "independent_owner_assent": false,
+    "production_database": false,
+    "native_gates_closed": 0
+  },
+  "current_work": "Integrate the published shared current-token client into actual NK48/Apps current operation/inverse and ongoing resource paths, preserving owner policy/approval/effect bindings. Independent issuer profile and package/custody admission, every-release-writer exclusion, private journal custody/retention and all sixteen native gates remain open. Full G01-G13 and 116-entry ledger retained.",
+  "workplan_finished": false,
+  "goal_complete": false,
+  "preceding_audit": {
+    "path": "docs/changes/netkingdom-target-2026-10-18/cust80-completion-r4/completion-audit.json",
+    "sha256": "sha256:8a4e3e61f3639a31d9d5df7803d3cb420eb391b191894e209d62b9e3100d5127"
+  },
+  "issuer_source_progress": {
+    "packet": "docs/changes/netkingdom-target-2026-10-18/keycape-token-status-r1",
+    "base_revision": "git:d803e9282a47b49daf930fb905312fa5104c0ace",
+    "scope": "proposed opt-in extension in the existing issuer",
+    "source_delta_paths": 18,
+    "complete_race_passes_including_subtests": 659,
+    "existing_native_external_skips": 6,
+    "new_token_status_passes_including_subtests": 43,
+    "actual_built_server_process_checks": 26,
+    "actual_process_restart": true,
+    "actual_handler_HTTPS_PKCE_status_revocation": true,
+    "controlled_revocation_guard_omission_failed_checks": 7,
+    "independent_owner_assent": false,
+    "native_admission": false,
+    "gates_closed": 0,
+    "owner_identifier_reconciliation": "existing exact historical reference restored using official consistency injection helper; new canonical records assigned by normal Repo Manager; no replacement existing UUID",
+    "consumer_owner_commit": "git:67a0869c1ee40c9e00a60cb7c1d828734d5d3d32",
+    "owner_primary_projection_verified": true,
+    "owner_workplan": "KEY-WP-0042",
+    "owner_workplan_status": "proposed",
+    "owner_tasks": {
+      "T01": "progress",
+      "T02": "done",
+      "T03": "todo"
+    },
+    "source_task_complete_only": true
+  },
+  "shared_client_source_progress": {
+    "packet": "docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1",
+    "issuer_commit": "git:08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+    "warden_commit": "git:08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+    "complete_issuer_race_passes_including_subtests": 724,
+    "existing_native_external_skips": 6,
+    "warden_canonical_unit_passes": 796,
+    "warden_deselected": 4,
+    "built_cross_owner_fixture_assertions": 45,
+    "owner_processes": 2,
+    "generated_go_consumer_processes": 4,
+    "exact_source_delta_replay_paths": 23,
+    "single_generated_producer_export_and_drift_refusal": true,
+    "independent_owner_assent": false,
+    "native_admission": false,
+    "second_real_consumer": false,
+    "native_gates_closed": 0,
+    "both_owner_primary_projections_verified": true
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/README.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/README.md
new file mode 100644
index 0000000..c8e9b26
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/README.md
@@ -0,0 +1,78 @@
+# Shared current-token client and fresh-session inverse source
+
+KeyCape source `08c083bae9ff35fbaf028c36d72a95b57d2541b7` provides one
+issuer-owned current-token client, its generated Go export and the existing
+executable's private current/revoke/inactive commands. Warden source
+`08c098e64a9afd89e43f65436782ed2bb69cdfbd` keeps original dispatch provenance
+while authenticating a fresh caller session for an exact existing run/inverse.
+These are source changes under the existing owner plans; neither deploys the
+proposed online issuer profile nor admits any operation, signer or credential.
+
+## Behavior and ownership
+
+The client verifies signed token identity before reading its private client
+credential, performs a fresh HTTPS introspection, joins signed/status metadata,
+then checks lifetime and reloads signing trust after the response. It uses explicit
+CA/JWKS/client admission, bounded I/O, no redirects or environment proxy, no cached
+positive, and rereads credential/trust files. The CLI binds an owner-supplied exact
+token digest and writes exclusive private observations outside Git. Inactivity is
+explicitly scoped to the configured client; original ownership is separately
+required before treating that negative as cleanup. Authentication assurance,
+current groups, operation policy, approval and effects retain their existing owners.
+
+The generated five-file public adapter contains the same authored client and JOSE
+bytes. Only the client's first package declaration changes. Both ordinary tests
+and the export checker reject drift. A controlled consumer-only mutation fails
+that checker. The current file profile is Linux/POSIX; no Windows ACL acceptance
+or independent Go 1.23 compiler run is claimed.
+
+Warden's optional `original_session_reference` is an immutable reference, never
+current authentication. Readmission requires the original exact journal/intent,
+caller/owner/target/source and pins. The fresh session is revalidated before
+journal writes and callbacks. Missing/orphaned intents, changed principal/reference,
+revoked current sessions, business replay and uncertain-effect retries refuse.
+Default admission behavior and receipt schemas are unchanged. This does not
+provide Apps' native evidence verifier or exclusion of external release writers.
+
+## Evidence
+
+| Check | Result and scope |
+| --- | --- |
+| Final KeyCape full race suite | 724 passing test/subtest results; six existing external/native skips, listed in `full-attempt2.json` |
+| Focused current-client/CLI suite | 63 passing results without skips, before the separately added human PKCE test |
+| Warden canonical guarded full suite | 796 passed, four deselected; actual Git metadata, empty HOME/credential guard |
+| Built CLI + actual issuer + Warden | One integration test; 45 owner assertions in two actual Python owner processes; actual HTTPS handlers, private SQLite and disposable file effect |
+| Generated standalone Go consumer | Four separate processes independently accept each current token and refuse it after revocation |
+| Replay and equivalence | All 19 KeyCape and four Warden delta postimages replay exactly with fuzz zero; all unrelated archived files unchanged; 54 integration production Go/module files, generated adapter and Warden runtime match |
+| Export counterexample | Unmodified export passes; one consumer-only change produces the intended drift refusal |
+
+`owner-boundary-result.json` explicitly records **native_acceptance=false**.
+The fixture's admissions, case/catalog/owner attestations and target are synthetic.
+Its tokens, client secret and private TLS/signing inputs stay inside fixture
+memory/tmpfs; no real credential, browser, user factor, Forgejo DB or release is
+used. It is not the required second real application or installation proof.
+
+Earlier results remain intact: the first CLI fixture had two failures because
+its temporary parent directory did not meet the required 0700 mode; the corrected
+fixture passes without weakening production checks. The archive Warden full run
+had one generated-artifact metadata failure because `git archive` has no history.
+The actual checkout preserves the correct artifact and passes. The original
+Warden API does not support fresh-session provenance and failed the new checks;
+that refusal is retained. The initial publication attempt lacked owner-index
+filesystem permission; exact approved staging and ordinary hooks were then used.
+
+## Records and remaining acceptance
+
+KEY-WP-0042-T04 records this source deliverable. Its existing T01 independent
+profile review and T03 native admission remain open. WARDEN-WP-0044-T03 remains
+progress; Apps RAPPS-WP-0016-T08/T09 and NK-WP-0048-T34/T42/T43 retain actual
+initiating/inverse identity, effect/approval integration, ongoing HTTP/API/Git/SSH,
+private journal custody/retention and every-release-writer exclusion. No catalog
+lane was activated. The knowledge pilot was reloaded: version 0.2.6, digest
+`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`,
+withheld for changed sources; current owner source/contracts were reviewed.
+
+The full CUST-WP-0080 scope remains sixteen acceptance gates, G01–G13 and the
+116-entry requirement ledger. This source result closes no native target gate.
+Owner application/publication receipts accompany the packet; private publication
+backups are operational workspace artifacts and are not part of the source capsule.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/apply_keycape.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/apply_keycape.py
new file mode 100644
index 0000000..843fd3f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/apply_keycape.py
@@ -0,0 +1,44 @@
+"""Apply the exact replayed shared client source to its existing owner."""
+from pathlib import Path
+import hashlib
+import json
+import re
+import subprocess
+
+HERE = Path(__file__).resolve().parent
+ROOT = Path('/home/worsch/key-cape')
+manifest = json.loads((HERE / 'key-cape-source/source-manifest.json').read_text())
+sha = lambda raw: 'sha256:' + hashlib.sha256(raw).hexdigest()
+def git(*args):
+    return subprocess.check_output(['git', '-C', str(ROOT), *args], text=True, timeout=40).strip()
+base = manifest['base_revision'].removeprefix('git:')
+assert git('rev-parse', 'HEAD') == base
+assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == base
+assert not git('diff', '--name-only', 'HEAD'), 'preserve preexisting tracked changes'
+paths = {row['path'] for row in manifest['files']}
+protected = {name: {'sha256': sha((ROOT / name).read_bytes()), 'index': git('ls-files', '--stage', '--', name)}
+             for name in git('ls-files').splitlines() if name not in paths and (ROOT / name).is_file()}
+plan = 'workplans/KEY-WP-0042-online-access-token-status.md'
+before = re.findall(r'```task\n.*?```', (ROOT / plan).read_text(), re.S)
+for row in manifest['files']:
+    file = ROOT / row['path']
+    assert (not file.exists()) if row['before_sha256'] is None else sha(file.read_bytes()) == row['before_sha256'], row['path']
+    assert sha((HERE / 'key-cape-source/postimages' / row['path']).read_bytes()) == row['sha256'], row['path']
+for row in manifest['files']:
+    file = ROOT / row['path']; file.parent.mkdir(parents=True, exist_ok=True)
+    file.write_bytes((HERE / 'key-cape-source/postimages' / row['path']).read_bytes())
+assert re.findall(r'```task\n.*?```', (ROOT / plan).read_text(), re.S)[:len(before)] == before
+for name, row in protected.items():
+    assert sha((ROOT / name).read_bytes()) == row['sha256']
+    assert git('ls-files', '--stage', '--', name) == row['index']
+out = HERE / 'keycape-application'; out.mkdir(exist_ok=False)
+(out / 'protected.json').write_text(json.dumps(protected, indent=2) + '\n')
+receipt = {'status': 'source-applied', 'owner': 'key-cape', 'files': len(paths),
+           'existing_task_blocks_preserved': len(before), 'new_source_only_task': 'KEY-WP-0042-T04',
+           'all_other_tracked_files_and_index_preserved': True, 'native_admission': False}
+(out / 'application.json').write_text(json.dumps(receipt, indent=2) + '\n')
+publication = {'owner': 'key-cape', 'base_revision': base,
+               'message': 'Share current-token verification and scoped cleanup through one producer client',
+               'files': [{'path': row['path'], 'sha256': row['sha256'].removeprefix('sha256:')} for row in manifest['files']]}
+(out / 'publication-inputs.json').write_text(json.dumps(publication, indent=2) + '\n')
+print(json.dumps(receipt))
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/apply_warden.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/apply_warden.py
new file mode 100644
index 0000000..2732a77
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/apply_warden.py
@@ -0,0 +1,36 @@
+"""Apply the exact tested source delta; never touch owner catalog or credentials."""
+from pathlib import Path
+import hashlib
+import json
+import re
+import subprocess
+
+HERE=Path(__file__).resolve().parent/'warden-application'
+ROOT=Path('/home/worsch/ops-warden')
+cfg=json.loads((HERE/'manifest.json').read_text())
+def git(*args): return subprocess.check_output(['git','-C',str(ROOT),*args],text=True,timeout=40).strip()
+sha=lambda raw:'sha256:'+hashlib.sha256(raw).hexdigest()
+assert git('rev-parse','HEAD')==cfg['base_revision']
+assert git('ls-remote','origin','refs/heads/main').split()[0]==cfg['base_revision']
+assert set(git('diff','--name-only','HEAD').splitlines())<={'.custodian-brief.md','WORK-RECORDS.md'}
+plan='workplans/WARDEN-WP-0044-security-case-follow-through.md'
+before=re.findall(r'```task\n.*?```',(ROOT/plan).read_text(),re.S)
+for row in cfg['files']:
+    file=ROOT/row['path']
+    assert (not file.exists()) if row['before_sha256'] is None else sha(file.read_bytes())==row['before_sha256']
+    assert sha(Path(row['source']).read_bytes())==row['sha256']
+for row in cfg['files']:
+    file=ROOT/row['path'];file.parent.mkdir(parents=True,exist_ok=True);file.write_bytes(Path(row['source']).read_bytes())
+assert re.findall(r'```task\n.*?```',(ROOT/plan).read_text(),re.S)==before
+for name,row in cfg['protected'].items():
+    assert sha((ROOT/name).read_bytes())==row['sha256'],name
+    assert git('ls-files','--stage','--',name)==row['index'],name
+receipt={'status':'source-applied','owner':'ops-warden','files':len(cfg['files']),
+         'original_task_blocks_preserved':len(before),'other_tracked_files_and_index_preserved':True,
+         'catalog_or_generated_artifact_changed':False,'native_authority':False}
+(HERE/'application.json').write_text(json.dumps(receipt,indent=2)+'\n')
+publication={'owner':'ops-warden','base_revision':cfg['base_revision'],
+             'message':'Keep original case provenance while revalidating a fresh caller session',
+             'files':[{'path':r['path'],'sha256':r['sha256'].removeprefix('sha256:')} for r in cfg['files']]}
+(HERE/'publication-inputs.json').write_text(json.dumps(publication,indent=2)+'\n')
+print(json.dumps(receipt))
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/baseline.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/baseline.json
new file mode 100644
index 0000000..f21ed7a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/baseline.json
@@ -0,0 +1,7 @@
+{
+  "owner": "key-cape",
+  "commit": "git:67a0869c1ee40c9e00a60cb7c1d828734d5d3d32",
+  "archive_sha256": "sha256:c1d5701e59068d30e53db22cbf4fcf5ec021371c515ba31efd0aeb5daa23f4b0",
+  "workspace": "/tmp/custodian-keycape-current-client-r1/source",
+  "native_authority": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/build-attempt1.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/build-attempt1.json
new file mode 100644
index 0000000..dfca7f0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/build-attempt1.json
@@ -0,0 +1,212 @@
+{
+  "returncode": 0,
+  "seconds": 1.74,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-integration-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "build",
+    "-o",
+    "/work/keycape-candidate",
+    "./cmd/keycape"
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a",
+    "src/internal/authclient/online_export_test.go": "sha256:5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f",
+    "src/internal/authclient/online_test.go": "sha256:6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a",
+    "src/internal/authclient/current_owner_fixture_test.go": "sha256:e41d0b56e8e9cc4cc7604ae6a84eec145870005697c3e97f2d86d92bdf8eb87d",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 0,
+    "fail": 0,
+    "skip": 0
+  },
+  "failures": [],
+  "skips": [],
+  "source": "/tmp/custodian-keycape-current-client-integration-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/build-attempt1.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/build-attempt1.jsonl
new file mode 100644
index 0000000..e69de29
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/consumer-build-attempt1.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/consumer-build-attempt1.json
new file mode 100644
index 0000000..75f0da0
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/consumer-build-attempt1.json
@@ -0,0 +1,212 @@
+{
+  "returncode": 0,
+  "seconds": 0.83,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-integration-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/consumer",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "build",
+    "-o",
+    "/work/tokenstatus-consumer",
+    "."
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a",
+    "src/internal/authclient/online_export_test.go": "sha256:5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f",
+    "src/internal/authclient/online_test.go": "sha256:6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a",
+    "src/internal/authclient/current_owner_fixture_test.go": "sha256:e41d0b56e8e9cc4cc7604ae6a84eec145870005697c3e97f2d86d92bdf8eb87d",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 0,
+    "fail": 0,
+    "skip": 0
+  },
+  "failures": [],
+  "skips": [],
+  "source": "/tmp/custodian-keycape-current-client-integration-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/consumer-build-attempt1.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/consumer-build-attempt1.jsonl
new file mode 100644
index 0000000..e69de29
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/current_session_owner.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/current_session_owner.py
new file mode 100644
index 0000000..7f82ace
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/current_session_owner.py
@@ -0,0 +1,165 @@
+"""Synthetic owner admissions/effect; actual issuer client and Warden kernel.
+
+Runs only inside the private cross-owner fixture. No production case, catalog,
+owner assent, application mutation, grant, credential or execution admission.
+"""
+from dataclasses import asdict
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+import uuid
+
+import yaml
+from warden.case_receipt_state import Outcome, Refused
+from warden.case_run import Adapter, Descriptor, Executor, Journal, OwnerResult, digest
+
+cfg = json.loads(Path(sys.argv[1]).read_text())
+phase = sys.argv[2]
+base = Path(cfg['directory'])
+assert base.is_relative_to('/tmp')
+base.mkdir(exist_ok=True, mode=0o700)
+target = base / 'fixture-target.json'
+records_file = base / 'fixture-owner-records.json'
+records = json.loads(records_file.read_text()) if records_file.exists() else {'checked': {}, 'closed': {}, 'calls': []}
+checks = []
+
+def check(name, condition):
+    checks.append({'check': name, 'passed': bool(condition)})
+    if not condition:
+        raise AssertionError(name)
+
+def save():
+    records_file.write_text(json.dumps(records))
+    records_file.chmod(0o600)
+
+def cli(mode, reference):
+    entry = cfg['sessions'][reference]
+    output = base / ('observation-' + uuid.uuid4().hex + '.json')
+    command = [cfg['binary'], mode, '--admission-file', cfg['admission'],
+               '--token-file', entry['file'], '--token-sha256', entry['digest'], '--out', str(output)]
+    if mode == 'check-current-token':
+        command += ['--subject', cfg['subject'], '--tenant', cfg['tenant'], '--principal-type', 'service']
+    result = subprocess.run(command, capture_output=True, timeout=20)
+    if result.returncode:
+        check('failed_client_removes_observation', not output.exists())
+        return None
+    value = json.loads(output.read_text())
+    check('observation_private', output.stat().st_mode & 0o777 == 0o600)
+    if mode == 'check-current-token':
+        current = value['current']
+        check('current_expected_identity', current['subject'] == cfg['subject'] and current['tenant'] == cfg['tenant'])
+        check('current_exact_token', current['token_sha256'] == entry['digest'])
+        # Checked timestamps change. Retain immutable identity/token facts only.
+        immutable = {k:v for k,v in current.items() if k != 'checked_at'}
+        previous = records['checked'].get(reference)
+        if previous is not None:
+            check('original_token_facts_stable', {k:v for k,v in previous.items() if k != 'checked_at'} == immutable)
+        records['checked'][reference] = current
+        if reference == 'inverse':
+            check('inverse_is_distinct_grant', current['jti'] != records['checked']['initial']['jti'])
+        save()
+    else:
+        inactive = value['inactive_for_client']
+        check('negative_exact_client_and_token', inactive['client_id'] == cfg['client_id'] and inactive['token_sha256'] == entry['digest'])
+        # Negative status cannot establish original ownership on its own.
+        check('prior_positive_ownership_required', reference in records['checked'])
+    return value
+
+descriptor = Descriptor('warden.case.execution.v1', 'fixture-change', 'fixture-owner',
+                        'fixture-owner/change@v1', digest(Path(__file__).read_bytes()),
+                        'agent', 'fixture-lane', 'target_id', 'change', ('fixture-state',),
+                        False, ('parent-session',))
+descriptor_bytes = json.dumps(asdict(descriptor)).encode()
+type_bytes = yaml.safe_dump({'spec': {'id': 'current-session-fixture', 'version': '1',
+    'status': 'acknowledged', 'parameters': [{'name':'target_id','sensitivity':'operational','case_settable':True}],
+    'execution_descriptors': {'fixture-change':digest(descriptor_bytes)},
+    'follow_through': [{'id':'fixture-change','owner':'fixture-owner','lane':'fixture-lane','warden_executes':False,'attended':False}]}}).encode()
+case_bytes = yaml.safe_dump({'spec': {'id':'fixture-case','type':'current-session-fixture@1',
+    'status':'materialized','acceptance':'fixture-acceptance','parameters':{'target_id':'fixture-target'}}}).encode()
+catalog_bytes = yaml.safe_dump({'entries':[{'id':'fixture-lane','title':'fixture only','need_keywords':['fixture'],
+    'owner_repo':'fixture-owner','subsystem':'fixture','warden_executes':False,
+    'wiki_ref':'wiki/fixture.md','canon_ref':'fixture/canon.md','reviewed':'2026-10-18',
+    'status':'active','risk':'high','workload_ref':{'applicability':'not-applicable','reason':'synthetic fixture'},
+    'delegation':{'mode':'native','intended_owner':'fixture-owner','reviewed':'2026-10-18'}}]}).encode()
+accepted = {('case-acceptance',digest(case_bytes),'fixture-acceptance'),
+            ('ops-mason-materialization',digest(case_bytes),'fixture-materialization'),
+            ('owner-descriptor-acceptance:fixture-owner',digest(descriptor_bytes),'fixture-descriptor'),
+            ('type-machine-seam-acceptance',digest(type_bytes),'fixture-descriptor'),
+            ('catalog-routing-acceptance',digest(catalog_bytes),'fixture-descriptor')}
+active_reference = 'initial' if phase == 'run' else 'inverse'
+
+def verify(purpose, source, evidence):
+    if purpose == 'caller-session:agent:fixture-operator:fixture-lane':
+        return source == digest(case_bytes) and evidence in cfg['sessions'] and cli('check-current-token', evidence) is not None
+    if purpose.startswith('session-revocation:'):
+        parts = purpose.split(':')
+        if len(parts) != 4 or source != digest(case_bytes):
+            return False
+        _, lane, operation, attempt = parts
+        record = records['closed'].get(attempt)
+        return (lane == 'fixture-lane' and record is not None and record['operation'] == operation
+                and evidence == 'closed-' + attempt
+                and cli('check-inactive-token', record['reference']) is not None)
+    return (purpose,source,evidence) in accepted
+
+def effect(invocation, *, inverse=False):
+    records['calls'].append(invocation.operation)
+    expected = b'{"fixture":"after"}' if inverse else b'{"fixture":"before"}'
+    check('exact_fixture_before', target.read_bytes() == expected)
+    target.write_bytes(b'{"fixture":"before"}' if inverse else b'{"fixture":"after"}')
+    check('actual_parent_cleanup', cli('revoke-token', active_reference) is not None)
+    records['closed'][invocation.attempt_id] = {'reference':active_reference,'operation':invocation.operation}
+    save()
+    return OwnerResult(Outcome.ROLLED_BACK if inverse else Outcome.SUCCESS,
+                       'fixture-result-' + invocation.attempt_id, () if inverse else ('fixture-state',), True,
+                       session_revocation_evidence='closed-' + invocation.attempt_id,
+                       attempt_id=invocation.attempt_id, operation=invocation.operation)
+
+adapter = Adapter(descriptor.adapter, descriptor.adapter_source, effect,
+    lambda inv,result: result.evidence == 'fixture-result-' + inv.attempt_id,
+    lambda inv,objects: effect(inv,inverse=True))
+executor = Executor(Journal(base/'journal'), {adapter.reference:adapter}, verify)
+kwargs = dict(principal='fixture-operator',actor='agent',lane='fixture-lane',
+              acceptance_evidence='fixture-acceptance',materialization_evidence='fixture-materialization',
+              descriptor_evidence='fixture-descriptor',session_evidence=active_reference)
+sources = (case_bytes,type_bytes,descriptor_bytes,catalog_bytes)
+
+def row_counts():
+    return tuple(executor.journal.db.execute(f'SELECT COUNT(*) FROM {table}').fetchone()[0] for table in ('receipts','intents'))
+
+if phase == 'run':
+    target.write_bytes(b'{"fixture":"before"}')
+    admitted = executor.admit(*sources,**kwargs)
+    check('actual_guarded_run', executor.run(*admitted).last.outcome is Outcome.SUCCESS)
+    before = row_counts()
+    try:
+        executor.rollback(*admitted)
+        raise AssertionError('revoked original session reused')
+    except Refused:
+        pass
+    check('revoked_parent_no_journal_or_callback', row_counts() == before and records['calls'] == ['run'])
+    records['pins'] = asdict(admitted[1].pins)
+    save()
+elif phase == 'inverse':
+    admitted = executor.admit(*sources,**kwargs,original_session_reference='initial')
+    check('fresh_process_original_pins_preserved', asdict(admitted[1].pins) == records['pins'])
+    before = row_counts()
+    try:
+        executor.run(*admitted)
+        raise AssertionError('consumed run replayed')
+    except Refused:
+        pass
+    check('readmission_no_business_replay', records['calls'] == ['run'] and row_counts() == before)
+    check('actual_guarded_inverse', executor.rollback(*admitted).last.outcome is Outcome.ROLLED_BACK)
+    check('exact_fixture_restore', target.read_bytes() == b'{"fixture":"before"}')
+    check('exact_callback_denominator', records['calls'] == ['run','rollback'])
+else:
+    raise AssertionError('unknown fixture phase')
+
+result = {'phase':phase,'checks':checks,'caller_status_and_cleanup':'actual producer CLI/HTTPS issuer',
+          'case_catalog_owner_acceptance_and_target':'synthetic fixture only','native_acceptance':False,
+          'source_kernel':'actual Warden Executor/Journal','original_journal_pins':records.get('pins')}
+(base/(phase+'-result.json')).write_text(json.dumps(result))
+print(json.dumps({'phase':phase,'checks':len(checks),'passed':True,'native_acceptance':False}))
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt1.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt1.json
new file mode 100644
index 0000000..771e78d
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt1.json
@@ -0,0 +1,213 @@
+{
+  "returncode": 0,
+  "seconds": 11.61,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "test",
+    "-p",
+    "4",
+    "-race",
+    "-json",
+    "-count=1",
+    "-run",
+    "^TestOnline",
+    "./internal/authclient"
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:376a8e0d1d60825a8b3ef21d371e3fc353c0a34e461712a6899e264278edbe7f",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:ec8b05b2692d5ff7bf18f22e1e627dea190b97b67617f85f320d89fb601f3165",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_test.go": "sha256:2c5e0c117afe9614cb396c9de1ae52cb000cc57256589d949ed8445f35b3e131",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:2f81ea0b0b33f38298e028d5610625e3834fdf1aa12f6f392579d6207bcf6f1d",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 49,
+    "fail": 0,
+    "skip": 0
+  },
+  "failures": [],
+  "skips": [],
+  "source": "/tmp/custodian-keycape-current-client-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt1.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt1.jsonl
new file mode 100644
index 0000000..ff543b4
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt1.jsonl
@@ -0,0 +1,200 @@
+{"Time":"2026-10-18T08:39:37.99716038Z","Action":"start","Package":"keycape/internal/authclient"}
+{"Time":"2026-10-18T08:39:38.184498962Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant"}
+{"Time":"2026-10-18T08:39:38.184552136Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"=== RUN   TestOnlineActualIssuerCurrentRevocationAndFreshGrant\n"}
+{"Time":"2026-10-18T08:39:38.538111017Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"--- PASS: TestOnlineActualIssuerCurrentRevocationAndFreshGrant (0.35s)\n"}
+{"Time":"2026-10-18T08:39:38.538277656Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Elapsed":0.35}
+{"Time":"2026-10-18T08:39:38.53926584Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork"}
+{"Time":"2026-10-18T08:39:38.539312504Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork\n"}
+{"Time":"2026-10-18T08:39:38.540390952Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject"}
+{"Time":"2026-10-18T08:39:38.540458058Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/subject\n"}
+{"Time":"2026-10-18T08:39:38.641619818Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/subject (0.10s)\n"}
+{"Time":"2026-10-18T08:39:38.641685427Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Elapsed":0.1}
+{"Time":"2026-10-18T08:39:38.642302306Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant"}
+{"Time":"2026-10-18T08:39:38.64232943Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant\n"}
+{"Time":"2026-10-18T08:39:38.870252614Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant (0.23s)\n"}
+{"Time":"2026-10-18T08:39:38.870309693Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Elapsed":0.23}
+{"Time":"2026-10-18T08:39:38.870322056Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal"}
+{"Time":"2026-10-18T08:39:38.870325798Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/principal\n"}
+{"Time":"2026-10-18T08:39:38.922103472Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/principal (0.05s)\n"}
+{"Time":"2026-10-18T08:39:38.922145962Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Elapsed":0.05}
+{"Time":"2026-10-18T08:39:38.922155872Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience"}
+{"Time":"2026-10-18T08:39:38.922160525Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/audience\n"}
+{"Time":"2026-10-18T08:39:38.978015222Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/audience (0.06s)\n"}
+{"Time":"2026-10-18T08:39:38.978223978Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Elapsed":0.06}
+{"Time":"2026-10-18T08:39:38.978688286Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer"}
+{"Time":"2026-10-18T08:39:38.978703679Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer\n"}
+{"Time":"2026-10-18T08:39:39.024596844Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer (0.05s)\n"}
+{"Time":"2026-10-18T08:39:39.024676168Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Elapsed":0.05}
+{"Time":"2026-10-18T08:39:39.025032373Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper"}
+{"Time":"2026-10-18T08:39:39.025094701Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper\n"}
+{"Time":"2026-10-18T08:39:39.133459839Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper (0.11s)\n"}
+{"Time":"2026-10-18T08:39:39.133620175Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Elapsed":0.11}
+{"Time":"2026-10-18T08:39:39.133955256Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key"}
+{"Time":"2026-10-18T08:39:39.133974652Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/key\n"}
+{"Time":"2026-10-18T08:39:39.338044993Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/key (0.20s)\n"}
+{"Time":"2026-10-18T08:39:39.338091044Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Elapsed":0.2}
+{"Time":"2026-10-18T08:39:39.338101964Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti"}
+{"Time":"2026-10-18T08:39:39.338106995Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti\n"}
+{"Time":"2026-10-18T08:39:39.416123973Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti (0.08s)\n"}
+{"Time":"2026-10-18T08:39:39.416179754Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Elapsed":0.08}
+{"Time":"2026-10-18T08:39:39.416193235Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token"}
+{"Time":"2026-10-18T08:39:39.416201414Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token\n"}
+{"Time":"2026-10-18T08:39:39.551301694Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token (0.14s)\n"}
+{"Time":"2026-10-18T08:39:39.551350198Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Elapsed":0.14}
+{"Time":"2026-10-18T08:39:39.551364174Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale"}
+{"Time":"2026-10-18T08:39:39.551371181Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/stale\n"}
+{"Time":"2026-10-18T08:39:39.64156505Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/stale (0.09s)\n"}
+{"Time":"2026-10-18T08:39:39.641618531Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Elapsed":0.09}
+{"Time":"2026-10-18T08:39:39.641635006Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork (1.10s)\n"}
+{"Time":"2026-10-18T08:39:39.641813782Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Elapsed":1.1}
+{"Time":"2026-10-18T08:39:39.641833331Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus"}
+{"Time":"2026-10-18T08:39:39.641840527Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus\n"}
+{"Time":"2026-10-18T08:39:39.642070359Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active"}
+{"Time":"2026-10-18T08:39:39.642085877Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active\n"}
+{"Time":"2026-10-18T08:39:39.830709325Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active (0.19s)\n"}
+{"Time":"2026-10-18T08:39:39.830759281Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Elapsed":0.19}
+{"Time":"2026-10-18T08:39:39.830773835Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type"}
+{"Time":"2026-10-18T08:39:39.830780471Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type\n"}
+{"Time":"2026-10-18T08:39:39.958450053Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type (0.13s)\n"}
+{"Time":"2026-10-18T08:39:39.958511948Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Elapsed":0.13}
+{"Time":"2026-10-18T08:39:39.958532516Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope"}
+{"Time":"2026-10-18T08:39:39.958557034Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope\n"}
+{"Time":"2026-10-18T08:39:40.114440325Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope (0.16s)\n"}
+{"Time":"2026-10-18T08:39:40.114529127Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Elapsed":0.16}
+{"Time":"2026-10-18T08:39:40.114560093Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope"}
+{"Time":"2026-10-18T08:39:40.11457388Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope\n"}
+{"Time":"2026-10-18T08:39:40.651806831Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope (0.54s)\n"}
+{"Time":"2026-10-18T08:39:40.65185566Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Elapsed":0.54}
+{"Time":"2026-10-18T08:39:40.651877734Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client"}
+{"Time":"2026-10-18T08:39:40.651883847Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client\n"}
+{"Time":"2026-10-18T08:39:40.861724914Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client (0.21s)\n"}
+{"Time":"2026-10-18T08:39:40.861767331Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Elapsed":0.21}
+{"Time":"2026-10-18T08:39:40.861780848Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject"}
+{"Time":"2026-10-18T08:39:40.861786429Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject\n"}
+{"Time":"2026-10-18T08:39:41.166881603Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject (0.30s)\n"}
+{"Time":"2026-10-18T08:39:41.1669431Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Elapsed":0.3}
+{"Time":"2026-10-18T08:39:41.167063742Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer"}
+{"Time":"2026-10-18T08:39:41.167105446Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer\n"}
+{"Time":"2026-10-18T08:39:41.28097308Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer (0.11s)\n"}
+{"Time":"2026-10-18T08:39:41.281059285Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Elapsed":0.11}
+{"Time":"2026-10-18T08:39:41.281080746Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience"}
+{"Time":"2026-10-18T08:39:41.281096896Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience\n"}
+{"Time":"2026-10-18T08:39:41.390033435Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience (0.11s)\n"}
+{"Time":"2026-10-18T08:39:41.390102282Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Elapsed":0.11}
+{"Time":"2026-10-18T08:39:41.390127756Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti"}
+{"Time":"2026-10-18T08:39:41.390133761Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti\n"}
+{"Time":"2026-10-18T08:39:41.52415106Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti (0.13s)\n"}
+{"Time":"2026-10-18T08:39:41.524195046Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Elapsed":0.13}
+{"Time":"2026-10-18T08:39:41.524203486Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry"}
+{"Time":"2026-10-18T08:39:41.524207526Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry\n"}
+{"Time":"2026-10-18T08:39:41.651950286Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry (0.13s)\n"}
+{"Time":"2026-10-18T08:39:41.651996517Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Elapsed":0.13}
+{"Time":"2026-10-18T08:39:41.652008555Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued"}
+{"Time":"2026-10-18T08:39:41.652084742Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued\n"}
+{"Time":"2026-10-18T08:39:41.739320835Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued (0.09s)\n"}
+{"Time":"2026-10-18T08:39:41.739370962Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Elapsed":0.09}
+{"Time":"2026-10-18T08:39:41.739384668Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope"}
+{"Time":"2026-10-18T08:39:41.739390755Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope\n"}
+{"Time":"2026-10-18T08:39:41.861563507Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope (0.12s)\n"}
+{"Time":"2026-10-18T08:39:41.861613175Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Elapsed":0.12}
+{"Time":"2026-10-18T08:39:41.861620605Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type"}
+{"Time":"2026-10-18T08:39:41.861625086Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type\n"}
+{"Time":"2026-10-18T08:39:42.449018038Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type (0.59s)\n"}
+{"Time":"2026-10-18T08:39:42.44906252Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Elapsed":0.59}
+{"Time":"2026-10-18T08:39:42.44907124Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field"}
+{"Time":"2026-10-18T08:39:42.449076001Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field\n"}
+{"Time":"2026-10-18T08:39:42.68130071Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field (0.23s)\n"}
+{"Time":"2026-10-18T08:39:42.681343713Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Elapsed":0.23}
+{"Time":"2026-10-18T08:39:42.681354516Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active"}
+{"Time":"2026-10-18T08:39:42.681359935Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active\n"}
+{"Time":"2026-10-18T08:39:42.811761665Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active (0.13s)\n"}
+{"Time":"2026-10-18T08:39:42.811845868Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Elapsed":0.13}
+{"Time":"2026-10-18T08:39:42.811859971Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json"}
+{"Time":"2026-10-18T08:39:42.811869141Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json\n"}
+{"Time":"2026-10-18T08:39:43.108123756Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json (0.30s)\n"}
+{"Time":"2026-10-18T08:39:43.108166291Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Elapsed":0.3}
+{"Time":"2026-10-18T08:39:43.108186318Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect"}
+{"Time":"2026-10-18T08:39:43.108191404Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect\n"}
+{"Time":"2026-10-18T08:39:43.226090634Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect (0.12s)\n"}
+{"Time":"2026-10-18T08:39:43.226136423Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Elapsed":0.12}
+{"Time":"2026-10-18T08:39:43.226209463Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable"}
+{"Time":"2026-10-18T08:39:43.226217146Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable\n"}
+{"Time":"2026-10-18T08:39:43.271464015Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable (0.05s)\n"}
+{"Time":"2026-10-18T08:39:43.271508172Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Elapsed":0.05}
+{"Time":"2026-10-18T08:39:43.271518245Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize"}
+{"Time":"2026-10-18T08:39:43.271523357Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize\n"}
+{"Time":"2026-10-18T08:39:43.506164613Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize (0.23s)\n"}
+{"Time":"2026-10-18T08:39:43.50621235Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Elapsed":0.23}
+{"Time":"2026-10-18T08:39:43.50622373Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached"}
+{"Time":"2026-10-18T08:39:43.506228825Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached\n"}
+{"Time":"2026-10-18T08:39:43.648780193Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached (0.14s)\n"}
+{"Time":"2026-10-18T08:39:43.648921394Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Elapsed":0.14}
+{"Time":"2026-10-18T08:39:43.648939122Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type"}
+{"Time":"2026-10-18T08:39:43.64896611Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type\n"}
+{"Time":"2026-10-18T08:39:43.964039228Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type (0.31s)\n"}
+{"Time":"2026-10-18T08:39:43.964100022Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Elapsed":0.31}
+{"Time":"2026-10-18T08:39:43.964121501Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus (4.32s)\n"}
+{"Time":"2026-10-18T08:39:43.9642652Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Elapsed":4.32}
+{"Time":"2026-10-18T08:39:43.964281134Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope"}
+{"Time":"2026-10-18T08:39:43.964287211Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"=== RUN   TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope\n"}
+{"Time":"2026-10-18T08:39:44.19602466Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"--- PASS: TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope (0.23s)\n"}
+{"Time":"2026-10-18T08:39:44.196083606Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Elapsed":0.23}
+{"Time":"2026-10-18T08:39:44.196100477Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles"}
+{"Time":"2026-10-18T08:39:44.196105716Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles\n"}
+{"Time":"2026-10-18T08:39:44.19636062Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret"}
+{"Time":"2026-10-18T08:39:44.196393478Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret\n"}
+{"Time":"2026-10-18T08:39:44.290447491Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret (0.09s)\n"}
+{"Time":"2026-10-18T08:39:44.290511919Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Elapsed":0.09}
+{"Time":"2026-10-18T08:39:44.290536888Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys"}
+{"Time":"2026-10-18T08:39:44.290553182Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/keys\n"}
+{"Time":"2026-10-18T08:39:44.418402273Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/keys (0.13s)\n"}
+{"Time":"2026-10-18T08:39:44.418447864Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Elapsed":0.13}
+{"Time":"2026-10-18T08:39:44.418550462Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca"}
+{"Time":"2026-10-18T08:39:44.418564701Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/ca\n"}
+{"Time":"2026-10-18T08:39:44.478652906Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/ca (0.06s)\n"}
+{"Time":"2026-10-18T08:39:44.478704512Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Elapsed":0.06}
+{"Time":"2026-10-18T08:39:44.47871545Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable"}
+{"Time":"2026-10-18T08:39:44.478719507Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable\n"}
+{"Time":"2026-10-18T08:39:44.718412401Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable (0.24s)\n"}
+{"Time":"2026-10-18T08:39:44.718464457Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Elapsed":0.24}
+{"Time":"2026-10-18T08:39:44.718475215Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable"}
+{"Time":"2026-10-18T08:39:44.718479787Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable\n"}
+{"Time":"2026-10-18T08:39:44.767214987Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable (0.05s)\n"}
+{"Time":"2026-10-18T08:39:44.767261624Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Elapsed":0.05}
+{"Time":"2026-10-18T08:39:44.767272246Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo"}
+{"Time":"2026-10-18T08:39:44.767277053Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo\n"}
+{"Time":"2026-10-18T08:39:44.822387793Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo (0.05s)\n"}
+{"Time":"2026-10-18T08:39:44.822433862Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Elapsed":0.05}
+{"Time":"2026-10-18T08:39:44.822445143Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles (0.63s)\n"}
+{"Time":"2026-10-18T08:39:44.822461293Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Elapsed":0.63}
+{"Time":"2026-10-18T08:39:44.822616295Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus"}
+{"Time":"2026-10-18T08:39:44.82263166Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus\n"}
+{"Time":"2026-10-18T08:39:44.822648856Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry"}
+{"Time":"2026-10-18T08:39:44.822653238Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry\n"}
+{"Time":"2026-10-18T08:39:44.893590342Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry (0.07s)\n"}
+{"Time":"2026-10-18T08:39:44.893632092Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Elapsed":0.07}
+{"Time":"2026-10-18T08:39:44.893642723Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards"}
+{"Time":"2026-10-18T08:39:44.893647024Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards\n"}
+{"Time":"2026-10-18T08:39:45.053200659Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards (0.16s)\n"}
+{"Time":"2026-10-18T08:39:45.053241949Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Elapsed":0.16}
+{"Time":"2026-10-18T08:39:45.053251498Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key"}
+{"Time":"2026-10-18T08:39:45.05331498Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key\n"}
+{"Time":"2026-10-18T08:39:45.167285955Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key (0.11s)\n"}
+{"Time":"2026-10-18T08:39:45.167369554Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Elapsed":0.11}
+{"Time":"2026-10-18T08:39:45.167383215Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus (0.34s)\n"}
+{"Time":"2026-10-18T08:39:45.16749276Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Elapsed":0.34}
+{"Time":"2026-10-18T08:39:45.167507142Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs"}
+{"Time":"2026-10-18T08:39:45.167511344Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"=== RUN   TestOnlineCancellationAndAmbientProxyDoNotLeakInputs\n"}
+{"Time":"2026-10-18T08:39:45.307805549Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"--- PASS: TestOnlineCancellationAndAmbientProxyDoNotLeakInputs (0.14s)\n"}
+{"Time":"2026-10-18T08:39:45.30787316Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Elapsed":0.14}
+{"Time":"2026-10-18T08:39:45.307905721Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus"}
+{"Time":"2026-10-18T08:39:45.307913521Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"=== RUN   TestOnlineMalformedAdmissionAndNegativeStatus\n"}
+{"Time":"2026-10-18T08:39:45.483113733Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"--- PASS: TestOnlineMalformedAdmissionAndNegativeStatus (0.17s)\n"}
+{"Time":"2026-10-18T08:39:45.483154347Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Elapsed":0.17}
+{"Time":"2026-10-18T08:39:45.483175835Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier"}
+{"Time":"2026-10-18T08:39:45.483180965Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"=== RUN   TestOnlineUsesSharedTypedJOSEVerifier\n"}
+{"Time":"2026-10-18T08:39:45.684323966Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"--- PASS: TestOnlineUsesSharedTypedJOSEVerifier (0.20s)\n"}
+{"Time":"2026-10-18T08:39:45.684499234Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Elapsed":0.2}
+{"Time":"2026-10-18T08:39:45.684517864Z","Action":"output","Package":"keycape/internal/authclient","Output":"PASS\n"}
+{"Time":"2026-10-18T08:39:46.691116208Z","Action":"output","Package":"keycape/internal/authclient","Output":"ok  \tkeycape/internal/authclient\t8.693s\n"}
+{"Time":"2026-10-18T08:39:46.69116408Z","Action":"pass","Package":"keycape/internal/authclient","Elapsed":8.693999999999999}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt2.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt2.json
new file mode 100644
index 0000000..7ce6e0e
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt2.json
@@ -0,0 +1,218 @@
+{
+  "returncode": 1,
+  "seconds": 12.17,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "test",
+    "-p",
+    "4",
+    "-race",
+    "-json",
+    "-count=1",
+    "-run",
+    "^TestOnline",
+    "./internal/authclient"
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:0193c01d05a0c77b0d7351ed4549e983eb585d8dbfe757ef6a7e8d29b0ef090f",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:34ed720bc4e90318064c5794bcfa157e237a741875dbf81e4277d6d3927a44f4",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:e37eeccc2b9a1943f68f9988b2327e47fdd90c791fcc96f7a1b2f1a1faf028b8",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:187d912d0a2b8fe1f1cf096f18c93bda1c24d3f090ed4cc926f3300127e26d83",
+    "src/internal/authclient/online_test.go": "sha256:2c5e0c117afe9614cb396c9de1ae52cb000cc57256589d949ed8445f35b3e131",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:b8be4e3fdb0787bd05753d5fca3c68ebbcb158fbcfa3de91207ac9c23429353e",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 60,
+    "fail": 2,
+    "skip": 0
+  },
+  "failures": [
+    "keycape/internal/authclient:TestOnlineCLIUsesActualProducerAndPrivateObservation",
+    "keycape/internal/authclient:TestOnlineCLIFailureDoesNotDeleteReplacedObservation"
+  ],
+  "skips": [],
+  "source": "/tmp/custodian-keycape-current-client-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt2.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt2.jsonl
new file mode 100644
index 0000000..ef05785
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt2.jsonl
@@ -0,0 +1,254 @@
+{"Time":"2026-10-18T08:46:14.440392027Z","Action":"start","Package":"keycape/internal/authclient"}
+{"Time":"2026-10-18T08:46:14.460559555Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation"}
+{"Time":"2026-10-18T08:46:14.460604714Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"=== RUN   TestOnlineCLIUsesActualProducerAndPrivateObservation\n"}
+{"Time":"2026-10-18T08:46:14.549702418Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"    online_cli_test.go:35: current-token command failed\n"}
+{"Time":"2026-10-18T08:46:14.550250568Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"--- FAIL: TestOnlineCLIUsesActualProducerAndPrivateObservation (0.09s)\n"}
+{"Time":"2026-10-18T08:46:14.550267006Z","Action":"fail","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Elapsed":0.09}
+{"Time":"2026-10-18T08:46:14.550336042Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput"}
+{"Time":"2026-10-18T08:46:14.550344185Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput\n"}
+{"Time":"2026-10-18T08:46:14.550503357Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash"}
+{"Time":"2026-10-18T08:46:14.550511978Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash\n"}
+{"Time":"2026-10-18T08:46:14.614877253Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash (0.06s)\n"}
+{"Time":"2026-10-18T08:46:14.614925541Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Elapsed":0.06}
+{"Time":"2026-10-18T08:46:14.615143199Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced"}
+{"Time":"2026-10-18T08:46:14.615159953Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced\n"}
+{"Time":"2026-10-18T08:46:15.316170186Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced (0.70s)\n"}
+{"Time":"2026-10-18T08:46:15.316220989Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Elapsed":0.7}
+{"Time":"2026-10-18T08:46:15.316464834Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission"}
+{"Time":"2026-10-18T08:46:15.316481245Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission\n"}
+{"Time":"2026-10-18T08:46:15.543192376Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission (0.23s)\n"}
+{"Time":"2026-10-18T08:46:15.54326593Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Elapsed":0.23}
+{"Time":"2026-10-18T08:46:15.543297851Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token"}
+{"Time":"2026-10-18T08:46:15.543306381Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token\n"}
+{"Time":"2026-10-18T08:46:15.719850063Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token (0.18s)\n"}
+{"Time":"2026-10-18T08:46:15.719902264Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Elapsed":0.18}
+{"Time":"2026-10-18T08:46:15.720040525Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token"}
+{"Time":"2026-10-18T08:46:15.720054349Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token\n"}
+{"Time":"2026-10-18T08:46:16.028277306Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token (0.31s)\n"}
+{"Time":"2026-10-18T08:46:16.028324042Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Elapsed":0.31}
+{"Time":"2026-10-18T08:46:16.028334241Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent"}
+{"Time":"2026-10-18T08:46:16.028343492Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent\n"}
+{"Time":"2026-10-18T08:46:16.154141775Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent (0.13s)\n"}
+{"Time":"2026-10-18T08:46:16.154185427Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Elapsed":0.13}
+{"Time":"2026-10-18T08:46:16.154200062Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output"}
+{"Time":"2026-10-18T08:46:16.15420494Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output\n"}
+{"Time":"2026-10-18T08:46:16.365162556Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output (0.21s)\n"}
+{"Time":"2026-10-18T08:46:16.365206371Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Elapsed":0.21}
+{"Time":"2026-10-18T08:46:16.36532162Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink"}
+{"Time":"2026-10-18T08:46:16.36532988Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink\n"}
+{"Time":"2026-10-18T08:46:16.405407475Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink (0.04s)\n"}
+{"Time":"2026-10-18T08:46:16.405534393Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Elapsed":0.04}
+{"Time":"2026-10-18T08:46:16.405575882Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag"}
+{"Time":"2026-10-18T08:46:16.405589101Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag\n"}
+{"Time":"2026-10-18T08:46:16.593556672Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag (0.19s)\n"}
+{"Time":"2026-10-18T08:46:16.593624905Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Elapsed":0.19}
+{"Time":"2026-10-18T08:46:16.593639459Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags"}
+{"Time":"2026-10-18T08:46:16.593647331Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags\n"}
+{"Time":"2026-10-18T08:46:16.648652759Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags (0.05s)\n"}
+{"Time":"2026-10-18T08:46:16.648717133Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Elapsed":0.05}
+{"Time":"2026-10-18T08:46:16.648737394Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput (2.10s)\n"}
+{"Time":"2026-10-18T08:46:16.648749649Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Elapsed":2.1}
+{"Time":"2026-10-18T08:46:16.648755627Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation"}
+{"Time":"2026-10-18T08:46:16.648761056Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"=== RUN   TestOnlineCLIFailureDoesNotDeleteReplacedObservation\n"}
+{"Time":"2026-10-18T08:46:16.763426882Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"    online_cli_test.go:153: another attempt's output removed\n"}
+{"Time":"2026-10-18T08:46:16.763949576Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"--- FAIL: TestOnlineCLIFailureDoesNotDeleteReplacedObservation (0.12s)\n"}
+{"Time":"2026-10-18T08:46:16.764058477Z","Action":"fail","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Elapsed":0.12}
+{"Time":"2026-10-18T08:46:16.764311501Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant"}
+{"Time":"2026-10-18T08:46:16.76432894Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"=== RUN   TestOnlineActualIssuerCurrentRevocationAndFreshGrant\n"}
+{"Time":"2026-10-18T08:46:17.043933195Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"--- PASS: TestOnlineActualIssuerCurrentRevocationAndFreshGrant (0.28s)\n"}
+{"Time":"2026-10-18T08:46:17.0439737Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Elapsed":0.28}
+{"Time":"2026-10-18T08:46:17.043983953Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork"}
+{"Time":"2026-10-18T08:46:17.043988443Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork\n"}
+{"Time":"2026-10-18T08:46:17.044071303Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject"}
+{"Time":"2026-10-18T08:46:17.044085577Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/subject\n"}
+{"Time":"2026-10-18T08:46:17.104845612Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/subject (0.06s)\n"}
+{"Time":"2026-10-18T08:46:17.104894512Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Elapsed":0.06}
+{"Time":"2026-10-18T08:46:17.104905477Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant"}
+{"Time":"2026-10-18T08:46:17.104911924Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant\n"}
+{"Time":"2026-10-18T08:46:17.202785913Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant (0.10s)\n"}
+{"Time":"2026-10-18T08:46:17.202893489Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Elapsed":0.1}
+{"Time":"2026-10-18T08:46:17.20303294Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal"}
+{"Time":"2026-10-18T08:46:17.203041236Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/principal\n"}
+{"Time":"2026-10-18T08:46:17.415084924Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/principal (0.21s)\n"}
+{"Time":"2026-10-18T08:46:17.415303953Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Elapsed":0.21}
+{"Time":"2026-10-18T08:46:17.415324152Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience"}
+{"Time":"2026-10-18T08:46:17.415329066Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/audience\n"}
+{"Time":"2026-10-18T08:46:17.52482687Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/audience (0.11s)\n"}
+{"Time":"2026-10-18T08:46:17.524873922Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Elapsed":0.11}
+{"Time":"2026-10-18T08:46:17.52490449Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer"}
+{"Time":"2026-10-18T08:46:17.524911614Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer\n"}
+{"Time":"2026-10-18T08:46:17.581967192Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer (0.06s)\n"}
+{"Time":"2026-10-18T08:46:17.582041855Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Elapsed":0.06}
+{"Time":"2026-10-18T08:46:17.582076499Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper"}
+{"Time":"2026-10-18T08:46:17.58209787Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper\n"}
+{"Time":"2026-10-18T08:46:17.939287603Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper (0.36s)\n"}
+{"Time":"2026-10-18T08:46:17.939342076Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Elapsed":0.36}
+{"Time":"2026-10-18T08:46:17.939364538Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key"}
+{"Time":"2026-10-18T08:46:17.939371274Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/key\n"}
+{"Time":"2026-10-18T08:46:18.043628757Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/key (0.10s)\n"}
+{"Time":"2026-10-18T08:46:18.043675566Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Elapsed":0.1}
+{"Time":"2026-10-18T08:46:18.043684845Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti"}
+{"Time":"2026-10-18T08:46:18.043690769Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti\n"}
+{"Time":"2026-10-18T08:46:18.29079042Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti (0.25s)\n"}
+{"Time":"2026-10-18T08:46:18.290841638Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Elapsed":0.25}
+{"Time":"2026-10-18T08:46:18.290852918Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token"}
+{"Time":"2026-10-18T08:46:18.290865876Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token\n"}
+{"Time":"2026-10-18T08:46:18.382731443Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token (0.09s)\n"}
+{"Time":"2026-10-18T08:46:18.382782021Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Elapsed":0.09}
+{"Time":"2026-10-18T08:46:18.382811561Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale"}
+{"Time":"2026-10-18T08:46:18.382821922Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/stale\n"}
+{"Time":"2026-10-18T08:46:18.74613425Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/stale (0.36s)\n"}
+{"Time":"2026-10-18T08:46:18.746188444Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Elapsed":0.36}
+{"Time":"2026-10-18T08:46:18.746200815Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork (1.70s)\n"}
+{"Time":"2026-10-18T08:46:18.746217019Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Elapsed":1.7}
+{"Time":"2026-10-18T08:46:18.746236037Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus"}
+{"Time":"2026-10-18T08:46:18.746243566Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus\n"}
+{"Time":"2026-10-18T08:46:18.746458023Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active"}
+{"Time":"2026-10-18T08:46:18.746478033Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active\n"}
+{"Time":"2026-10-18T08:46:18.988827669Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active (0.24s)\n"}
+{"Time":"2026-10-18T08:46:18.988890123Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Elapsed":0.24}
+{"Time":"2026-10-18T08:46:18.988902287Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type"}
+{"Time":"2026-10-18T08:46:18.988908572Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type\n"}
+{"Time":"2026-10-18T08:46:19.072409025Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type (0.08s)\n"}
+{"Time":"2026-10-18T08:46:19.072458259Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Elapsed":0.08}
+{"Time":"2026-10-18T08:46:19.072468448Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope"}
+{"Time":"2026-10-18T08:46:19.072473823Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope\n"}
+{"Time":"2026-10-18T08:46:19.258045461Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope (0.19s)\n"}
+{"Time":"2026-10-18T08:46:19.258112838Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Elapsed":0.19}
+{"Time":"2026-10-18T08:46:19.258238214Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope"}
+{"Time":"2026-10-18T08:46:19.258251803Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope\n"}
+{"Time":"2026-10-18T08:46:19.415022485Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope (0.16s)\n"}
+{"Time":"2026-10-18T08:46:19.415067382Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Elapsed":0.16}
+{"Time":"2026-10-18T08:46:19.415076453Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client"}
+{"Time":"2026-10-18T08:46:19.415080285Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client\n"}
+{"Time":"2026-10-18T08:46:19.706894076Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client (0.29s)\n"}
+{"Time":"2026-10-18T08:46:19.706956323Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Elapsed":0.29}
+{"Time":"2026-10-18T08:46:19.707078803Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject"}
+{"Time":"2026-10-18T08:46:19.707098713Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject\n"}
+{"Time":"2026-10-18T08:46:19.939241204Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject (0.23s)\n"}
+{"Time":"2026-10-18T08:46:19.939296363Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Elapsed":0.23}
+{"Time":"2026-10-18T08:46:19.939306732Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer"}
+{"Time":"2026-10-18T08:46:19.939310267Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer\n"}
+{"Time":"2026-10-18T08:46:20.125509023Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer (0.19s)\n"}
+{"Time":"2026-10-18T08:46:20.125558727Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Elapsed":0.19}
+{"Time":"2026-10-18T08:46:20.125570746Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience"}
+{"Time":"2026-10-18T08:46:20.125576608Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience\n"}
+{"Time":"2026-10-18T08:46:20.2352132Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience (0.11s)\n"}
+{"Time":"2026-10-18T08:46:20.235265284Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Elapsed":0.11}
+{"Time":"2026-10-18T08:46:20.235277034Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti"}
+{"Time":"2026-10-18T08:46:20.235287467Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti\n"}
+{"Time":"2026-10-18T08:46:20.379420365Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti (0.14s)\n"}
+{"Time":"2026-10-18T08:46:20.379474829Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Elapsed":0.14}
+{"Time":"2026-10-18T08:46:20.379486777Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry"}
+{"Time":"2026-10-18T08:46:20.379492485Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry\n"}
+{"Time":"2026-10-18T08:46:20.540861751Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry (0.16s)\n"}
+{"Time":"2026-10-18T08:46:20.540903789Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Elapsed":0.16}
+{"Time":"2026-10-18T08:46:20.540914168Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued"}
+{"Time":"2026-10-18T08:46:20.540918749Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued\n"}
+{"Time":"2026-10-18T08:46:20.643268416Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued (0.10s)\n"}
+{"Time":"2026-10-18T08:46:20.643324152Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Elapsed":0.1}
+{"Time":"2026-10-18T08:46:20.643335847Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope"}
+{"Time":"2026-10-18T08:46:20.643342655Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope\n"}
+{"Time":"2026-10-18T08:46:20.949243022Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope (0.31s)\n"}
+{"Time":"2026-10-18T08:46:20.949281435Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Elapsed":0.31}
+{"Time":"2026-10-18T08:46:20.949302644Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type"}
+{"Time":"2026-10-18T08:46:20.949306638Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type\n"}
+{"Time":"2026-10-18T08:46:21.048927999Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type (0.10s)\n"}
+{"Time":"2026-10-18T08:46:21.048971038Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Elapsed":0.1}
+{"Time":"2026-10-18T08:46:21.049046602Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field"}
+{"Time":"2026-10-18T08:46:21.049054898Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field\n"}
+{"Time":"2026-10-18T08:46:21.241793505Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field (0.19s)\n"}
+{"Time":"2026-10-18T08:46:21.241850151Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Elapsed":0.19}
+{"Time":"2026-10-18T08:46:21.241876373Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active"}
+{"Time":"2026-10-18T08:46:21.241888123Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active\n"}
+{"Time":"2026-10-18T08:46:21.710898206Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active (0.47s)\n"}
+{"Time":"2026-10-18T08:46:21.710944311Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Elapsed":0.47}
+{"Time":"2026-10-18T08:46:21.710956214Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json"}
+{"Time":"2026-10-18T08:46:21.710961642Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json\n"}
+{"Time":"2026-10-18T08:46:21.983438349Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json (0.27s)\n"}
+{"Time":"2026-10-18T08:46:21.983479504Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Elapsed":0.27}
+{"Time":"2026-10-18T08:46:21.983489396Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect"}
+{"Time":"2026-10-18T08:46:21.983494455Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect\n"}
+{"Time":"2026-10-18T08:46:22.14831702Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect (0.16s)\n"}
+{"Time":"2026-10-18T08:46:22.148376687Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Elapsed":0.16}
+{"Time":"2026-10-18T08:46:22.148492496Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable"}
+{"Time":"2026-10-18T08:46:22.148503253Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable\n"}
+{"Time":"2026-10-18T08:46:22.382790883Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable (0.23s)\n"}
+{"Time":"2026-10-18T08:46:22.382832886Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Elapsed":0.23}
+{"Time":"2026-10-18T08:46:22.382840334Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize"}
+{"Time":"2026-10-18T08:46:22.382844401Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize\n"}
+{"Time":"2026-10-18T08:46:22.467082638Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize (0.08s)\n"}
+{"Time":"2026-10-18T08:46:22.467136038Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Elapsed":0.08}
+{"Time":"2026-10-18T08:46:22.467146489Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached"}
+{"Time":"2026-10-18T08:46:22.467157815Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached\n"}
+{"Time":"2026-10-18T08:46:22.597848402Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached (0.13s)\n"}
+{"Time":"2026-10-18T08:46:22.597891821Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Elapsed":0.13}
+{"Time":"2026-10-18T08:46:22.597906185Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type"}
+{"Time":"2026-10-18T08:46:22.59791128Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type\n"}
+{"Time":"2026-10-18T08:46:22.702418351Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type (0.10s)\n"}
+{"Time":"2026-10-18T08:46:22.702492193Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Elapsed":0.1}
+{"Time":"2026-10-18T08:46:22.702507775Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus (3.96s)\n"}
+{"Time":"2026-10-18T08:46:22.702533185Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Elapsed":3.96}
+{"Time":"2026-10-18T08:46:22.702589606Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope"}
+{"Time":"2026-10-18T08:46:22.702621455Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"=== RUN   TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope\n"}
+{"Time":"2026-10-18T08:46:22.919373804Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"--- PASS: TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope (0.22s)\n"}
+{"Time":"2026-10-18T08:46:22.919423669Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Elapsed":0.22}
+{"Time":"2026-10-18T08:46:22.919612932Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles"}
+{"Time":"2026-10-18T08:46:22.919630155Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles\n"}
+{"Time":"2026-10-18T08:46:22.919731563Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret"}
+{"Time":"2026-10-18T08:46:22.919744115Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret\n"}
+{"Time":"2026-10-18T08:46:23.092705253Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret (0.17s)\n"}
+{"Time":"2026-10-18T08:46:23.092750988Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Elapsed":0.17}
+{"Time":"2026-10-18T08:46:23.092763585Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys"}
+{"Time":"2026-10-18T08:46:23.092769654Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/keys\n"}
+{"Time":"2026-10-18T08:46:23.243950194Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/keys (0.15s)\n"}
+{"Time":"2026-10-18T08:46:23.243995361Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Elapsed":0.15}
+{"Time":"2026-10-18T08:46:23.244021078Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca"}
+{"Time":"2026-10-18T08:46:23.244028527Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/ca\n"}
+{"Time":"2026-10-18T08:46:23.388425705Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/ca (0.14s)\n"}
+{"Time":"2026-10-18T08:46:23.388494516Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Elapsed":0.14}
+{"Time":"2026-10-18T08:46:23.388532406Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable"}
+{"Time":"2026-10-18T08:46:23.38856375Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable\n"}
+{"Time":"2026-10-18T08:46:23.578012871Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable (0.19s)\n"}
+{"Time":"2026-10-18T08:46:23.578061988Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Elapsed":0.19}
+{"Time":"2026-10-18T08:46:23.578075334Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable"}
+{"Time":"2026-10-18T08:46:23.578084766Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable\n"}
+{"Time":"2026-10-18T08:46:23.806683945Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable (0.23s)\n"}
+{"Time":"2026-10-18T08:46:23.806740799Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Elapsed":0.23}
+{"Time":"2026-10-18T08:46:23.806755839Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo"}
+{"Time":"2026-10-18T08:46:23.806763297Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo\n"}
+{"Time":"2026-10-18T08:46:24.010745382Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo (0.20s)\n"}
+{"Time":"2026-10-18T08:46:24.010792245Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Elapsed":0.2}
+{"Time":"2026-10-18T08:46:24.010805266Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles (1.09s)\n"}
+{"Time":"2026-10-18T08:46:24.010978814Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Elapsed":1.09}
+{"Time":"2026-10-18T08:46:24.011002016Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus"}
+{"Time":"2026-10-18T08:46:24.011009572Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus\n"}
+{"Time":"2026-10-18T08:46:24.011207561Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry"}
+{"Time":"2026-10-18T08:46:24.011229518Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry\n"}
+{"Time":"2026-10-18T08:46:24.191144644Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry (0.18s)\n"}
+{"Time":"2026-10-18T08:46:24.191196592Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Elapsed":0.18}
+{"Time":"2026-10-18T08:46:24.191230768Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards"}
+{"Time":"2026-10-18T08:46:24.191243626Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards\n"}
+{"Time":"2026-10-18T08:46:24.271537949Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards (0.08s)\n"}
+{"Time":"2026-10-18T08:46:24.271599961Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Elapsed":0.08}
+{"Time":"2026-10-18T08:46:24.271624118Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key"}
+{"Time":"2026-10-18T08:46:24.271634064Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key\n"}
+{"Time":"2026-10-18T08:46:24.327105487Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key (0.06s)\n"}
+{"Time":"2026-10-18T08:46:24.327153215Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Elapsed":0.06}
+{"Time":"2026-10-18T08:46:24.327167264Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus (0.32s)\n"}
+{"Time":"2026-10-18T08:46:24.327284509Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Elapsed":0.32}
+{"Time":"2026-10-18T08:46:24.327441821Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs"}
+{"Time":"2026-10-18T08:46:24.327459585Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"=== RUN   TestOnlineCancellationAndAmbientProxyDoNotLeakInputs\n"}
+{"Time":"2026-10-18T08:46:24.440437409Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"--- PASS: TestOnlineCancellationAndAmbientProxyDoNotLeakInputs (0.11s)\n"}
+{"Time":"2026-10-18T08:46:24.440490908Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Elapsed":0.11}
+{"Time":"2026-10-18T08:46:24.440499817Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus"}
+{"Time":"2026-10-18T08:46:24.440504758Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"=== RUN   TestOnlineMalformedAdmissionAndNegativeStatus\n"}
+{"Time":"2026-10-18T08:46:24.54412066Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"--- PASS: TestOnlineMalformedAdmissionAndNegativeStatus (0.10s)\n"}
+{"Time":"2026-10-18T08:46:24.544170435Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Elapsed":0.1}
+{"Time":"2026-10-18T08:46:24.544187929Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier"}
+{"Time":"2026-10-18T08:46:24.544194917Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"=== RUN   TestOnlineUsesSharedTypedJOSEVerifier\n"}
+{"Time":"2026-10-18T08:46:24.590603025Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"--- PASS: TestOnlineUsesSharedTypedJOSEVerifier (0.05s)\n"}
+{"Time":"2026-10-18T08:46:24.59065656Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Elapsed":0.05}
+{"Time":"2026-10-18T08:46:24.590669229Z","Action":"output","Package":"keycape/internal/authclient","Output":"FAIL\n"}
+{"Time":"2026-10-18T08:46:24.598580109Z","Action":"output","Package":"keycape/internal/authclient","Output":"FAIL\tkeycape/internal/authclient\t10.157s\n"}
+{"Time":"2026-10-18T08:46:24.598625457Z","Action":"fail","Package":"keycape/internal/authclient","Elapsed":10.158}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt3.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt3.json
new file mode 100644
index 0000000..9064e81
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt3.json
@@ -0,0 +1,215 @@
+{
+  "returncode": 0,
+  "seconds": 9.26,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "test",
+    "-p",
+    "4",
+    "-race",
+    "-json",
+    "-count=1",
+    "-run",
+    "^TestOnline",
+    "./internal/authclient"
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:0193c01d05a0c77b0d7351ed4549e983eb585d8dbfe757ef6a7e8d29b0ef090f",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:dbf68dfa0d047a98e07b2e7fcf96a9270b2a5fb983257c26b1a9ee861a9dcc01",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:e37eeccc2b9a1943f68f9988b2327e47fdd90c791fcc96f7a1b2f1a1faf028b8",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f",
+    "src/internal/authclient/online_test.go": "sha256:2c5e0c117afe9614cb396c9de1ae52cb000cc57256589d949ed8445f35b3e131",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:b8be4e3fdb0787bd05753d5fca3c68ebbcb158fbcfa3de91207ac9c23429353e",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 63,
+    "fail": 0,
+    "skip": 0
+  },
+  "failures": [],
+  "skips": [],
+  "source": "/tmp/custodian-keycape-current-client-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt3.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt3.jsonl
new file mode 100644
index 0000000..4216746
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/focused-attempt3.jsonl
@@ -0,0 +1,256 @@
+{"Time":"2026-10-18T08:47:18.74945806Z","Action":"start","Package":"keycape/internal/authclient"}
+{"Time":"2026-10-18T08:47:18.766157446Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation"}
+{"Time":"2026-10-18T08:47:18.766227745Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"=== RUN   TestOnlineCLIUsesActualProducerAndPrivateObservation\n"}
+{"Time":"2026-10-18T08:47:18.922433315Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"--- PASS: TestOnlineCLIUsesActualProducerAndPrivateObservation (0.16s)\n"}
+{"Time":"2026-10-18T08:47:18.922495201Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Elapsed":0.16}
+{"Time":"2026-10-18T08:47:18.922514011Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput"}
+{"Time":"2026-10-18T08:47:18.922519755Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput\n"}
+{"Time":"2026-10-18T08:47:18.922531423Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash"}
+{"Time":"2026-10-18T08:47:18.922536896Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash\n"}
+{"Time":"2026-10-18T08:47:19.021741879Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash (0.10s)\n"}
+{"Time":"2026-10-18T08:47:19.021798029Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:19.021813963Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag"}
+{"Time":"2026-10-18T08:47:19.021820266Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag\n"}
+{"Time":"2026-10-18T08:47:19.077729661Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag (0.06s)\n"}
+{"Time":"2026-10-18T08:47:19.077782214Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Elapsed":0.06}
+{"Time":"2026-10-18T08:47:19.078031477Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced"}
+{"Time":"2026-10-18T08:47:19.078055409Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced\n"}
+{"Time":"2026-10-18T08:47:19.217039863Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced (0.14s)\n"}
+{"Time":"2026-10-18T08:47:19.217086023Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Elapsed":0.14}
+{"Time":"2026-10-18T08:47:19.217098331Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission"}
+{"Time":"2026-10-18T08:47:19.217120207Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission\n"}
+{"Time":"2026-10-18T08:47:19.369650765Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission (0.15s)\n"}
+{"Time":"2026-10-18T08:47:19.369706519Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Elapsed":0.15}
+{"Time":"2026-10-18T08:47:19.36987286Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token"}
+{"Time":"2026-10-18T08:47:19.369888451Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token\n"}
+{"Time":"2026-10-18T08:47:19.493949909Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token (0.12s)\n"}
+{"Time":"2026-10-18T08:47:19.494007457Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Elapsed":0.12}
+{"Time":"2026-10-18T08:47:19.4940245Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token"}
+{"Time":"2026-10-18T08:47:19.494031299Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token\n"}
+{"Time":"2026-10-18T08:47:19.55750809Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token (0.06s)\n"}
+{"Time":"2026-10-18T08:47:19.55755892Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Elapsed":0.06}
+{"Time":"2026-10-18T08:47:19.557731114Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent"}
+{"Time":"2026-10-18T08:47:19.557751402Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent\n"}
+{"Time":"2026-10-18T08:47:19.706465119Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent (0.15s)\n"}
+{"Time":"2026-10-18T08:47:19.706524921Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Elapsed":0.15}
+{"Time":"2026-10-18T08:47:19.706603849Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output"}
+{"Time":"2026-10-18T08:47:19.706617312Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output\n"}
+{"Time":"2026-10-18T08:47:19.84259186Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output (0.14s)\n"}
+{"Time":"2026-10-18T08:47:19.842679417Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Elapsed":0.14}
+{"Time":"2026-10-18T08:47:19.842706767Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink"}
+{"Time":"2026-10-18T08:47:19.842717218Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink\n"}
+{"Time":"2026-10-18T08:47:19.974683947Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink (0.13s)\n"}
+{"Time":"2026-10-18T08:47:19.974731278Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Elapsed":0.13}
+{"Time":"2026-10-18T08:47:19.974741892Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag"}
+{"Time":"2026-10-18T08:47:19.974746941Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag\n"}
+{"Time":"2026-10-18T08:47:20.059766516Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag (0.08s)\n"}
+{"Time":"2026-10-18T08:47:20.059825381Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Elapsed":0.08}
+{"Time":"2026-10-18T08:47:20.059839114Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags"}
+{"Time":"2026-10-18T08:47:20.05984447Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags\n"}
+{"Time":"2026-10-18T08:47:20.150280462Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags (0.09s)\n"}
+{"Time":"2026-10-18T08:47:20.150330346Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Elapsed":0.09}
+{"Time":"2026-10-18T08:47:20.150349264Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput (1.23s)\n"}
+{"Time":"2026-10-18T08:47:20.150519807Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Elapsed":1.23}
+{"Time":"2026-10-18T08:47:20.150861534Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation"}
+{"Time":"2026-10-18T08:47:20.150887197Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"=== RUN   TestOnlineCLIFailureDoesNotDeleteReplacedObservation\n"}
+{"Time":"2026-10-18T08:47:20.278855425Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"--- PASS: TestOnlineCLIFailureDoesNotDeleteReplacedObservation (0.13s)\n"}
+{"Time":"2026-10-18T08:47:20.278910448Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Elapsed":0.13}
+{"Time":"2026-10-18T08:47:20.27894043Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant"}
+{"Time":"2026-10-18T08:47:20.278949853Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"=== RUN   TestOnlineActualIssuerCurrentRevocationAndFreshGrant\n"}
+{"Time":"2026-10-18T08:47:20.553797226Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"--- PASS: TestOnlineActualIssuerCurrentRevocationAndFreshGrant (0.27s)\n"}
+{"Time":"2026-10-18T08:47:20.553857019Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Elapsed":0.27}
+{"Time":"2026-10-18T08:47:20.554013234Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork"}
+{"Time":"2026-10-18T08:47:20.554030321Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork\n"}
+{"Time":"2026-10-18T08:47:20.55420256Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject"}
+{"Time":"2026-10-18T08:47:20.554219945Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/subject\n"}
+{"Time":"2026-10-18T08:47:20.614604519Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/subject (0.06s)\n"}
+{"Time":"2026-10-18T08:47:20.614649452Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Elapsed":0.06}
+{"Time":"2026-10-18T08:47:20.614730021Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant"}
+{"Time":"2026-10-18T08:47:20.61473884Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant\n"}
+{"Time":"2026-10-18T08:47:20.733305803Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant (0.12s)\n"}
+{"Time":"2026-10-18T08:47:20.733358518Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Elapsed":0.12}
+{"Time":"2026-10-18T08:47:20.733525274Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal"}
+{"Time":"2026-10-18T08:47:20.73354008Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/principal\n"}
+{"Time":"2026-10-18T08:47:20.78295131Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/principal (0.05s)\n"}
+{"Time":"2026-10-18T08:47:20.783007776Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Elapsed":0.05}
+{"Time":"2026-10-18T08:47:20.783129392Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience"}
+{"Time":"2026-10-18T08:47:20.783144279Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/audience\n"}
+{"Time":"2026-10-18T08:47:20.927029021Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/audience (0.14s)\n"}
+{"Time":"2026-10-18T08:47:20.927084044Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Elapsed":0.14}
+{"Time":"2026-10-18T08:47:20.927098021Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer"}
+{"Time":"2026-10-18T08:47:20.927105586Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer\n"}
+{"Time":"2026-10-18T08:47:20.982963861Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer (0.06s)\n"}
+{"Time":"2026-10-18T08:47:20.983015385Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Elapsed":0.06}
+{"Time":"2026-10-18T08:47:20.983029714Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper"}
+{"Time":"2026-10-18T08:47:20.983036359Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper\n"}
+{"Time":"2026-10-18T08:47:21.209751475Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper (0.23s)\n"}
+{"Time":"2026-10-18T08:47:21.209809735Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Elapsed":0.23}
+{"Time":"2026-10-18T08:47:21.20982199Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key"}
+{"Time":"2026-10-18T08:47:21.209829609Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/key\n"}
+{"Time":"2026-10-18T08:47:21.322698117Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/key (0.11s)\n"}
+{"Time":"2026-10-18T08:47:21.322772266Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Elapsed":0.11}
+{"Time":"2026-10-18T08:47:21.322784674Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti"}
+{"Time":"2026-10-18T08:47:21.322789904Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti\n"}
+{"Time":"2026-10-18T08:47:21.532995563Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti (0.21s)\n"}
+{"Time":"2026-10-18T08:47:21.533067115Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Elapsed":0.21}
+{"Time":"2026-10-18T08:47:21.533291148Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token"}
+{"Time":"2026-10-18T08:47:21.533304656Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token\n"}
+{"Time":"2026-10-18T08:47:21.627031033Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token (0.09s)\n"}
+{"Time":"2026-10-18T08:47:21.627085299Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Elapsed":0.09}
+{"Time":"2026-10-18T08:47:21.627110376Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale"}
+{"Time":"2026-10-18T08:47:21.627117247Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/stale\n"}
+{"Time":"2026-10-18T08:47:21.66354915Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/stale (0.04s)\n"}
+{"Time":"2026-10-18T08:47:21.663607032Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Elapsed":0.04}
+{"Time":"2026-10-18T08:47:21.66362375Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork (1.11s)\n"}
+{"Time":"2026-10-18T08:47:21.663633849Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Elapsed":1.11}
+{"Time":"2026-10-18T08:47:21.663645058Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus"}
+{"Time":"2026-10-18T08:47:21.663651325Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus\n"}
+{"Time":"2026-10-18T08:47:21.663657952Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active"}
+{"Time":"2026-10-18T08:47:21.663664075Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active\n"}
+{"Time":"2026-10-18T08:47:21.758116367Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active (0.09s)\n"}
+{"Time":"2026-10-18T08:47:21.758162535Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Elapsed":0.09}
+{"Time":"2026-10-18T08:47:21.758249579Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type"}
+{"Time":"2026-10-18T08:47:21.758258064Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type\n"}
+{"Time":"2026-10-18T08:47:21.81107521Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type (0.05s)\n"}
+{"Time":"2026-10-18T08:47:21.811130693Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Elapsed":0.05}
+{"Time":"2026-10-18T08:47:21.811151758Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope"}
+{"Time":"2026-10-18T08:47:21.811178061Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope\n"}
+{"Time":"2026-10-18T08:47:21.942129897Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope (0.13s)\n"}
+{"Time":"2026-10-18T08:47:21.942172395Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Elapsed":0.13}
+{"Time":"2026-10-18T08:47:21.942184172Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope"}
+{"Time":"2026-10-18T08:47:21.942189772Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope\n"}
+{"Time":"2026-10-18T08:47:22.097989597Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope (0.16s)\n"}
+{"Time":"2026-10-18T08:47:22.098034999Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Elapsed":0.16}
+{"Time":"2026-10-18T08:47:22.098053458Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client"}
+{"Time":"2026-10-18T08:47:22.098063836Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client\n"}
+{"Time":"2026-10-18T08:47:22.154749158Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client (0.06s)\n"}
+{"Time":"2026-10-18T08:47:22.15479373Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Elapsed":0.06}
+{"Time":"2026-10-18T08:47:22.154802405Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject"}
+{"Time":"2026-10-18T08:47:22.1548075Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject\n"}
+{"Time":"2026-10-18T08:47:22.287109349Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject (0.13s)\n"}
+{"Time":"2026-10-18T08:47:22.287169783Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Elapsed":0.13}
+{"Time":"2026-10-18T08:47:22.287310284Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer"}
+{"Time":"2026-10-18T08:47:22.287320951Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer\n"}
+{"Time":"2026-10-18T08:47:22.382878214Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer (0.10s)\n"}
+{"Time":"2026-10-18T08:47:22.382939009Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:22.382951371Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience"}
+{"Time":"2026-10-18T08:47:22.382957837Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience\n"}
+{"Time":"2026-10-18T08:47:22.49215412Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience (0.11s)\n"}
+{"Time":"2026-10-18T08:47:22.492214644Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Elapsed":0.11}
+{"Time":"2026-10-18T08:47:22.492226835Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti"}
+{"Time":"2026-10-18T08:47:22.492233842Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti\n"}
+{"Time":"2026-10-18T08:47:22.590850707Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti (0.10s)\n"}
+{"Time":"2026-10-18T08:47:22.590900446Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:22.590912223Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry"}
+{"Time":"2026-10-18T08:47:22.590918427Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry\n"}
+{"Time":"2026-10-18T08:47:22.687419376Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry (0.10s)\n"}
+{"Time":"2026-10-18T08:47:22.687485076Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:22.687501163Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued"}
+{"Time":"2026-10-18T08:47:22.687513345Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued\n"}
+{"Time":"2026-10-18T08:47:22.76259169Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued (0.07s)\n"}
+{"Time":"2026-10-18T08:47:22.762643683Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Elapsed":0.07}
+{"Time":"2026-10-18T08:47:22.762658589Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope"}
+{"Time":"2026-10-18T08:47:22.762664675Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope\n"}
+{"Time":"2026-10-18T08:47:22.877583866Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope (0.12s)\n"}
+{"Time":"2026-10-18T08:47:22.877661883Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Elapsed":0.12}
+{"Time":"2026-10-18T08:47:22.877672677Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type"}
+{"Time":"2026-10-18T08:47:22.877677284Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type\n"}
+{"Time":"2026-10-18T08:47:22.959989117Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type (0.08s)\n"}
+{"Time":"2026-10-18T08:47:22.96003717Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Elapsed":0.08}
+{"Time":"2026-10-18T08:47:22.960050245Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field"}
+{"Time":"2026-10-18T08:47:22.960056512Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field\n"}
+{"Time":"2026-10-18T08:47:23.101147385Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field (0.14s)\n"}
+{"Time":"2026-10-18T08:47:23.101217134Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Elapsed":0.14}
+{"Time":"2026-10-18T08:47:23.101229559Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active"}
+{"Time":"2026-10-18T08:47:23.101236368Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active\n"}
+{"Time":"2026-10-18T08:47:23.211522835Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active (0.11s)\n"}
+{"Time":"2026-10-18T08:47:23.211568949Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Elapsed":0.11}
+{"Time":"2026-10-18T08:47:23.211583214Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json"}
+{"Time":"2026-10-18T08:47:23.211587687Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json\n"}
+{"Time":"2026-10-18T08:47:23.344179408Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json (0.13s)\n"}
+{"Time":"2026-10-18T08:47:23.344225036Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Elapsed":0.13}
+{"Time":"2026-10-18T08:47:23.3442506Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect"}
+{"Time":"2026-10-18T08:47:23.344259689Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect\n"}
+{"Time":"2026-10-18T08:47:23.442627711Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect (0.10s)\n"}
+{"Time":"2026-10-18T08:47:23.442672933Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:23.442682617Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable"}
+{"Time":"2026-10-18T08:47:23.442687108Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable\n"}
+{"Time":"2026-10-18T08:47:23.582698758Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable (0.14s)\n"}
+{"Time":"2026-10-18T08:47:23.582740391Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Elapsed":0.14}
+{"Time":"2026-10-18T08:47:23.582749652Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize"}
+{"Time":"2026-10-18T08:47:23.582754259Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize\n"}
+{"Time":"2026-10-18T08:47:23.774596079Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize (0.19s)\n"}
+{"Time":"2026-10-18T08:47:23.774646296Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Elapsed":0.19}
+{"Time":"2026-10-18T08:47:23.774659245Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached"}
+{"Time":"2026-10-18T08:47:23.774665926Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached\n"}
+{"Time":"2026-10-18T08:47:23.914702611Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached (0.14s)\n"}
+{"Time":"2026-10-18T08:47:23.914756083Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Elapsed":0.14}
+{"Time":"2026-10-18T08:47:23.914768608Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type"}
+{"Time":"2026-10-18T08:47:23.914776246Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type\n"}
+{"Time":"2026-10-18T08:47:24.020878865Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type (0.11s)\n"}
+{"Time":"2026-10-18T08:47:24.02093837Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Elapsed":0.11}
+{"Time":"2026-10-18T08:47:24.020949182Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus (2.36s)\n"}
+{"Time":"2026-10-18T08:47:24.020955746Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Elapsed":2.36}
+{"Time":"2026-10-18T08:47:24.020964673Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope"}
+{"Time":"2026-10-18T08:47:24.020969696Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"=== RUN   TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope\n"}
+{"Time":"2026-10-18T08:47:24.204319118Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"--- PASS: TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope (0.18s)\n"}
+{"Time":"2026-10-18T08:47:24.20436094Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Elapsed":0.18}
+{"Time":"2026-10-18T08:47:24.204371517Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles"}
+{"Time":"2026-10-18T08:47:24.204376071Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles\n"}
+{"Time":"2026-10-18T08:47:24.204394313Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret"}
+{"Time":"2026-10-18T08:47:24.204398452Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret\n"}
+{"Time":"2026-10-18T08:47:24.455937947Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret (0.25s)\n"}
+{"Time":"2026-10-18T08:47:24.456002619Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Elapsed":0.25}
+{"Time":"2026-10-18T08:47:24.456022754Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys"}
+{"Time":"2026-10-18T08:47:24.456031357Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/keys\n"}
+{"Time":"2026-10-18T08:47:24.573489827Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/keys (0.12s)\n"}
+{"Time":"2026-10-18T08:47:24.57353962Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Elapsed":0.12}
+{"Time":"2026-10-18T08:47:24.5735521Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca"}
+{"Time":"2026-10-18T08:47:24.573563416Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/ca\n"}
+{"Time":"2026-10-18T08:47:24.652166912Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/ca (0.08s)\n"}
+{"Time":"2026-10-18T08:47:24.652216669Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Elapsed":0.08}
+{"Time":"2026-10-18T08:47:24.652226471Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable"}
+{"Time":"2026-10-18T08:47:24.652229862Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable\n"}
+{"Time":"2026-10-18T08:47:24.728594063Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable (0.08s)\n"}
+{"Time":"2026-10-18T08:47:24.728653171Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Elapsed":0.08}
+{"Time":"2026-10-18T08:47:24.728663722Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable"}
+{"Time":"2026-10-18T08:47:24.728671738Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable\n"}
+{"Time":"2026-10-18T08:47:24.830174607Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable (0.10s)\n"}
+{"Time":"2026-10-18T08:47:24.830234022Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:24.83024844Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo"}
+{"Time":"2026-10-18T08:47:24.830255636Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo\n"}
+{"Time":"2026-10-18T08:47:24.931415517Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo (0.10s)\n"}
+{"Time":"2026-10-18T08:47:24.931472713Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:24.931487727Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles (0.73s)\n"}
+{"Time":"2026-10-18T08:47:24.931495446Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Elapsed":0.73}
+{"Time":"2026-10-18T08:47:24.931674456Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus"}
+{"Time":"2026-10-18T08:47:24.931692418Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus\n"}
+{"Time":"2026-10-18T08:47:24.931711183Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry"}
+{"Time":"2026-10-18T08:47:24.931717919Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry\n"}
+{"Time":"2026-10-18T08:47:25.01767421Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry (0.09s)\n"}
+{"Time":"2026-10-18T08:47:25.017715446Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Elapsed":0.09}
+{"Time":"2026-10-18T08:47:25.017727872Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards"}
+{"Time":"2026-10-18T08:47:25.017731821Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards\n"}
+{"Time":"2026-10-18T08:47:25.109905204Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards (0.09s)\n"}
+{"Time":"2026-10-18T08:47:25.109944105Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Elapsed":0.09}
+{"Time":"2026-10-18T08:47:25.110039634Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key"}
+{"Time":"2026-10-18T08:47:25.110047803Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key\n"}
+{"Time":"2026-10-18T08:47:25.184581091Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key (0.07s)\n"}
+{"Time":"2026-10-18T08:47:25.184630136Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Elapsed":0.07}
+{"Time":"2026-10-18T08:47:25.184788547Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus (0.25s)\n"}
+{"Time":"2026-10-18T08:47:25.184888016Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Elapsed":0.25}
+{"Time":"2026-10-18T08:47:25.185078681Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs"}
+{"Time":"2026-10-18T08:47:25.185095588Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"=== RUN   TestOnlineCancellationAndAmbientProxyDoNotLeakInputs\n"}
+{"Time":"2026-10-18T08:47:25.252063767Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"--- PASS: TestOnlineCancellationAndAmbientProxyDoNotLeakInputs (0.07s)\n"}
+{"Time":"2026-10-18T08:47:25.252109241Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Elapsed":0.07}
+{"Time":"2026-10-18T08:47:25.25212164Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus"}
+{"Time":"2026-10-18T08:47:25.252127961Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"=== RUN   TestOnlineMalformedAdmissionAndNegativeStatus\n"}
+{"Time":"2026-10-18T08:47:25.467710322Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"--- PASS: TestOnlineMalformedAdmissionAndNegativeStatus (0.22s)\n"}
+{"Time":"2026-10-18T08:47:25.46776622Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Elapsed":0.22}
+{"Time":"2026-10-18T08:47:25.467794643Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier"}
+{"Time":"2026-10-18T08:47:25.467804381Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"=== RUN   TestOnlineUsesSharedTypedJOSEVerifier\n"}
+{"Time":"2026-10-18T08:47:25.564334543Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"--- PASS: TestOnlineUsesSharedTypedJOSEVerifier (0.10s)\n"}
+{"Time":"2026-10-18T08:47:25.564393795Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Elapsed":0.1}
+{"Time":"2026-10-18T08:47:25.564410775Z","Action":"output","Package":"keycape/internal/authclient","Output":"PASS\n"}
+{"Time":"2026-10-18T08:47:26.570558037Z","Action":"output","Package":"keycape/internal/authclient","Output":"ok  \tkeycape/internal/authclient\t7.820s\n"}
+{"Time":"2026-10-18T08:47:26.570601527Z","Action":"pass","Package":"keycape/internal/authclient","Elapsed":7.821}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/freeze_sources.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/freeze_sources.py
new file mode 100644
index 0000000..dd80c51
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/freeze_sources.py
@@ -0,0 +1,54 @@
+"""Freeze owner deltas and prove exact replay; no runtime or custody action."""
+import difflib
+import hashlib
+import io
+import json
+from pathlib import Path
+import subprocess
+import tarfile
+
+HERE = Path(__file__).resolve().parent
+sha = lambda raw: 'sha256:' + hashlib.sha256(raw).hexdigest()
+owners = [
+    ('key-cape', 'git:67a0869c1ee40c9e00a60cb7c1d828734d5d3d32', 'source', 19),
+    ('ops-warden', 'git:b593c879831378db7dc62adfabdfedf2d44ddd38', 'warden-source', 4),
+]
+for owner, base, folder, expected in owners:
+    source = Path('/tmp/custodian-keycape-current-client-r1') / folder
+    target = HERE / (owner + '-source')
+    target.mkdir(exist_ok=False)
+    archive = subprocess.check_output(['git', '-C', '/home/worsch/' + owner, 'archive', base.removeprefix('git:')])
+    with tarfile.open(fileobj=io.BytesIO(archive)) as tar:
+        original = {m.name: tar.extractfile(m).read() for m in tar.getmembers() if m.isfile()}
+    current = {str(p.relative_to(source)): p.read_bytes() for p in source.rglob('*') if p.is_file()}
+    assert not original.keys() - current.keys(), 'unexpected deletion'
+    rows, patch = [], []
+    for name, raw in sorted(current.items()):
+        before = original.get(name)
+        if before == raw:
+            continue
+        if before is not None:
+            p = target / 'preimages' / name
+            p.parent.mkdir(parents=True, exist_ok=True); p.write_bytes(before)
+        p = target / 'postimages' / name
+        p.parent.mkdir(parents=True, exist_ok=True); p.write_bytes(raw)
+        rows.append({'path': name, 'before_sha256': None if before is None else sha(before), 'sha256': sha(raw)})
+        patch.append(f'diff --git a/{name} b/{name}\n')
+        patch.extend(difflib.unified_diff((before or b'').decode().splitlines(keepends=True), raw.decode().splitlines(keepends=True),
+                                        fromfile='/dev/null' if before is None else 'a/' + name, tofile='b/' + name))
+    assert len(rows) == expected, [r['path'] for r in rows]
+    patchfile = target / 'owner-source.patch'; patchfile.write_text(''.join(patch))
+    replay = Path('/tmp/custodian-current-client-frozen-replay-r1') / owner
+    replay.mkdir(parents=True, exist_ok=False)
+    with tarfile.open(fileobj=io.BytesIO(archive)) as tar:
+        tar.extractall(replay, filter='data')
+    result = subprocess.run(['patch', '-p1', '--batch', '--fuzz=0', '-i', str(patchfile)], cwd=replay,
+                            capture_output=True, text=True, check=True)
+    assert all((replay / name).read_bytes() == raw for name, raw in current.items())
+    receipt = {'owner': owner, 'base_revision': base, 'files': rows,
+               'archive_sha256': sha(archive), 'patch_sha256': sha(patchfile.read_bytes()),
+               'replay': {'fuzz': 0, 'all_postimages_exact': True, 'all_unrelated_archive_files_unchanged': True,
+                          'stdout': result.stdout, 'stderr': result.stderr},
+               'independent_owner_assent': False, 'native_admission': False}
+    (target / 'source-manifest.json').write_text(json.dumps(receipt, indent=2) + '\n')
+    print(json.dumps({'owner': owner, 'files': len(rows), 'exact_replay': True}))
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt1.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt1.json
new file mode 100644
index 0000000..61eb588
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt1.json
@@ -0,0 +1,221 @@
+{
+  "returncode": 0,
+  "seconds": 26.84,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "test",
+    "-p",
+    "4",
+    "-race",
+    "-json",
+    "-count=1",
+    "./..."
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a",
+    "src/internal/authclient/online_export_test.go": "sha256:5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f",
+    "src/internal/authclient/online_test.go": "sha256:6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 723,
+    "fail": 0,
+    "skip": 6
+  },
+  "failures": [],
+  "skips": [
+    "keycape/tests/conformance:TestIssuerAdvertisesItself",
+    "keycape/tests/conformance:TestProfileAuthorizationSurface",
+    "keycape/tests/conformance:TestPublishedKeysAreUsable",
+    "keycape/tests/conformance:TestExcludedGrantsAreNotAdvertised",
+    "keycape/tests/conformance:TestServiceTokenVerifiesAgainstPublishedKeys",
+    "keycape/internal/server/oidc:TestNativeOptionalEnrollmentAndOldSession"
+  ],
+  "source": "/tmp/custodian-keycape-current-client-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt1.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt1.jsonl
new file mode 100644
index 0000000..720a4b5
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt1.jsonl
@@ -0,0 +1,3028 @@
+{"Time":"2026-10-18T08:58:07.336238148Z","Action":"start","Package":"keycape/cmd/keycape"}
+{"Time":"2026-10-18T08:58:07.355879175Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey"}
+{"Time":"2026-10-18T08:58:07.355950474Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey","Output":"=== RUN   TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey\n"}
+{"Time":"2026-10-18T08:58:07.358434829Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey","Output":"--- PASS: TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.362918711Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.362982184Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup"}
+{"Time":"2026-10-18T08:58:07.362996341Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup\n"}
+{"Time":"2026-10-18T08:58:07.363017838Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client"}
+{"Time":"2026-10-18T08:58:07.363032581Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/duplicate_client\n"}
+{"Time":"2026-10-18T08:58:07.363048641Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/duplicate_client (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.363055368Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.36306131Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect"}
+{"Time":"2026-10-18T08:58:07.363066152Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/query_in_redirect\n"}
+{"Time":"2026-10-18T08:58:07.36377012Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/query_in_redirect (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.363830391Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.36384169Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided"}
+{"Time":"2026-10-18T08:58:07.363847001Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided\n"}
+{"Time":"2026-10-18T08:58:07.368294993Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.368347844Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.3683565Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing"}
+{"Time":"2026-10-18T08:58:07.368360792Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing\n"}
+{"Time":"2026-10-18T08:58:07.369866329Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.369931424Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.369940892Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client"}
+{"Time":"2026-10-18T08:58:07.369946429Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client\n"}
+{"Time":"2026-10-18T08:58:07.372375235Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.372432107Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.372453397Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup (0.01s)\n"}
+{"Time":"2026-10-18T08:58:07.372469024Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:07.372481422Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem"}
+{"Time":"2026-10-18T08:58:07.372488167Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem","Output":"=== RUN   TestCheckConfigWithoutEnvNamesOnlyListsThem\n"}
+{"Time":"2026-10-18T08:58:07.374396199Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem","Output":"--- PASS: TestCheckConfigWithoutEnvNamesOnlyListsThem (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.374441258Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.374463711Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation"}
+{"Time":"2026-10-18T08:58:07.374474784Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation","Output":"=== RUN   TestServiceRegistrationAudienceAndScopeIsolation\n"}
+{"Time":"2026-10-18T08:58:07.383363119Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation","Output":"--- PASS: TestServiceRegistrationAudienceAndScopeIsolation (0.01s)\n"}
+{"Time":"2026-10-18T08:58:07.383412931Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:07.383432769Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision"}
+{"Time":"2026-10-18T08:58:07.383441921Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision","Output":"=== RUN   TestServiceRegistrationTenantsAreExactPerDecision\n"}
+{"Time":"2026-10-18T08:58:07.387679363Z","Action":"start","Package":"keycape/cmd/keycape-to-keycloak"}
+{"Time":"2026-10-18T08:58:07.387717713Z","Action":"output","Package":"keycape/cmd/keycape-to-keycloak","Output":"?   \tkeycape/cmd/keycape-to-keycloak\t[no test files]\n"}
+{"Time":"2026-10-18T08:58:07.387728011Z","Action":"skip","Package":"keycape/cmd/keycape-to-keycloak","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.387739616Z","Action":"start","Package":"keycape/cmd/lldap-export"}
+{"Time":"2026-10-18T08:58:07.391319841Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision","Output":"--- PASS: TestServiceRegistrationTenantsAreExactPerDecision (0.01s)\n"}
+{"Time":"2026-10-18T08:58:07.391463666Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:07.391482296Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact"}
+{"Time":"2026-10-18T08:58:07.391488292Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact","Output":"=== RUN   TestApproverRegistrationShapeIsExact\n"}
+{"Time":"2026-10-18T08:58:07.399485035Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact","Output":"--- PASS: TestApproverRegistrationShapeIsExact (0.01s)\n"}
+{"Time":"2026-10-18T08:58:07.39960005Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:07.399628906Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact"}
+{"Time":"2026-10-18T08:58:07.399649465Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact","Output":"=== RUN   TestSittingRequesterRegistrationShapeIsExact\n"}
+{"Time":"2026-10-18T08:58:07.407824541Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact","Output":"--- PASS: TestSittingRequesterRegistrationShapeIsExact (0.01s)\n"}
+{"Time":"2026-10-18T08:58:07.407877473Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:07.407891828Z","Action":"output","Package":"keycape/cmd/keycape","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:07.408215674Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword"}
+{"Time":"2026-10-18T08:58:07.408234637Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword","Output":"=== RUN   TestResolveBindPassword\n"}
+{"Time":"2026-10-18T08:58:07.408306676Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins"}
+{"Time":"2026-10-18T08:58:07.408334791Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins","Output":"=== RUN   TestResolveBindPassword/environment_wins\n"}
+{"Time":"2026-10-18T08:58:07.408716464Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins","Output":"--- PASS: TestResolveBindPassword/environment_wins (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.408753336Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.408772092Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed"}
+{"Time":"2026-10-18T08:58:07.408784445Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed","Output":"=== RUN   TestResolveBindPassword/file,_trailing_newline_trimmed\n"}
+{"Time":"2026-10-18T08:58:07.409930745Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed","Output":"--- PASS: TestResolveBindPassword/file,_trailing_newline_trimmed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.409974596Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.409985931Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works"}
+{"Time":"2026-10-18T08:58:07.409991377Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Output":"=== RUN   TestResolveBindPassword/deprecated_flag_still_works\n"}
+{"Time":"2026-10-18T08:58:07.410196907Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Output":"lldap-export: warning: --bind-pw exposes the password to any local user via ps; prefer KEYCAPE_LLDAP_BIND_PW or --bind-pw-file\n"}
+{"Time":"2026-10-18T08:58:07.410217602Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Output":"--- PASS: TestResolveBindPassword/deprecated_flag_still_works (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.410378767Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.41042471Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password"}
+{"Time":"2026-10-18T08:58:07.410430986Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password","Output":"=== RUN   TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password\n"}
+{"Time":"2026-10-18T08:58:07.41122124Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password","Output":"--- PASS: TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.411259202Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.411279392Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected"}
+{"Time":"2026-10-18T08:58:07.41128482Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected","Output":"=== RUN   TestResolveBindPassword/conflicting_sources_are_rejected\n"}
+{"Time":"2026-10-18T08:58:07.411587277Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected","Output":"--- PASS: TestResolveBindPassword/conflicting_sources_are_rejected (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.411606258Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.41162973Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error"}
+{"Time":"2026-10-18T08:58:07.411638747Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error","Output":"=== RUN   TestResolveBindPassword/no_password_at_all_is_an_error\n"}
+{"Time":"2026-10-18T08:58:07.411903241Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error","Output":"--- PASS: TestResolveBindPassword/no_password_at_all_is_an_error (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.411927876Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.412031277Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword","Output":"--- PASS: TestResolveBindPassword (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.412144302Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.412239657Z","Action":"output","Package":"keycape/cmd/lldap-export","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:07.538897976Z","Action":"start","Package":"keycape/cmd/lldap-to-ldap"}
+{"Time":"2026-10-18T08:58:07.538937778Z","Action":"output","Package":"keycape/cmd/lldap-to-ldap","Output":"?   \tkeycape/cmd/lldap-to-ldap\t[no test files]\n"}
+{"Time":"2026-10-18T08:58:07.538948094Z","Action":"skip","Package":"keycape/cmd/lldap-to-ldap","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.538976291Z","Action":"start","Package":"keycape/cmd/validator"}
+{"Time":"2026-10-18T08:58:07.538981566Z","Action":"output","Package":"keycape/cmd/validator","Output":"?   \tkeycape/cmd/validator\t[no test files]\n"}
+{"Time":"2026-10-18T08:58:07.53898557Z","Action":"skip","Package":"keycape/cmd/validator","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.538992756Z","Action":"start","Package":"keycape/internal/adapters/authelia"}
+{"Time":"2026-10-18T08:58:07.99172972Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams"}
+{"Time":"2026-10-18T08:58:07.991777331Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams","Output":"=== RUN   TestAuthorizeURL_ContainsRequiredParams\n"}
+{"Time":"2026-10-18T08:58:07.992157466Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams","Output":"--- PASS: TestAuthorizeURL_ContainsRequiredParams (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.992189765Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.992272904Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL"}
+{"Time":"2026-10-18T08:58:07.992281444Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL","Output":"=== RUN   TestAuthorizeURL_UsesBaseURL\n"}
+{"Time":"2026-10-18T08:58:07.992510978Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL","Output":"--- PASS: TestAuthorizeURL_UsesBaseURL (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.992534197Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.992548976Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured"}
+{"Time":"2026-10-18T08:58:07.992555234Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured","Output":"=== RUN   TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured\n"}
+{"Time":"2026-10-18T08:58:07.992735183Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured","Output":"--- PASS: TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.992761756Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.992775445Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername"}
+{"Time":"2026-10-18T08:58:07.992782911Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername","Output":"=== RUN   TestHandleCallback_Success_PreferredUsername\n"}
+{"Time":"2026-10-18T08:58:07.99722888Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername","Output":"--- PASS: TestHandleCallback_Success_PreferredUsername (0.00s)\n"}
+{"Time":"2026-10-18T08:58:07.997275409Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername","Elapsed":0}
+{"Time":"2026-10-18T08:58:07.997287582Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured"}
+{"Time":"2026-10-18T08:58:07.997291784Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured","Output":"=== RUN   TestHandleCallback_UsesTokenBaseURLWhenConfigured\n"}
+{"Time":"2026-10-18T08:58:08.000793714Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured","Output":"--- PASS: TestHandleCallback_UsesTokenBaseURLWhenConfigured (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.000860631Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.000873814Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP"}
+{"Time":"2026-10-18T08:58:08.00087982Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP","Output":"=== RUN   TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP\n"}
+{"Time":"2026-10-18T08:58:08.000889883Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local"}
+{"Time":"2026-10-18T08:58:08.000901218Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local","Output":"=== RUN   TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local\n"}
+{"Time":"2026-10-18T08:58:08.003953484Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local","Output":"--- PASS: TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.003999653Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.004012286Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091"}
+{"Time":"2026-10-18T08:58:08.00401821Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091","Output":"=== RUN   TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091\n"}
+{"Time":"2026-10-18T08:58:08.007123552Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091","Output":"--- PASS: TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.007187205Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.007200289Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP","Output":"--- PASS: TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP (0.01s)\n"}
+{"Time":"2026-10-18T08:58:08.007212616Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:08.007224185Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders"}
+{"Time":"2026-10-18T08:58:08.007230957Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders","Output":"=== RUN   TestDiscoveryFetch_CarriesPublicOriginHeaders\n"}
+{"Time":"2026-10-18T08:58:08.010465456Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders","Output":"--- PASS: TestDiscoveryFetch_CarriesPublicOriginHeaders (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.010510722Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.010542418Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub"}
+{"Time":"2026-10-18T08:58:08.010555592Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub","Output":"=== RUN   TestHandleCallback_Success_FallsBackToSub\n"}
+{"Time":"2026-10-18T08:58:08.01363232Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub","Output":"--- PASS: TestHandleCallback_Success_FallsBackToSub (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.013691509Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.013704476Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T08:58:08.013711915Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_CallbackError_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T08:58:08.013727759Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_CallbackError_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.013874839Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.013891683Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T08:58:08.01389731Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_HTTPError_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T08:58:08.014595734Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_HTTPError_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.014701804Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.014926692Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T08:58:08.014954916Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T08:58:08.019678514Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.019730138Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.019744205Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T08:58:08.019750634Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T08:58:08.019878724Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.01991987Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.019960412Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens"}
+{"Time":"2026-10-18T08:58:08.019967869Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens","Output":"=== RUN   TestHandleCallback_AuthResultContainsNoRawTokens\n"}
+{"Time":"2026-10-18T08:58:08.023016034Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens","Output":"--- PASS: TestHandleCallback_AuthResultContainsNoRawTokens (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.023061291Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.023069028Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge"}
+{"Time":"2026-10-18T08:58:08.023072409Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge","Output":"=== RUN   TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge\n"}
+{"Time":"2026-10-18T08:58:08.023450583Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge","Output":"--- PASS: TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.023475939Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.02349061Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime"}
+{"Time":"2026-10-18T08:58:08.023502748Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime","Output":"=== RUN   TestHandleCallback_CarriesUpstreamAuthTime\n"}
+{"Time":"2026-10-18T08:58:08.029143813Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime","Output":"--- PASS: TestHandleCallback_CarriesUpstreamAuthTime (0.01s)\n"}
+{"Time":"2026-10-18T08:58:08.029202407Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:08.029215076Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens"}
+{"Time":"2026-10-18T08:58:08.029221271Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens","Output":"=== RUN   TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens\n"}
+{"Time":"2026-10-18T08:58:08.029239215Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local"}
+{"Time":"2026-10-18T08:58:08.029247349Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local","Output":"=== RUN   TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local\n"}
+{"Time":"2026-10-18T08:58:08.031157452Z","Action":"start","Package":"keycape/internal/adapters/lldap"}
+{"Time":"2026-10-18T08:58:08.033021642Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local","Output":"--- PASS: TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.033067079Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.033083915Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091"}
+{"Time":"2026-10-18T08:58:08.033088008Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091","Output":"=== RUN   TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091\n"}
+{"Time":"2026-10-18T08:58:08.036539757Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091","Output":"--- PASS: TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.036595042Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.036610786Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens","Output":"--- PASS: TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens (0.01s)\n"}
+{"Time":"2026-10-18T08:58:08.036625746Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:08.036722203Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange"}
+{"Time":"2026-10-18T08:58:08.036736928Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange","Output":"=== RUN   TestIssuerProbeRefusesUnboundCallbacksBeforeExchange\n"}
+{"Time":"2026-10-18T08:58:08.04028876Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange","Output":"--- PASS: TestIssuerProbeRefusesUnboundCallbacksBeforeExchange (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.040352367Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.040361366Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory"}
+{"Time":"2026-10-18T08:58:08.040369725Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory\n"}
+{"Time":"2026-10-18T08:58:08.047897201Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch"}
+{"Time":"2026-10-18T08:58:08.047947563Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch","Output":"=== RUN   TestUserBaseDNDefaultsToLLDAPsPeopleBranch\n"}
+{"Time":"2026-10-18T08:58:08.048001639Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch","Output":"--- PASS: TestUserBaseDNDefaultsToLLDAPsPeopleBranch (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.048086987Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.048101117Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults"}
+{"Time":"2026-10-18T08:58:08.048107727Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults","Output":"=== RUN   TestExplicitOUOverridesDefaults\n"}
+{"Time":"2026-10-18T08:58:08.048235204Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults","Output":"--- PASS: TestExplicitOUOverridesDefaults (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.048303419Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.048315989Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped"}
+{"Time":"2026-10-18T08:58:08.048320291Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped","Output":"=== RUN   TestRailianceAdminGroupIsExplicitAndScoped\n"}
+{"Time":"2026-10-18T08:58:08.048480987Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped","Output":"--- PASS: TestRailianceAdminGroupIsExplicitAndScoped (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.048549509Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.048570961Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success"}
+{"Time":"2026-10-18T08:58:08.048575515Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success","Output":"=== RUN   TestLookupUser_Success\n"}
+{"Time":"2026-10-18T08:58:08.048782082Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success","Output":"--- PASS: TestLookupUser_Success (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.048793624Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.048800685Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup"}
+{"Time":"2026-10-18T08:58:08.048804824Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup","Output":"=== RUN   TestLookupUser_MapsExplicitTenantAdminGroup\n"}
+{"Time":"2026-10-18T08:58:08.04899956Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup","Output":"--- PASS: TestLookupUser_MapsExplicitTenantAdminGroup (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.049016927Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.049023014Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups"}
+{"Time":"2026-10-18T08:58:08.049027811Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups","Output":"=== RUN   TestLookupUser_IgnoresAmbiguousTenantGroups\n"}
+{"Time":"2026-10-18T08:58:08.049248397Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups","Output":"--- PASS: TestLookupUser_IgnoresAmbiguousTenantGroups (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.049270309Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.049289976Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup"}
+{"Time":"2026-10-18T08:58:08.04929847Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup","Output":"=== RUN   TestLookupUser_MapsEstablishedPlatformAdminGroup\n"}
+{"Time":"2026-10-18T08:58:08.049465885Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup","Output":"--- PASS: TestLookupUser_MapsEstablishedPlatformAdminGroup (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.049479023Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.049507283Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN"}
+{"Time":"2026-10-18T08:58:08.049511854Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN","Output":"=== RUN   TestLookupUser_DisplayName_FallsBackToSN\n"}
+{"Time":"2026-10-18T08:58:08.049691733Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN","Output":"--- PASS: TestLookupUser_DisplayName_FallsBackToSN (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.049710453Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.04972213Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound"}
+{"Time":"2026-10-18T08:58:08.04973333Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound","Output":"=== RUN   TestLookupUser_NotFound\n"}
+{"Time":"2026-10-18T08:58:08.049877817Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound","Output":"--- PASS: TestLookupUser_NotFound (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.049895815Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.049903841Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin"}
+{"Time":"2026-10-18T08:58:08.049908683Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin","Output":"=== RUN   TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin\n"}
+{"Time":"2026-10-18T08:58:08.050113895Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin","Output":"--- PASS: TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.050129242Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.050136618Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success"}
+{"Time":"2026-10-18T08:58:08.050140649Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success","Output":"=== RUN   TestLookupGroups_Success\n"}
+{"Time":"2026-10-18T08:58:08.05031778Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success","Output":"--- PASS: TestLookupGroups_Success (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.05033677Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.050351865Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty"}
+{"Time":"2026-10-18T08:58:08.05035623Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty","Output":"=== RUN   TestLookupGroups_Empty\n"}
+{"Time":"2026-10-18T08:58:08.050601066Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty","Output":"--- PASS: TestLookupGroups_Empty (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.05062039Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.050625647Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success"}
+{"Time":"2026-10-18T08:58:08.050629515Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success","Output":"=== RUN   TestValidatePassword_Success\n"}
+{"Time":"2026-10-18T08:58:08.050854992Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success","Output":"--- PASS: TestValidatePassword_Success (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.050892134Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.050900294Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword"}
+{"Time":"2026-10-18T08:58:08.050904722Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword","Output":"=== RUN   TestValidatePassword_WrongPassword\n"}
+{"Time":"2026-10-18T08:58:08.051109089Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword","Output":"--- PASS: TestValidatePassword_WrongPassword (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.051126203Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.051136104Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure"}
+{"Time":"2026-10-18T08:58:08.051141884Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure","Output":"=== RUN   TestValidatePassword_BindFailure\n"}
+{"Time":"2026-10-18T08:58:08.051329745Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure","Output":"--- PASS: TestValidatePassword_BindFailure (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.051344623Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.051351747Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound"}
+{"Time":"2026-10-18T08:58:08.051355777Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound","Output":"=== RUN   TestValidatePassword_UserNotFound\n"}
+{"Time":"2026-10-18T08:58:08.051443019Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound","Output":"--- PASS: TestValidatePassword_UserNotFound (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.051498872Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.051509251Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers"}
+{"Time":"2026-10-18T08:58:08.051513678Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers","Output":"=== RUN   TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers\n"}
+{"Time":"2026-10-18T08:58:08.051667873Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers","Output":"--- PASS: TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.051679596Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.05168635Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError"}
+{"Time":"2026-10-18T08:58:08.051690534Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError","Output":"=== RUN   TestLDAPAdapter_ListGroups_PropagatesSearchError\n"}
+{"Time":"2026-10-18T08:58:08.051886321Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError","Output":"--- PASS: TestLDAPAdapter_ListGroups_PropagatesSearchError (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.051901912Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.051910307Z","Action":"output","Package":"keycape/internal/adapters/lldap","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:08.083756989Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer"}
+{"Time":"2026-10-18T08:58:08.083816286Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer\n"}
+{"Time":"2026-10-18T08:58:08.086801584Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.086910855Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.086923335Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience"}
+{"Time":"2026-10-18T08:58:08.086929196Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience\n"}
+{"Time":"2026-10-18T08:58:08.090165027Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.090202855Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.09021574Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired"}
+{"Time":"2026-10-18T08:58:08.090225948Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired\n"}
+{"Time":"2026-10-18T08:58:08.093308097Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.093363644Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.093375005Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce"}
+{"Time":"2026-10-18T08:58:08.093382931Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce\n"}
+{"Time":"2026-10-18T08:58:08.096291679Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.096329011Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.096337749Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature"}
+{"Time":"2026-10-18T08:58:08.096343952Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature\n"}
+{"Time":"2026-10-18T08:58:08.09924858Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.099288093Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.099297363Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys"}
+{"Time":"2026-10-18T08:58:08.099303729Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys\n"}
+{"Time":"2026-10-18T08:58:08.101914629Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.101936964Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.101944954Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused"}
+{"Time":"2026-10-18T08:58:08.101951212Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused\n"}
+{"Time":"2026-10-18T08:58:08.104481172Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.104525889Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.104538846Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed"}
+{"Time":"2026-10-18T08:58:08.104545095Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed\n"}
+{"Time":"2026-10-18T08:58:08.107142334Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.107192415Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.107201667Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize"}
+{"Time":"2026-10-18T08:58:08.107207889Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize\n"}
+{"Time":"2026-10-18T08:58:08.130168399Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize (0.02s)\n"}
+{"Time":"2026-10-18T08:58:08.130244153Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize","Elapsed":0.02}
+{"Time":"2026-10-18T08:58:08.130258328Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory (0.09s)\n"}
+{"Time":"2026-10-18T08:58:08.130267408Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:08.130276263Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration"}
+{"Time":"2026-10-18T08:58:08.130283838Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration","Output":"=== RUN   TestIssuerProbeBoundsLifetimeAndConfiguration\n"}
+{"Time":"2026-10-18T08:58:08.131725563Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration","Output":"--- PASS: TestIssuerProbeBoundsLifetimeAndConfiguration (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.131817206Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.131921057Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments"}
+{"Time":"2026-10-18T08:58:08.131928596Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments","Output":"=== RUN   TestIssuerProbeErrorsDoNotPrintArguments\n"}
+{"Time":"2026-10-18T08:58:08.132252567Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments","Output":"--- PASS: TestIssuerProbeErrorsDoNotPrintArguments (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.132336608Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.132401514Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun"}
+{"Time":"2026-10-18T08:58:08.13240871Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun","Output":"=== RUN   TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun\n"}
+{"Time":"2026-10-18T08:58:08.136574499Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun","Output":"--- PASS: TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.136633255Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.136758153Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine"}
+{"Time":"2026-10-18T08:58:08.136770696Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine","Output":"=== RUN   TestUpstreamTokenIsAcceptedWhenGenuine\n"}
+{"Time":"2026-10-18T08:58:08.140581904Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine","Output":"--- PASS: TestUpstreamTokenIsAcceptedWhenGenuine (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.140632617Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.140641012Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections"}
+{"Time":"2026-10-18T08:58:08.140661977Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections","Output":"=== RUN   TestUpstreamTokenRejections\n"}
+{"Time":"2026-10-18T08:58:08.346493131Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id"}
+{"Time":"2026-10-18T08:58:08.346556053Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id","Output":"=== RUN   TestUpstreamTokenRejections/unknown_key_id\n"}
+{"Time":"2026-10-18T08:58:08.3471891Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id","Output":"--- PASS: TestUpstreamTokenRejections/unknown_key_id (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.347224529Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.347236648Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer"}
+{"Time":"2026-10-18T08:58:08.347242897Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer","Output":"=== RUN   TestUpstreamTokenRejections/wrong_issuer\n"}
+{"Time":"2026-10-18T08:58:08.347882778Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer","Output":"--- PASS: TestUpstreamTokenRejections/wrong_issuer (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.347918711Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.347930208Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client"}
+{"Time":"2026-10-18T08:58:08.347936142Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client","Output":"=== RUN   TestUpstreamTokenRejections/audience_array_without_this_client\n"}
+{"Time":"2026-10-18T08:58:08.348541507Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client","Output":"--- PASS: TestUpstreamTokenRejections/audience_array_without_this_client (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.348566359Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.348573852Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future"}
+{"Time":"2026-10-18T08:58:08.348579281Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future","Output":"=== RUN   TestUpstreamTokenRejections/issued_in_the_future\n"}
+{"Time":"2026-10-18T08:58:08.349118224Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future","Output":"--- PASS: TestUpstreamTokenRejections/issued_in_the_future (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.349143652Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.349150794Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry"}
+{"Time":"2026-10-18T08:58:08.34915643Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry","Output":"=== RUN   TestUpstreamTokenRejections/missing_expiry\n"}
+{"Time":"2026-10-18T08:58:08.34978027Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry","Output":"--- PASS: TestUpstreamTokenRejections/missing_expiry (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.349819288Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.349829143Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key"}
+{"Time":"2026-10-18T08:58:08.349836727Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key","Output":"=== RUN   TestUpstreamTokenRejections/undersized_signing_key\n"}
+{"Time":"2026-10-18T08:58:08.350318699Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key","Output":"--- PASS: TestUpstreamTokenRejections/undersized_signing_key (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.350342414Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.350350521Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set"}
+{"Time":"2026-10-18T08:58:08.350355976Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set","Output":"=== RUN   TestUpstreamTokenRejections/malformed_key_set\n"}
+{"Time":"2026-10-18T08:58:08.350760842Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set","Output":"--- PASS: TestUpstreamTokenRejections/malformed_key_set (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.350777352Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.350792709Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client"}
+{"Time":"2026-10-18T08:58:08.350797857Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client","Output":"=== RUN   TestUpstreamTokenRejections/audience_is_another_client\n"}
+{"Time":"2026-10-18T08:58:08.351524918Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client","Output":"--- PASS: TestUpstreamTokenRejections/audience_is_another_client (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.351554702Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.351565054Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired"}
+{"Time":"2026-10-18T08:58:08.351570266Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired","Output":"=== RUN   TestUpstreamTokenRejections/expired\n"}
+{"Time":"2026-10-18T08:58:08.352199345Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired","Output":"--- PASS: TestUpstreamTokenRejections/expired (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.352216712Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.352222898Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid"}
+{"Time":"2026-10-18T08:58:08.352227804Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid","Output":"=== RUN   TestUpstreamTokenRejections/not_yet_valid\n"}
+{"Time":"2026-10-18T08:58:08.35297069Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid","Output":"--- PASS: TestUpstreamTokenRejections/not_yet_valid (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.353008715Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.353017597Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set"}
+{"Time":"2026-10-18T08:58:08.353024036Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set","Output":"=== RUN   TestUpstreamTokenRejections/empty_key_set\n"}
+{"Time":"2026-10-18T08:58:08.353379459Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set","Output":"--- PASS: TestUpstreamTokenRejections/empty_key_set (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.353398666Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.353405582Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set"}
+{"Time":"2026-10-18T08:58:08.353412102Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set","Output":"=== RUN   TestUpstreamTokenRejections/unreachable_key_set\n"}
+{"Time":"2026-10-18T08:58:08.353721357Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set","Output":"--- PASS: TestUpstreamTokenRejections/unreachable_key_set (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.353741466Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.35374859Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature"}
+{"Time":"2026-10-18T08:58:08.353754992Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature","Output":"=== RUN   TestUpstreamTokenRejections/forged_signature\n"}
+{"Time":"2026-10-18T08:58:08.354391664Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature","Output":"--- PASS: TestUpstreamTokenRejections/forged_signature (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.354431276Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.354440294Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections","Output":"--- PASS: TestUpstreamTokenRejections (0.21s)\n"}
+{"Time":"2026-10-18T08:58:08.354450231Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections","Elapsed":0.21}
+{"Time":"2026-10-18T08:58:08.354458058Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms"}
+{"Time":"2026-10-18T08:58:08.35446382Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms","Output":"=== RUN   TestUpstreamTokenRejectsNonRS256Algorithms\n"}
+{"Time":"2026-10-18T08:58:08.36489344Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms","Output":"--- PASS: TestUpstreamTokenRejectsNonRS256Algorithms (0.01s)\n"}
+{"Time":"2026-10-18T08:58:08.364945163Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:08.36495538Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart"}
+{"Time":"2026-10-18T08:58:08.364961521Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart","Output":"=== RUN   TestUpstreamKeyRotationIsPickedUpWithoutRestart\n"}
+{"Time":"2026-10-18T08:58:08.412088158Z","Action":"output","Package":"keycape/cmd/keycape","Output":"ok  \tkeycape/cmd/keycape\t1.075s\n"}
+{"Time":"2026-10-18T08:58:08.412137744Z","Action":"pass","Package":"keycape/cmd/keycape","Elapsed":1.076}
+{"Time":"2026-10-18T08:58:08.415077475Z","Action":"start","Package":"keycape/internal/adapters/privacyidea"}
+{"Time":"2026-10-18T08:58:08.416562013Z","Action":"output","Package":"keycape/cmd/lldap-export","Output":"ok  \tkeycape/cmd/lldap-export\t1.029s\n"}
+{"Time":"2026-10-18T08:58:08.416633827Z","Action":"pass","Package":"keycape/cmd/lldap-export","Elapsed":1.029}
+{"Time":"2026-10-18T08:58:08.418898202Z","Action":"start","Package":"keycape/internal/adapters/tenantengine"}
+{"Time":"2026-10-18T08:58:08.433271361Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue"}
+{"Time":"2026-10-18T08:58:08.433341975Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue","Output":"=== RUN   TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue\n"}
+{"Time":"2026-10-18T08:58:08.434404616Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue","Output":"--- PASS: TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.434453327Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.434489676Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList"}
+{"Time":"2026-10-18T08:58:08.434502228Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList","Output":"=== RUN   TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList\n"}
+{"Time":"2026-10-18T08:58:08.434762129Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList","Output":"--- PASS: TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.434883159Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.434903447Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse"}
+{"Time":"2026-10-18T08:58:08.434913159Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse","Output":"=== RUN   TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse\n"}
+{"Time":"2026-10-18T08:58:08.435390246Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse","Output":"--- PASS: TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.435426414Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.435444728Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens"}
+{"Time":"2026-10-18T08:58:08.435456433Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens","Output":"=== RUN   TestHasEnrolledFactor_RequireForAllStillListsTokens\n"}
+{"Time":"2026-10-18T08:58:08.435475558Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess"}
+{"Time":"2026-10-18T08:58:08.435483367Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess","Output":"=== RUN   TestRolesReturnsRolesOnSuccess\n"}
+{"Time":"2026-10-18T08:58:08.435982851Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens","Output":"--- PASS: TestHasEnrolledFactor_RequireForAllStillListsTokens (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.436027685Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.436041851Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue"}
+{"Time":"2026-10-18T08:58:08.436046657Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue","Output":"=== RUN   TestHasEnrolledFactor_ActiveToken_ReturnsTrue\n"}
+{"Time":"2026-10-18T08:58:08.436419418Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue","Output":"--- PASS: TestHasEnrolledFactor_ActiveToken_ReturnsTrue (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.436458463Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.436468427Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse"}
+{"Time":"2026-10-18T08:58:08.436473017Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse","Output":"=== RUN   TestCheckMFARequired_NoTokens_ReturnsFalse\n"}
+{"Time":"2026-10-18T08:58:08.437018879Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse","Output":"--- PASS: TestCheckMFARequired_NoTokens_ReturnsFalse (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.437086752Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.437105526Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError"}
+{"Time":"2026-10-18T08:58:08.437112812Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError","Output":"=== RUN   TestCheckMFARequired_HTTPError_ReturnsError\n"}
+{"Time":"2026-10-18T08:58:08.437294031Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError","Output":"--- PASS: TestCheckMFARequired_HTTPError_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.437379163Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.437393897Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError"}
+{"Time":"2026-10-18T08:58:08.437398154Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError","Output":"=== RUN   TestCheckMFARequired_Non200Status_ReturnsError\n"}
+{"Time":"2026-10-18T08:58:08.437636047Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError","Output":"--- PASS: TestCheckMFARequired_Non200Status_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.437652756Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.437693279Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken"}
+{"Time":"2026-10-18T08:58:08.437700006Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken","Output":"=== RUN   TestCheckMFARequired_SendsAdminToken\n"}
+{"Time":"2026-10-18T08:58:08.438182771Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken","Output":"--- PASS: TestCheckMFARequired_SendsAdminToken (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.438247091Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.438276262Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil"}
+{"Time":"2026-10-18T08:58:08.438288417Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil","Output":"=== RUN   TestValidateMFAToken_ValidOTP_ReturnsNil\n"}
+{"Time":"2026-10-18T08:58:08.438719324Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil","Output":"--- PASS: TestValidateMFAToken_ValidOTP_ReturnsNil (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.438744852Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.43875597Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed"}
+{"Time":"2026-10-18T08:58:08.438761444Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed","Output":"=== RUN   TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed\n"}
+{"Time":"2026-10-18T08:58:08.439130039Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed","Output":"--- PASS: TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.439170455Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.439178579Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError"}
+{"Time":"2026-10-18T08:58:08.439182971Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError","Output":"=== RUN   TestValidateMFAToken_HTTPError_ReturnsError\n"}
+{"Time":"2026-10-18T08:58:08.439395501Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError","Output":"--- PASS: TestValidateMFAToken_HTTPError_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.439487946Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.439659129Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError"}
+{"Time":"2026-10-18T08:58:08.43968775Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError","Output":"=== RUN   TestValidateMFAToken_Non200Status_ReturnsError\n"}
+{"Time":"2026-10-18T08:58:08.439950194Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess","Output":"--- PASS: TestRolesReturnsRolesOnSuccess (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.439980943Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.439953392Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError","Output":"--- PASS: TestValidateMFAToken_Non200Status_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.440004821Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.440012909Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm"}
+{"Time":"2026-10-18T08:58:08.440039582Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm","Output":"=== RUN   TestValidateMFAToken_IncludesRealm\n"}
+{"Time":"2026-10-18T08:58:08.440082227Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200"}
+{"Time":"2026-10-18T08:58:08.440096664Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200","Output":"=== RUN   TestRolesFailsOpenOnNon200\n"}
+{"Time":"2026-10-18T08:58:08.440268197Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm","Output":"--- PASS: TestValidateMFAToken_IncludesRealm (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.440288711Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.440415183Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm"}
+{"Time":"2026-10-18T08:58:08.440438114Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm","Output":"=== RUN   TestCheckMFARequired_IncludesRealm\n"}
+{"Time":"2026-10-18T08:58:08.440982185Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm","Output":"--- PASS: TestCheckMFARequired_IncludesRealm (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.441010887Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.441017353Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery"}
+{"Time":"2026-10-18T08:58:08.441021942Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery","Output":"=== RUN   TestCredentialFileRenewalAndFailureRecovery\n"}
+{"Time":"2026-10-18T08:58:08.442650809Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200","Output":"--- PASS: TestRolesFailsOpenOnNon200 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.442705824Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.442716058Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody"}
+{"Time":"2026-10-18T08:58:08.442720477Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody","Output":"=== RUN   TestRolesFailsOpenOnMalformedBody\n"}
+{"Time":"2026-10-18T08:58:08.442740856Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery","Output":"--- PASS: TestCredentialFileRenewalAndFailureRecovery (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.442968559Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.443085648Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues"}
+{"Time":"2026-10-18T08:58:08.443103808Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues\n"}
+{"Time":"2026-10-18T08:58:08.443581993Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous"}
+{"Time":"2026-10-18T08:58:08.443613265Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous\n"}
+{"Time":"2026-10-18T08:58:08.444041711Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.444113713Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.444155247Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty"}
+{"Time":"2026-10-18T08:58:08.444165932Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty\n"}
+{"Time":"2026-10-18T08:58:08.444563945Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.444600807Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.444651683Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline"}
+{"Time":"2026-10-18T08:58:08.444659474Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline\n"}
+{"Time":"2026-10-18T08:58:08.44508384Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.445119585Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.445134671Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized"}
+{"Time":"2026-10-18T08:58:08.44514706Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized\n"}
+{"Time":"2026-10-18T08:58:08.445171966Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody","Output":"--- PASS: TestRolesFailsOpenOnMalformedBody (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.445184951Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.445329654Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure"}
+{"Time":"2026-10-18T08:58:08.445345578Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure","Output":"=== RUN   TestRolesFailsOpenOnConnectionFailure\n"}
+{"Time":"2026-10-18T08:58:08.446067776Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.446096378Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.44611637Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing"}
+{"Time":"2026-10-18T08:58:08.446120427Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing\n"}
+{"Time":"2026-10-18T08:58:08.44613481Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure","Output":"--- PASS: TestRolesFailsOpenOnConnectionFailure (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.446247958Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.446260492Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout"}
+{"Time":"2026-10-18T08:58:08.446264307Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout","Output":"=== RUN   TestRolesFailsOpenOnTimeout\n"}
+{"Time":"2026-10-18T08:58:08.446274478Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.446436444Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.446453162Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory"}
+{"Time":"2026-10-18T08:58:08.446457661Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory\n"}
+{"Time":"2026-10-18T08:58:08.446780578Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.446851481Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.44733935Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.447385194Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.447399342Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2"}
+{"Time":"2026-10-18T08:58:08.447405852Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2","Output":"=== RUN   TestProviderFailureFlagCannotGrantAAL2\n"}
+{"Time":"2026-10-18T08:58:08.447952723Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2","Output":"--- PASS: TestProviderFailureFlagCannotGrantAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.447996214Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.448007936Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects"}
+{"Time":"2026-10-18T08:58:08.448011985Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects","Output":"=== RUN   TestProductionClientDoesNotFollowProviderRedirects\n"}
+{"Time":"2026-10-18T08:58:08.453036769Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects","Output":"--- PASS: TestProductionClientDoesNotFollowProviderRedirects (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.453084542Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.453175806Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal"}
+{"Time":"2026-10-18T08:58:08.453186013Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal","Output":"=== RUN   TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal\n"}
+{"Time":"2026-10-18T08:58:08.454388743Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal","Output":"--- PASS: TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.454422846Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.454530611Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation"}
+{"Time":"2026-10-18T08:58:08.454552712Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation\n"}
+{"Time":"2026-10-18T08:58:08.454728993Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed"}
+{"Time":"2026-10-18T08:58:08.454745242Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/confirmed\n"}
+{"Time":"2026-10-18T08:58:08.45526271Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/confirmed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.455300574Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.455388393Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed"}
+{"Time":"2026-10-18T08:58:08.455398672Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed\n"}
+{"Time":"2026-10-18T08:58:08.455739984Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.455752698Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.455848362Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP"}
+{"Time":"2026-10-18T08:58:08.455912872Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP\n"}
+{"Time":"2026-10-18T08:58:08.456215653Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.456230279Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.456237953Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device"}
+{"Time":"2026-10-18T08:58:08.456242173Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device\n"}
+{"Time":"2026-10-18T08:58:08.456706714Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.456734578Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.456812117Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending"}
+{"Time":"2026-10-18T08:58:08.456822126Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/backend_pending\n"}
+{"Time":"2026-10-18T08:58:08.457134312Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/backend_pending (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.457148397Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.457220661Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state"}
+{"Time":"2026-10-18T08:58:08.457230671Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/missing_state\n"}
+{"Time":"2026-10-18T08:58:08.457469114Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/missing_state (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.457481431Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.457493821Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state"}
+{"Time":"2026-10-18T08:58:08.457498032Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/unknown_state\n"}
+{"Time":"2026-10-18T08:58:08.45776683Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/unknown_state (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.45780298Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.457833783Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment"}
+{"Time":"2026-10-18T08:58:08.45784491Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment\n"}
+{"Time":"2026-10-18T08:58:08.458123225Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.458151115Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.458257422Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.458350715Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.458363979Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup"}
+{"Time":"2026-10-18T08:58:08.458368181Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup","Output":"=== RUN   TestEnrollmentConfirmationChangesDecisionOnNextLookup\n"}
+{"Time":"2026-10-18T08:58:08.459222499Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup","Output":"--- PASS: TestEnrollmentConfirmationChangesDecisionOnNextLookup (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.459273348Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.459290832Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor"}
+{"Time":"2026-10-18T08:58:08.459297586Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor","Output":"=== RUN   TestPendingEnrollmentCannotHideExistingFactor\n"}
+{"Time":"2026-10-18T08:58:08.459486329Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor"}
+{"Time":"2026-10-18T08:58:08.459501902Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor","Output":"=== RUN   TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor\n"}
+{"Time":"2026-10-18T08:58:08.459803355Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor","Output":"--- PASS: TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.459823851Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.459860713Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain"}
+{"Time":"2026-10-18T08:58:08.45986634Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain","Output":"=== RUN   TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain\n"}
+{"Time":"2026-10-18T08:58:08.460230844Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain","Output":"--- PASS: TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.460253649Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.46059873Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor","Output":"--- PASS: TestPendingEnrollmentCannotHideExistingFactor (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.460642003Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.460650958Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2"}
+{"Time":"2026-10-18T08:58:08.460656061Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2\n"}
+{"Time":"2026-10-18T08:58:08.460669506Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough"}
+{"Time":"2026-10-18T08:58:08.460679209Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/password_passthrough\n"}
+{"Time":"2026-10-18T08:58:08.460983291Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/password_passthrough (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.460999522Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.461006826Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token"}
+{"Time":"2026-10-18T08:58:08.461011344Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/static_password_token\n"}
+{"Time":"2026-10-18T08:58:08.46127875Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/static_password_token (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.461291311Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.461305378Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial"}
+{"Time":"2026-10-18T08:58:08.461309562Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/missing_serial\n"}
+{"Time":"2026-10-18T08:58:08.461545571Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/missing_serial (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.461557456Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.461654247Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial"}
+{"Time":"2026-10-18T08:58:08.461678719Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/blank_serial\n"}
+{"Time":"2026-10-18T08:58:08.461895359Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/blank_serial (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.461909128Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.461915323Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type"}
+{"Time":"2026-10-18T08:58:08.461919227Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/missing_factor_type\n"}
+{"Time":"2026-10-18T08:58:08.462162305Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/missing_factor_type (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.46218025Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.462187112Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type"}
+{"Time":"2026-10-18T08:58:08.462191107Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type\n"}
+{"Time":"2026-10-18T08:58:08.462465601Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.462488955Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.462512707Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed"}
+{"Time":"2026-10-18T08:58:08.462517648Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed\n"}
+{"Time":"2026-10-18T08:58:08.462758472Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.462770654Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.462795001Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed"}
+{"Time":"2026-10-18T08:58:08.462805668Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed\n"}
+{"Time":"2026-10-18T08:58:08.463096159Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.463123436Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.463196476Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.463279705Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.463290751Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses"}
+{"Time":"2026-10-18T08:58:08.463294755Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses\n"}
+{"Time":"2026-10-18T08:58:08.463406361Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}"}
+{"Time":"2026-10-18T08:58:08.463416334Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{}\n"}
+{"Time":"2026-10-18T08:58:08.463611239Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.463629445Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.463716444Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}"}
+{"Time":"2026-10-18T08:58:08.463727778Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}\n"}
+{"Time":"2026-10-18T08:58:08.463966429Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.463982894Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.463994436Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}"}
+{"Time":"2026-10-18T08:58:08.463999098Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}\n"}
+{"Time":"2026-10-18T08:58:08.464245846Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.464271293Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.46428178Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}"}
+{"Time":"2026-10-18T08:58:08.464286478Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}\n"}
+{"Time":"2026-10-18T08:58:08.464511323Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.464526166Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.464608421Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}"}
+{"Time":"2026-10-18T08:58:08.464618647Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}\n"}
+{"Time":"2026-10-18T08:58:08.464842238Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.464856639Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.464888884Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}"}
+{"Time":"2026-10-18T08:58:08.464894304Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}\n"}
+{"Time":"2026-10-18T08:58:08.465120357Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.465134514Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.465151638Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}"}
+{"Time":"2026-10-18T08:58:08.4651663Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}\n"}
+{"Time":"2026-10-18T08:58:08.465639453Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.465663782Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.465670572Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}"}
+{"Time":"2026-10-18T08:58:08.465675396Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}\n"}
+{"Time":"2026-10-18T08:58:08.46568151Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}} (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.465688895Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.46577849Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.46581776Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.465899971Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination"}
+{"Time":"2026-10-18T08:58:08.465910304Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination","Output":"=== RUN   TestEnrollmentLookupFiltersBeforePagination\n"}
+{"Time":"2026-10-18T08:58:08.466138242Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination","Output":"--- PASS: TestEnrollmentLookupFiltersBeforePagination (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.466150993Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.466157747Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope"}
+{"Time":"2026-10-18T08:58:08.466161913Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope\n"}
+{"Time":"2026-10-18T08:58:08.466270958Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible"}
+{"Time":"2026-10-18T08:58:08.466294295Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/scope_visible\n"}
+{"Time":"2026-10-18T08:58:08.466629396Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/scope_visible (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.466650425Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.466657873Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn"}
+{"Time":"2026-10-18T08:58:08.466661841Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn\n"}
+{"Time":"2026-10-18T08:58:08.467006471Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.467030231Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.467107329Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user"}
+{"Time":"2026-10-18T08:58:08.467117635Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user\n"}
+{"Time":"2026-10-18T08:58:08.46749113Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.467514169Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.467600798Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm"}
+{"Time":"2026-10-18T08:58:08.467610906Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/different_realm\n"}
+{"Time":"2026-10-18T08:58:08.467933615Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/different_realm (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.467946122Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.467968205Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.468055348Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.468068306Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor"}
+{"Time":"2026-10-18T08:58:08.468072715Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor","Output":"=== RUN   TestNoProbeConfigurationCannotMeanNoFactor\n"}
+{"Time":"2026-10-18T08:58:08.468324107Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor","Output":"--- PASS: TestNoProbeConfigurationCannotMeanNoFactor (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.468336758Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.468406426Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:08.496499905Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart","Output":"--- PASS: TestUpstreamKeyRotationIsPickedUpWithoutRestart (0.13s)\n"}
+{"Time":"2026-10-18T08:58:08.496554523Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart","Elapsed":0.13}
+{"Time":"2026-10-18T08:58:08.496566137Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable"}
+{"Time":"2026-10-18T08:58:08.49657317Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable","Output":"=== RUN   TestFailureReasonsAreDistinguishable\n"}
+{"Time":"2026-10-18T08:58:08.506797901Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable"}
+{"Time":"2026-10-18T08:58:08.506886892Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable","Output":"=== RUN   TestFailureReasonsAreDistinguishable/keys_unavailable\n"}
+{"Time":"2026-10-18T08:58:08.507196355Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable","Output":"--- PASS: TestFailureReasonsAreDistinguishable/keys_unavailable (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.507226734Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.507244931Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch"}
+{"Time":"2026-10-18T08:58:08.507252181Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch","Output":"=== RUN   TestFailureReasonsAreDistinguishable/issuer_mismatch\n"}
+{"Time":"2026-10-18T08:58:08.507852684Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch","Output":"--- PASS: TestFailureReasonsAreDistinguishable/issuer_mismatch (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.507880151Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.507889412Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch"}
+{"Time":"2026-10-18T08:58:08.507896238Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch","Output":"=== RUN   TestFailureReasonsAreDistinguishable/audience_mismatch\n"}
+{"Time":"2026-10-18T08:58:08.508478482Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch","Output":"--- PASS: TestFailureReasonsAreDistinguishable/audience_mismatch (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.508499158Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.508505957Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired"}
+{"Time":"2026-10-18T08:58:08.508529375Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired","Output":"=== RUN   TestFailureReasonsAreDistinguishable/expired\n"}
+{"Time":"2026-10-18T08:58:08.509035089Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired","Output":"--- PASS: TestFailureReasonsAreDistinguishable/expired (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.509054016Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.509063088Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature"}
+{"Time":"2026-10-18T08:58:08.509068534Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature","Output":"=== RUN   TestFailureReasonsAreDistinguishable/signature\n"}
+{"Time":"2026-10-18T08:58:08.509696901Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature","Output":"--- PASS: TestFailureReasonsAreDistinguishable/signature (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.509714196Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.509724314Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable","Output":"--- PASS: TestFailureReasonsAreDistinguishable (0.01s)\n"}
+{"Time":"2026-10-18T08:58:08.50980931Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:08.509824504Z","Action":"output","Package":"keycape/internal/adapters/authelia","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:08.548875288Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout","Output":"--- PASS: TestRolesFailsOpenOnTimeout (0.10s)\n"}
+{"Time":"2026-10-18T08:58:08.548919346Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:08.549095173Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient"}
+{"Time":"2026-10-18T08:58:08.549105489Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient","Output":"=== RUN   TestRolesFailsOpenOnNilClient\n"}
+{"Time":"2026-10-18T08:58:08.549113875Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient","Output":"--- PASS: TestRolesFailsOpenOnNilClient (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.549120512Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.549126914Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL"}
+{"Time":"2026-10-18T08:58:08.549132162Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL","Output":"=== RUN   TestRolesFailsOpenOnEmptyBaseURL\n"}
+{"Time":"2026-10-18T08:58:08.549347711Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL","Output":"--- PASS: TestRolesFailsOpenOnEmptyBaseURL (0.00s)\n"}
+{"Time":"2026-10-18T08:58:08.549363815Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL","Elapsed":0}
+{"Time":"2026-10-18T08:58:08.549468127Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:09.054856134Z","Action":"output","Package":"keycape/internal/adapters/lldap","Output":"ok  \tkeycape/internal/adapters/lldap\t1.024s\n"}
+{"Time":"2026-10-18T08:58:09.054913367Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Elapsed":1.024}
+{"Time":"2026-10-18T08:58:09.472992585Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Output":"ok  \tkeycape/internal/adapters/privacyidea\t1.058s\n"}
+{"Time":"2026-10-18T08:58:09.473045399Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Elapsed":1.058}
+{"Time":"2026-10-18T08:58:09.516743929Z","Action":"output","Package":"keycape/internal/adapters/authelia","Output":"ok  \tkeycape/internal/adapters/authelia\t1.978s\n"}
+{"Time":"2026-10-18T08:58:09.516790116Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Elapsed":1.978}
+{"Time":"2026-10-18T08:58:09.553748838Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Output":"ok  \tkeycape/internal/adapters/tenantengine\t1.135s\n"}
+{"Time":"2026-10-18T08:58:09.553817703Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Elapsed":1.135}
+{"Time":"2026-10-18T08:58:09.632055462Z","Action":"start","Package":"keycape/internal/authclient"}
+{"Time":"2026-10-18T08:58:09.651113879Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation"}
+{"Time":"2026-10-18T08:58:09.651170011Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation","Output":"=== RUN   TestServiceExchangeAndClaimValidation\n"}
+{"Time":"2026-10-18T08:58:10.219027209Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation","Output":"--- PASS: TestServiceExchangeAndClaimValidation (0.57s)\n"}
+{"Time":"2026-10-18T08:58:10.219085641Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation","Elapsed":0.57}
+{"Time":"2026-10-18T08:58:10.219097724Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState"}
+{"Time":"2026-10-18T08:58:10.219104207Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState","Output":"=== RUN   TestBrowserLoginPKCEAndState\n"}
+{"Time":"2026-10-18T08:58:10.35362139Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState","Output":"--- PASS: TestBrowserLoginPKCEAndState (0.13s)\n"}
+{"Time":"2026-10-18T08:58:10.353682419Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState","Elapsed":0.13}
+{"Time":"2026-10-18T08:58:10.353698326Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks"}
+{"Time":"2026-10-18T08:58:10.35370507Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks","Output":"=== RUN   TestLoginRejectsUnsafeCallbacks\n"}
+{"Time":"2026-10-18T08:58:10.475070336Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks","Output":"--- PASS: TestLoginRejectsUnsafeCallbacks (0.12s)\n"}
+{"Time":"2026-10-18T08:58:10.475124846Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:10.475133015Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOutputProtection"}
+{"Time":"2026-10-18T08:58:10.475136812Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOutputProtection","Output":"=== RUN   TestOutputProtection\n"}
+{"Time":"2026-10-18T08:58:10.476323896Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOutputProtection","Output":"--- PASS: TestOutputProtection (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.476398568Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOutputProtection","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.47640975Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries"}
+{"Time":"2026-10-18T08:58:10.476415376Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries","Output":"=== RUN   TestDiscoveryAndRedirectBoundaries\n"}
+{"Time":"2026-10-18T08:58:10.493077761Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries","Output":"--- PASS: TestDiscoveryAndRedirectBoundaries (0.02s)\n"}
+{"Time":"2026-10-18T08:58:10.493130503Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries","Elapsed":0.02}
+{"Time":"2026-10-18T08:58:10.49313924Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin"}
+{"Time":"2026-10-18T08:58:10.493144083Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin","Output":"=== RUN   TestNonceMismatchAndCancelledLogin\n"}
+{"Time":"2026-10-18T08:58:10.581633818Z","Action":"start","Package":"keycape/internal/config"}
+{"Time":"2026-10-18T08:58:10.602152929Z","Action":"run","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS"}
+{"Time":"2026-10-18T08:58:10.602203976Z","Action":"output","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS","Output":"=== RUN   TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS\n"}
+{"Time":"2026-10-18T08:58:10.603976485Z","Action":"output","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS","Output":"--- PASS: TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.607141658Z","Action":"pass","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.607248315Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML"}
+{"Time":"2026-10-18T08:58:10.607262256Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML","Output":"=== RUN   TestLoad_ValidYAML\n"}
+{"Time":"2026-10-18T08:58:10.607276737Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML","Output":"--- PASS: TestLoad_ValidYAML (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.607288902Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.60729681Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs"}
+{"Time":"2026-10-18T08:58:10.607302157Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs","Output":"=== RUN   TestLoad_AutheliaSplitURLs\n"}
+{"Time":"2026-10-18T08:58:10.609321208Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs","Output":"--- PASS: TestLoad_AutheliaSplitURLs (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.609368738Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.609381966Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL"}
+{"Time":"2026-10-18T08:58:10.609387413Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL","Output":"=== RUN   TestLoad_ClientMFAAndRegistrationURL\n"}
+{"Time":"2026-10-18T08:58:10.610886458Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL","Output":"--- PASS: TestLoad_ClientMFAAndRegistrationURL (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.610939615Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.610950337Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL"}
+{"Time":"2026-10-18T08:58:10.610956225Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL","Output":"=== RUN   TestValidate_InvalidRegistrationURL\n"}
+{"Time":"2026-10-18T08:58:10.611545538Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL","Output":"--- PASS: TestValidate_InvalidRegistrationURL (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.611593384Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.611630922Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll"}
+{"Time":"2026-10-18T08:58:10.611637406Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll","Output":"=== RUN   TestLoad_PrivacyIDEARequireForAll\n"}
+{"Time":"2026-10-18T08:58:10.613776515Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll","Output":"--- PASS: TestLoad_PrivacyIDEARequireForAll (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.613836227Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.613857111Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits"}
+{"Time":"2026-10-18T08:58:10.613864099Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits","Output":"=== RUN   TestLoad_LLDAPOrganisationalUnits\n"}
+{"Time":"2026-10-18T08:58:10.61571892Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits","Output":"--- PASS: TestLoad_LLDAPOrganisationalUnits (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.615771662Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.615787199Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound"}
+{"Time":"2026-10-18T08:58:10.615792726Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound","Output":"=== RUN   TestLoad_FileNotFound\n"}
+{"Time":"2026-10-18T08:58:10.616311615Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound","Output":"--- PASS: TestLoad_FileNotFound (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.616335655Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.616361183Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML"}
+{"Time":"2026-10-18T08:58:10.616367919Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML","Output":"=== RUN   TestLoad_InvalidYAML\n"}
+{"Time":"2026-10-18T08:58:10.617098226Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML","Output":"--- PASS: TestLoad_InvalidYAML (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.617150147Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.617168759Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig"}
+{"Time":"2026-10-18T08:58:10.617175648Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig","Output":"=== RUN   TestValidate_ValidConfig\n"}
+{"Time":"2026-10-18T08:58:10.617690424Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig","Output":"--- PASS: TestValidate_ValidConfig (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.617725312Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.617742589Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer"}
+{"Time":"2026-10-18T08:58:10.617757369Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer","Output":"=== RUN   TestValidate_MissingIssuer\n"}
+{"Time":"2026-10-18T08:58:10.618318539Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer","Output":"--- PASS: TestValidate_MissingIssuer (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.618346862Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.618391903Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL"}
+{"Time":"2026-10-18T08:58:10.618404843Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL","Output":"=== RUN   TestValidate_InvalidIssuerURL\n"}
+{"Time":"2026-10-18T08:58:10.619408733Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL","Output":"--- PASS: TestValidate_InvalidIssuerURL (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.619448472Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.619466146Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_PortZero"}
+{"Time":"2026-10-18T08:58:10.619473351Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortZero","Output":"=== RUN   TestValidate_PortZero\n"}
+{"Time":"2026-10-18T08:58:10.620083963Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortZero","Output":"--- PASS: TestValidate_PortZero (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.620123991Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_PortZero","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.620142819Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh"}
+{"Time":"2026-10-18T08:58:10.620149645Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh","Output":"=== RUN   TestValidate_PortTooHigh\n"}
+{"Time":"2026-10-18T08:58:10.620817228Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh","Output":"--- PASS: TestValidate_PortTooHigh (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.620859086Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.620871205Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_NoClients"}
+{"Time":"2026-10-18T08:58:10.620876913Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_NoClients","Output":"=== RUN   TestValidate_NoClients\n"}
+{"Time":"2026-10-18T08:58:10.621468823Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_NoClients","Output":"--- PASS: TestValidate_NoClients (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.621503386Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_NoClients","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.621536281Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI"}
+{"Time":"2026-10-18T08:58:10.621577679Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI","Output":"=== RUN   TestValidate_ClientMissingRedirectURI\n"}
+{"Time":"2026-10-18T08:58:10.622248391Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI","Output":"--- PASS: TestValidate_ClientMissingRedirectURI (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.622300448Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.622311287Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM"}
+{"Time":"2026-10-18T08:58:10.622318627Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM","Output":"=== RUN   TestValidate_MissingPrivateKeyPEM\n"}
+{"Time":"2026-10-18T08:58:10.62257955Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM","Output":"--- PASS: TestValidate_MissingPrivateKeyPEM (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.622717379Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.622789751Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime"}
+{"Time":"2026-10-18T08:58:10.622872015Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime","Output":"=== RUN   TestValidate_ClientCredentialsTokenLifetime\n"}
+{"Time":"2026-10-18T08:58:10.6237085Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime","Output":"--- PASS: TestValidate_ClientCredentialsTokenLifetime (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.623756598Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.623775417Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime"}
+{"Time":"2026-10-18T08:58:10.623781495Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime","Output":"=== RUN   TestValidate_PublicClientRejectsTokenLifetime\n"}
+{"Time":"2026-10-18T08:58:10.624503687Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime","Output":"--- PASS: TestValidate_PublicClientRejectsTokenLifetime (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.624547754Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.624564968Z","Action":"run","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts"}
+{"Time":"2026-10-18T08:58:10.624570568Z","Action":"output","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts","Output":"=== RUN   TestServiceClientExampleContracts\n"}
+{"Time":"2026-10-18T08:58:10.632284788Z","Action":"output","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts","Output":"--- PASS: TestServiceClientExampleContracts (0.01s)\n"}
+{"Time":"2026-10-18T08:58:10.632332769Z","Action":"pass","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:10.632434285Z","Action":"run","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback"}
+{"Time":"2026-10-18T08:58:10.632447432Z","Action":"output","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback","Output":"=== RUN   TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback\n"}
+{"Time":"2026-10-18T08:58:10.637066241Z","Action":"output","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback","Output":"--- PASS: TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.637548063Z","Action":"pass","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.637595845Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar"}
+{"Time":"2026-10-18T08:58:10.637604782Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar","Output":"=== RUN   TestLoad_FromEnvVar\n"}
+{"Time":"2026-10-18T08:58:10.638497913Z","Action":"start","Package":"keycape/internal/domain"}
+{"Time":"2026-10-18T08:58:10.639379189Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar","Output":"--- PASS: TestLoad_FromEnvVar (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.639425818Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.63955554Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidateConfigAudience"}
+{"Time":"2026-10-18T08:58:10.639569859Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidateConfigAudience","Output":"=== RUN   TestValidateConfigAudience\n"}
+{"Time":"2026-10-18T08:58:10.639761999Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidateConfigAudience","Output":"--- PASS: TestValidateConfigAudience (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.639880628Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidateConfigAudience","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.63993356Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine"}
+{"Time":"2026-10-18T08:58:10.639941612Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine","Output":"=== RUN   TestValidate_TenantEngine\n"}
+{"Time":"2026-10-18T08:58:10.639961775Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid"}
+{"Time":"2026-10-18T08:58:10.639968546Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid","Output":"=== RUN   TestValidate_TenantEngine/absent_is_valid\n"}
+{"Time":"2026-10-18T08:58:10.640522033Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid","Output":"--- PASS: TestValidate_TenantEngine/absent_is_valid (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.640573918Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.640594532Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout"}
+{"Time":"2026-10-18T08:58:10.640602818Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout","Output":"=== RUN   TestValidate_TenantEngine/https_url_and_timeout\n"}
+{"Time":"2026-10-18T08:58:10.641214252Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout","Output":"--- PASS: TestValidate_TenantEngine/https_url_and_timeout (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.641273252Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.641284046Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme"}
+{"Time":"2026-10-18T08:58:10.641290638Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme","Output":"=== RUN   TestValidate_TenantEngine/wrong_scheme\n"}
+{"Time":"2026-10-18T08:58:10.64172552Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme","Output":"--- PASS: TestValidate_TenantEngine/wrong_scheme (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.641758424Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.641768794Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long"}
+{"Time":"2026-10-18T08:58:10.641773816Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long","Output":"=== RUN   TestValidate_TenantEngine/timeout_far_too_long\n"}
+{"Time":"2026-10-18T08:58:10.642151966Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long","Output":"--- PASS: TestValidate_TenantEngine/timeout_far_too_long (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.642176818Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.642185961Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url"}
+{"Time":"2026-10-18T08:58:10.642190975Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url","Output":"=== RUN   TestValidate_TenantEngine/timeout_without_url\n"}
+{"Time":"2026-10-18T08:58:10.642499798Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url","Output":"--- PASS: TestValidate_TenantEngine/timeout_without_url (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.64252758Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.642564659Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url"}
+{"Time":"2026-10-18T08:58:10.64257979Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url","Output":"=== RUN   TestValidate_TenantEngine/http_url\n"}
+{"Time":"2026-10-18T08:58:10.643070662Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url","Output":"--- PASS: TestValidate_TenantEngine/http_url (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.643110825Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.643125748Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url"}
+{"Time":"2026-10-18T08:58:10.643133386Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url","Output":"=== RUN   TestValidate_TenantEngine/not_a_url\n"}
+{"Time":"2026-10-18T08:58:10.643524175Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url","Output":"--- PASS: TestValidate_TenantEngine/not_a_url (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.643546394Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.643601183Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout"}
+{"Time":"2026-10-18T08:58:10.643620371Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout","Output":"=== RUN   TestValidate_TenantEngine/unparseable_timeout\n"}
+{"Time":"2026-10-18T08:58:10.643926173Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout","Output":"--- PASS: TestValidate_TenantEngine/unparseable_timeout (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.643948148Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.644063677Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout"}
+{"Time":"2026-10-18T08:58:10.644080314Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout","Output":"=== RUN   TestValidate_TenantEngine/zero_timeout\n"}
+{"Time":"2026-10-18T08:58:10.644467163Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout","Output":"--- PASS: TestValidate_TenantEngine/zero_timeout (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.644494882Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.644511708Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine","Output":"--- PASS: TestValidate_TenantEngine (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.644548986Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.644580988Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients"}
+{"Time":"2026-10-18T08:58:10.644587066Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients\n"}
+{"Time":"2026-10-18T08:58:10.644702351Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject"}
+{"Time":"2026-10-18T08:58:10.644717906Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject\n"}
+{"Time":"2026-10-18T08:58:10.645077694Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.645106928Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.645151049Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles"}
+{"Time":"2026-10-18T08:58:10.64515756Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles\n"}
+{"Time":"2026-10-18T08:58:10.645527682Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.645545906Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.645583904Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client"}
+{"Time":"2026-10-18T08:58:10.645599126Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client\n"}
+{"Time":"2026-10-18T08:58:10.645956804Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.645979157Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.646099718Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client"}
+{"Time":"2026-10-18T08:58:10.646121026Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client\n"}
+{"Time":"2026-10-18T08:58:10.646705315Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.646744171Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.646753558Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected"}
+{"Time":"2026-10-18T08:58:10.646845083Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected\n"}
+{"Time":"2026-10-18T08:58:10.647325243Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.647369311Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.647379879Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.647486201Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.647511891Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID"}
+{"Time":"2026-10-18T08:58:10.647519845Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID","Output":"=== RUN   TestValidate_DuplicateClientID\n"}
+{"Time":"2026-10-18T08:58:10.648023448Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID","Output":"--- PASS: TestValidate_DuplicateClientID (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.648051383Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.648061149Z","Action":"run","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration"}
+{"Time":"2026-10-18T08:58:10.648066767Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration","Output":"=== RUN   TestOptionalMFALoadAndRegistration\n"}
+{"Time":"2026-10-18T08:58:10.649241192Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration","Output":"--- PASS: TestOptionalMFALoadAndRegistration (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.649302834Z","Action":"pass","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.649313213Z","Action":"run","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation"}
+{"Time":"2026-10-18T08:58:10.649320147Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation","Output":"=== RUN   TestOptionalMFAValidation\n"}
+{"Time":"2026-10-18T08:58:10.650408647Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation","Output":"--- PASS: TestOptionalMFAValidation (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.650477728Z","Action":"pass","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.650490298Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS"}
+{"Time":"2026-10-18T08:58:10.65049707Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS\n"}
+{"Time":"2026-10-18T08:58:10.650648859Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy"}
+{"Time":"2026-10-18T08:58:10.650670158Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy\n"}
+{"Time":"2026-10-18T08:58:10.651001043Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.651049041Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.651063821Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default"}
+{"Time":"2026-10-18T08:58:10.65109392Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default\n"}
+{"Time":"2026-10-18T08:58:10.651309117Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.651335528Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.651349992Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded"}
+{"Time":"2026-10-18T08:58:10.651356656Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded\n"}
+{"Time":"2026-10-18T08:58:10.651519733Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.651571771Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.651585757Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http"}
+{"Time":"2026-10-18T08:58:10.651592619Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http\n"}
+{"Time":"2026-10-18T08:58:10.651769294Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.651794542Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.65181906Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url"}
+{"Time":"2026-10-18T08:58:10.651828592Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url\n"}
+{"Time":"2026-10-18T08:58:10.652007341Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.652027602Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.652045808Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query"}
+{"Time":"2026-10-18T08:58:10.652054591Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query\n"}
+{"Time":"2026-10-18T08:58:10.652238543Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.652285036Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.652321123Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large"}
+{"Time":"2026-10-18T08:58:10.652432801Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large\n"}
+{"Time":"2026-10-18T08:58:10.652455624Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.652562334Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.65257926Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative"}
+{"Time":"2026-10-18T08:58:10.652585743Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative\n"}
+{"Time":"2026-10-18T08:58:10.652759758Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.652778956Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.652923574Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity"}
+{"Time":"2026-10-18T08:58:10.652937082Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity\n"}
+{"Time":"2026-10-18T08:58:10.653100998Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.653152378Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.653251757Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.653293651Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.653411615Z","Action":"output","Package":"keycape/internal/config","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:10.658539523Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient"}
+{"Time":"2026-10-18T08:58:10.658586602Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient","Output":"=== RUN   TestDecideAssurance_ClientOverrideIsPerClient\n"}
+{"Time":"2026-10-18T08:58:10.65883381Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient","Output":"--- PASS: TestDecideAssurance_ClientOverrideIsPerClient (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.658867877Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.658960421Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1"}
+{"Time":"2026-10-18T08:58:10.658973072Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1","Output":"=== RUN   TestDecideAssurance_ACRRaisesClientAAL1\n"}
+{"Time":"2026-10-18T08:58:10.659220641Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1","Output":"--- PASS: TestDecideAssurance_ACRRaisesClientAAL1 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.659253653Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.659340778Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2"}
+{"Time":"2026-10-18T08:58:10.659353834Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2","Output":"=== RUN   TestDecideAssurance_AAL1SessionCannotSatisfyAAL2\n"}
+{"Time":"2026-10-18T08:58:10.659606426Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2","Output":"--- PASS: TestDecideAssurance_AAL1SessionCannotSatisfyAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.659625254Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.659716202Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance"}
+{"Time":"2026-10-18T08:58:10.659727852Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance","Output":"=== RUN   TestDecideAssurance_AAL2SessionSatisfiesHighAssurance\n"}
+{"Time":"2026-10-18T08:58:10.659961453Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance","Output":"--- PASS: TestDecideAssurance_AAL2SessionSatisfiesHighAssurance (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.659984546Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.660086459Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession"}
+{"Time":"2026-10-18T08:58:10.660098226Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession","Output":"=== RUN   TestDecideAssurance_MaxAgeInvalidatesSession\n"}
+{"Time":"2026-10-18T08:58:10.660326237Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession","Output":"--- PASS: TestDecideAssurance_MaxAgeInvalidatesSession (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.660343442Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.660431765Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession"}
+{"Time":"2026-10-18T08:58:10.66044319Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession","Output":"=== RUN   TestDecideAssurance_PromptLoginIgnoresSession\n"}
+{"Time":"2026-10-18T08:58:10.660666223Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession","Output":"--- PASS: TestDecideAssurance_PromptLoginIgnoresSession (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.66068341Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.660691643Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored"}
+{"Time":"2026-10-18T08:58:10.660697387Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored","Output":"=== RUN   TestDecideAssurance_SessionUserMismatchIgnored\n"}
+{"Time":"2026-10-18T08:58:10.660925748Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored","Output":"--- PASS: TestDecideAssurance_SessionUserMismatchIgnored (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.660943188Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.660972656Z","Action":"run","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2"}
+{"Time":"2026-10-18T08:58:10.660979599Z","Action":"output","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2","Output":"=== RUN   TestACRRequiresAAL2\n"}
+{"Time":"2026-10-18T08:58:10.661193407Z","Action":"output","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2","Output":"--- PASS: TestACRRequiresAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.661264058Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.661277457Z","Action":"run","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient"}
+{"Time":"2026-10-18T08:58:10.661282606Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient","Output":"=== RUN   TestCanonicalModelMatchesRuntimeClient\n"}
+{"Time":"2026-10-18T08:58:10.676064685Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient","Output":"--- PASS: TestCanonicalModelMatchesRuntimeClient (0.01s)\n"}
+{"Time":"2026-10-18T08:58:10.676118951Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:10.67612905Z","Action":"run","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities"}
+{"Time":"2026-10-18T08:58:10.676134731Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities","Output":"=== RUN   TestCanonicalModelMatchesRuntimeDirectoryEntities\n"}
+{"Time":"2026-10-18T08:58:10.686267251Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities","Output":"--- PASS: TestCanonicalModelMatchesRuntimeDirectoryEntities (0.01s)\n"}
+{"Time":"2026-10-18T08:58:10.686325286Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:10.686344826Z","Action":"output","Package":"keycape/internal/domain","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:10.803804632Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin","Output":"--- PASS: TestNonceMismatchAndCancelledLogin (0.31s)\n"}
+{"Time":"2026-10-18T08:58:10.803863758Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin","Elapsed":0.31}
+{"Time":"2026-10-18T08:58:10.803881008Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet"}
+{"Time":"2026-10-18T08:58:10.803887446Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet","Output":"=== RUN   TestVerifyRejectsForeignSignatureAndUnusableKeySet\n"}
+{"Time":"2026-10-18T08:58:10.905799179Z","Action":"start","Package":"keycape/internal/errors"}
+{"Time":"2026-10-18T08:58:10.924506213Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants"}
+{"Time":"2026-10-18T08:58:10.924549216Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants","Output":"=== RUN   TestErrorTypeConstants\n"}
+{"Time":"2026-10-18T08:58:10.924872379Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported"}
+{"Time":"2026-10-18T08:58:10.924886455Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported","Output":"=== RUN   TestErrorTypeConstants/FeatureNotSupported\n"}
+{"Time":"2026-10-18T08:58:10.92508723Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported","Output":"--- PASS: TestErrorTypeConstants/FeatureNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.925124832Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.925176618Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly"}
+{"Time":"2026-10-18T08:58:10.925191317Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly","Output":"=== RUN   TestErrorTypeConstants/KeycloakModeOnly\n"}
+{"Time":"2026-10-18T08:58:10.925391887Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly","Output":"--- PASS: TestErrorTypeConstants/KeycloakModeOnly (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.925412022Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.925510518Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety"}
+{"Time":"2026-10-18T08:58:10.925526398Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety","Output":"=== RUN   TestErrorTypeConstants/RejectedForSafety\n"}
+{"Time":"2026-10-18T08:58:10.925781901Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety","Output":"--- PASS: TestErrorTypeConstants/RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.925805986Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.925819791Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:10.925826672Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage","Output":"=== RUN   TestErrorTypeConstants/InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:10.926051147Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage","Output":"--- PASS: TestErrorTypeConstants/InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.926077369Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.92622231Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants","Output":"--- PASS: TestErrorTypeConstants (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.926245917Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.926443479Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers"}
+{"Time":"2026-10-18T08:58:10.926464687Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers","Output":"=== RUN   TestConstructorHelpers\n"}
+{"Time":"2026-10-18T08:58:10.926598241Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported"}
+{"Time":"2026-10-18T08:58:10.926622127Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported","Output":"=== RUN   TestConstructorHelpers/FeatureNotSupported\n"}
+{"Time":"2026-10-18T08:58:10.92672991Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported","Output":"--- PASS: TestConstructorHelpers/FeatureNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.926767603Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.926925792Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly"}
+{"Time":"2026-10-18T08:58:10.9269549Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly","Output":"=== RUN   TestConstructorHelpers/KeycloakModeOnly\n"}
+{"Time":"2026-10-18T08:58:10.927091762Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly","Output":"--- PASS: TestConstructorHelpers/KeycloakModeOnly (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.927141204Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.927155659Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety"}
+{"Time":"2026-10-18T08:58:10.927169906Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety","Output":"=== RUN   TestConstructorHelpers/RejectedForSafety\n"}
+{"Time":"2026-10-18T08:58:10.927393581Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety","Output":"--- PASS: TestConstructorHelpers/RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.927411733Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.927748455Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:10.927767698Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage","Output":"=== RUN   TestConstructorHelpers/InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:10.927776679Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage","Output":"--- PASS: TestConstructorHelpers/InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.927782793Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.927887167Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers","Output":"--- PASS: TestConstructorHelpers (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.928002724Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.928018432Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON"}
+{"Time":"2026-10-18T08:58:10.928024094Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON","Output":"=== RUN   TestProfileErrorJSON\n"}
+{"Time":"2026-10-18T08:58:10.928534272Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON","Output":"--- PASS: TestProfileErrorJSON (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.928549358Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.928556987Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty"}
+{"Time":"2026-10-18T08:58:10.928561495Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty","Output":"=== RUN   TestProfileErrorOmitsFeatureWhenEmpty\n"}
+{"Time":"2026-10-18T08:58:10.928771904Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty","Output":"--- PASS: TestProfileErrorOmitsFeatureWhenEmpty (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.92878717Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.92887168Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite"}
+{"Time":"2026-10-18T08:58:10.928883087Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite","Output":"=== RUN   TestProfileErrorWrite\n"}
+{"Time":"2026-10-18T08:58:10.929100556Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite","Output":"--- PASS: TestProfileErrorWrite (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.929115867Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.929122936Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError"}
+{"Time":"2026-10-18T08:58:10.929141602Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError","Output":"=== RUN   TestProfileErrorGoError\n"}
+{"Time":"2026-10-18T08:58:10.929321478Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError","Output":"--- PASS: TestProfileErrorGoError (0.00s)\n"}
+{"Time":"2026-10-18T08:58:10.929336555Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError","Elapsed":0}
+{"Time":"2026-10-18T08:58:10.929389396Z","Action":"output","Package":"keycape/internal/errors","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:10.976922302Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet","Output":"--- PASS: TestVerifyRejectsForeignSignatureAndUnusableKeySet (0.17s)\n"}
+{"Time":"2026-10-18T08:58:10.976992483Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet","Elapsed":0.17}
+{"Time":"2026-10-18T08:58:10.977006081Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation"}
+{"Time":"2026-10-18T08:58:10.977012673Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"=== RUN   TestOnlineCLIUsesActualProducerAndPrivateObservation\n"}
+{"Time":"2026-10-18T08:58:11.056926784Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"--- PASS: TestOnlineCLIUsesActualProducerAndPrivateObservation (0.08s)\n"}
+{"Time":"2026-10-18T08:58:11.056976235Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:11.056985117Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput"}
+{"Time":"2026-10-18T08:58:11.05699023Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput\n"}
+{"Time":"2026-10-18T08:58:11.057181777Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash"}
+{"Time":"2026-10-18T08:58:11.057204158Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash\n"}
+{"Time":"2026-10-18T08:58:11.280430507Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash (0.22s)\n"}
+{"Time":"2026-10-18T08:58:11.280478019Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:11.280486675Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag"}
+{"Time":"2026-10-18T08:58:11.280491211Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag\n"}
+{"Time":"2026-10-18T08:58:11.447745268Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag (0.17s)\n"}
+{"Time":"2026-10-18T08:58:11.447840805Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Elapsed":0.17}
+{"Time":"2026-10-18T08:58:11.447854872Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced"}
+{"Time":"2026-10-18T08:58:11.447874367Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced\n"}
+{"Time":"2026-10-18T08:58:11.602454603Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced (0.15s)\n"}
+{"Time":"2026-10-18T08:58:11.602504107Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:11.602514865Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission"}
+{"Time":"2026-10-18T08:58:11.602521736Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission\n"}
+{"Time":"2026-10-18T08:58:11.65796638Z","Action":"output","Package":"keycape/internal/config","Output":"ok  \tkeycape/internal/config\t1.076s\n"}
+{"Time":"2026-10-18T08:58:11.658023622Z","Action":"pass","Package":"keycape/internal/config","Elapsed":1.076}
+{"Time":"2026-10-18T08:58:11.660722015Z","Action":"start","Package":"keycape/internal/jose"}
+{"Time":"2026-10-18T08:58:11.690747196Z","Action":"output","Package":"keycape/internal/domain","Output":"ok  \tkeycape/internal/domain\t1.052s\n"}
+{"Time":"2026-10-18T08:58:11.690867946Z","Action":"pass","Package":"keycape/internal/domain","Elapsed":1.052}
+{"Time":"2026-10-18T08:58:11.692918685Z","Action":"start","Package":"keycape/internal/migration/lldapexport"}
+{"Time":"2026-10-18T08:58:11.707900926Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups"}
+{"Time":"2026-10-18T08:58:11.70796044Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups","Output":"=== RUN   TestExporter_Export_UsersAndGroups\n"}
+{"Time":"2026-10-18T08:58:11.70932208Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups","Output":"--- PASS: TestExporter_Export_UsersAndGroups (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.709364155Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.709373902Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile"}
+{"Time":"2026-10-18T08:58:11.709383533Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile","Output":"=== RUN   TestExporter_Export_WritesYAMLFile\n"}
+{"Time":"2026-10-18T08:58:11.710645326Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile","Output":"--- PASS: TestExporter_Export_WritesYAMLFile (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.710697238Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.710718158Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent"}
+{"Time":"2026-10-18T08:58:11.710730178Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent","Output":"=== RUN   TestExporter_Export_EmitsMigrationEvent\n"}
+{"Time":"2026-10-18T08:58:11.711718929Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent","Output":"--- PASS: TestExporter_Export_EmitsMigrationEvent (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.711755954Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.711791554Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser"}
+{"Time":"2026-10-18T08:58:11.711799254Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser","Output":"=== RUN   TestExporter_Export_IncompatibilityReport_BadUser\n"}
+{"Time":"2026-10-18T08:58:11.712742558Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser","Output":"--- PASS: TestExporter_Export_IncompatibilityReport_BadUser (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.712768672Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.712786823Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships"}
+{"Time":"2026-10-18T08:58:11.712797861Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships","Output":"=== RUN   TestExporter_Export_BuildsMemberships\n"}
+{"Time":"2026-10-18T08:58:11.714269385Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships","Output":"--- PASS: TestExporter_Export_BuildsMemberships (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.714310107Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.714319025Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion"}
+{"Time":"2026-10-18T08:58:11.714324806Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion","Output":"=== RUN   TestExporter_Export_ProfileVersion\n"}
+{"Time":"2026-10-18T08:58:11.715611855Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion","Output":"--- PASS: TestExporter_Export_ProfileVersion (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.715665526Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.71567576Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers"}
+{"Time":"2026-10-18T08:58:11.715680675Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers","Output":"=== RUN   TestExporter_Export_IncludesGroupWithNoMembers\n"}
+{"Time":"2026-10-18T08:58:11.717036662Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers","Output":"--- PASS: TestExporter_Export_IncludesGroupWithNoMembers (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.717072704Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.717084489Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal"}
+{"Time":"2026-10-18T08:58:11.7170887Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal","Output":"=== RUN   TestExporter_Export_GroupEnumerationFailureIsFatal\n"}
+{"Time":"2026-10-18T08:58:11.7177234Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal","Output":"--- PASS: TestExporter_Export_GroupEnumerationFailureIsFatal (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.717750308Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.717769677Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness"}
+{"Time":"2026-10-18T08:58:11.717776124Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness","Output":"=== RUN   TestExporter_Export_FallbackReportsIncompleteness\n"}
+{"Time":"2026-10-18T08:58:11.718881161Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness","Output":"--- PASS: TestExporter_Export_FallbackReportsIncompleteness (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.718935553Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.718944894Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic"}
+{"Time":"2026-10-18T08:58:11.718949295Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic","Output":"=== RUN   TestExporter_Export_IsDeterministic\n"}
+{"Time":"2026-10-18T08:58:11.723172127Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic","Output":"--- PASS: TestExporter_Export_IsDeterministic (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.72322082Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.723229468Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:11.739665033Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims"}
+{"Time":"2026-10-18T08:58:11.739711273Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims","Output":"=== RUN   TestVerifyAcceptsGenuineTokenAndReturnsClaims\n"}
+{"Time":"2026-10-18T08:58:11.743289266Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims","Output":"--- PASS: TestVerifyAcceptsGenuineTokenAndReturnsClaims (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.74334933Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.743366958Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections"}
+{"Time":"2026-10-18T08:58:11.743377635Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections","Output":"=== RUN   TestVerifyRejections\n"}
+{"Time":"2026-10-18T08:58:11.827836284Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission (0.23s)\n"}
+{"Time":"2026-10-18T08:58:11.827949Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Elapsed":0.23}
+{"Time":"2026-10-18T08:58:11.828071355Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token"}
+{"Time":"2026-10-18T08:58:11.828080174Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token\n"}
+{"Time":"2026-10-18T08:58:11.885516721Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token (0.06s)\n"}
+{"Time":"2026-10-18T08:58:11.885569517Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Elapsed":0.06}
+{"Time":"2026-10-18T08:58:11.885757734Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token"}
+{"Time":"2026-10-18T08:58:11.885776292Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token\n"}
+{"Time":"2026-10-18T08:58:11.886921933Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id"}
+{"Time":"2026-10-18T08:58:11.886955541Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id","Output":"=== RUN   TestVerifyRejections/unknown_key_id\n"}
+{"Time":"2026-10-18T08:58:11.88714025Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id","Output":"--- PASS: TestVerifyRejections/unknown_key_id (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.887160656Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.887197212Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256"}
+{"Time":"2026-10-18T08:58:11.887204309Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256","Output":"=== RUN   TestVerifyRejections/alg_HS256\n"}
+{"Time":"2026-10-18T08:58:11.887369562Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256","Output":"--- PASS: TestVerifyRejections/alg_HS256 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.887395586Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.887414766Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json"}
+{"Time":"2026-10-18T08:58:11.88742014Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json","Output":"=== RUN   TestVerifyRejections/payload_not_json\n"}
+{"Time":"2026-10-18T08:58:11.887738485Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json","Output":"--- PASS: TestVerifyRejections/payload_not_json (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.887773923Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.887794798Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty"}
+{"Time":"2026-10-18T08:58:11.887801534Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty","Output":"=== RUN   TestVerifyRejections/empty\n"}
+{"Time":"2026-10-18T08:58:11.88790534Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty","Output":"--- PASS: TestVerifyRejections/empty (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.887932942Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.887944908Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key"}
+{"Time":"2026-10-18T08:58:11.887957279Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key","Output":"=== RUN   TestVerifyRejections/wrong_signing_key\n"}
+{"Time":"2026-10-18T08:58:11.888273781Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key","Output":"--- PASS: TestVerifyRejections/wrong_signing_key (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.888298768Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.888308913Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id"}
+{"Time":"2026-10-18T08:58:11.888314404Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id","Output":"=== RUN   TestVerifyRejections/missing_key_id\n"}
+{"Time":"2026-10-18T08:58:11.888452068Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id","Output":"--- PASS: TestVerifyRejections/missing_key_id (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.888470093Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.888558366Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none"}
+{"Time":"2026-10-18T08:58:11.88857448Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none","Output":"=== RUN   TestVerifyRejections/alg_none\n"}
+{"Time":"2026-10-18T08:58:11.888748242Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none","Output":"--- PASS: TestVerifyRejections/alg_none (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.888763526Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.888770136Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension"}
+{"Time":"2026-10-18T08:58:11.888775357Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension","Output":"=== RUN   TestVerifyRejections/critical_extension\n"}
+{"Time":"2026-10-18T08:58:11.888937101Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension","Output":"--- PASS: TestVerifyRejections/critical_extension (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.888952232Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.889046289Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload"}
+{"Time":"2026-10-18T08:58:11.889062719Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload","Output":"=== RUN   TestVerifyRejections/tampered_payload\n"}
+{"Time":"2026-10-18T08:58:11.889377015Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload","Output":"--- PASS: TestVerifyRejections/tampered_payload (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.889392993Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.88939972Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments"}
+{"Time":"2026-10-18T08:58:11.889404797Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments","Output":"=== RUN   TestVerifyRejections/two_segments\n"}
+{"Time":"2026-10-18T08:58:11.889596964Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments","Output":"--- PASS: TestVerifyRejections/two_segments (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.889611941Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.889759635Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections","Output":"--- PASS: TestVerifyRejections (0.15s)\n"}
+{"Time":"2026-10-18T08:58:11.889778048Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:11.889875353Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets"}
+{"Time":"2026-10-18T08:58:11.889888518Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets\n"}
+{"Time":"2026-10-18T08:58:11.895508128Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id"}
+{"Time":"2026-10-18T08:58:11.895556632Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/missing_key_id\n"}
+{"Time":"2026-10-18T08:58:11.895844354Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/missing_key_id (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.89598717Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.89623729Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64"}
+{"Time":"2026-10-18T08:58:11.896248237Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/bad_base64\n"}
+{"Time":"2026-10-18T08:58:11.896531225Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/bad_base64 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.896648837Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.896676944Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent"}
+{"Time":"2026-10-18T08:58:11.896681335Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/even_exponent\n"}
+{"Time":"2026-10-18T08:58:11.897031541Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/even_exponent (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.897049702Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.89716138Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json"}
+{"Time":"2026-10-18T08:58:11.897172922Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/not_json\n"}
+{"Time":"2026-10-18T08:58:11.897393132Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/not_json (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.897414251Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.897519085Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus"}
+{"Time":"2026-10-18T08:58:11.897530393Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/undersized_modulus\n"}
+{"Time":"2026-10-18T08:58:11.897811641Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/undersized_modulus (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.897829946Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.898067289Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set"}
+{"Time":"2026-10-18T08:58:11.898080959Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/empty_set\n"}
+{"Time":"2026-10-18T08:58:11.898207219Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/empty_set (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.898248436Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.898260168Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key"}
+{"Time":"2026-10-18T08:58:11.898265768Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key\n"}
+{"Time":"2026-10-18T08:58:11.898503462Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.898614239Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.898632643Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets (0.01s)\n"}
+{"Time":"2026-10-18T08:58:11.898995817Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets","Elapsed":0.01}
+{"Time":"2026-10-18T08:58:11.899026637Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs"}
+{"Time":"2026-10-18T08:58:11.899031687Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs","Output":"=== RUN   TestParseJWKSRejectsDuplicateKeyIDs\n"}
+{"Time":"2026-10-18T08:58:11.900069897Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs","Output":"--- PASS: TestParseJWKSRejectsDuplicateKeyIDs (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.900111034Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.900120691Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys"}
+{"Time":"2026-10-18T08:58:11.900125831Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys","Output":"=== RUN   TestParseJWKSIgnoresIrrelevantKeys\n"}
+{"Time":"2026-10-18T08:58:11.900685514Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys","Output":"--- PASS: TestParseJWKSIgnoresIrrelevantKeys (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.900717543Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.900729139Z","Action":"output","Package":"keycape/internal/jose","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:11.93385568Z","Action":"output","Package":"keycape/internal/errors","Output":"ok  \tkeycape/internal/errors\t1.028s\n"}
+{"Time":"2026-10-18T08:58:11.933920424Z","Action":"pass","Package":"keycape/internal/errors","Elapsed":1.028}
+{"Time":"2026-10-18T08:58:11.938181071Z","Action":"start","Package":"keycape/internal/migration/tokeycloak"}
+{"Time":"2026-10-18T08:58:11.955735467Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail"}
+{"Time":"2026-10-18T08:58:11.955789327Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail","Output":"=== RUN   TestTransformer_UserMapping_UsernameAndEmail\n"}
+{"Time":"2026-10-18T08:58:11.956066914Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail","Output":"--- PASS: TestTransformer_UserMapping_UsernameAndEmail (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.956175861Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.956205383Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit"}
+{"Time":"2026-10-18T08:58:11.956217457Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit","Output":"=== RUN   TestTransformer_UserMapping_DisplayNameSplit\n"}
+{"Time":"2026-10-18T08:58:11.956496343Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit","Output":"--- PASS: TestTransformer_UserMapping_DisplayNameSplit (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.956518453Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.956570248Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord"}
+{"Time":"2026-10-18T08:58:11.956577642Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord","Output":"=== RUN   TestTransformer_UserMapping_DisplayNameSingleWord\n"}
+{"Time":"2026-10-18T08:58:11.956855527Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord","Output":"--- PASS: TestTransformer_UserMapping_DisplayNameSingleWord (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.956880468Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.956910866Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths"}
+{"Time":"2026-10-18T08:58:11.956916096Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths","Output":"=== RUN   TestTransformer_UserMapping_GroupPaths\n"}
+{"Time":"2026-10-18T08:58:11.957430881Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths","Output":"--- PASS: TestTransformer_UserMapping_GroupPaths (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.957462902Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.957469403Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath"}
+{"Time":"2026-10-18T08:58:11.957473731Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath","Output":"=== RUN   TestTransformer_GroupMapping_NameAndPath\n"}
+{"Time":"2026-10-18T08:58:11.957489845Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath","Output":"--- PASS: TestTransformer_GroupMapping_NameAndPath (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.957648882Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.95766322Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient"}
+{"Time":"2026-10-18T08:58:11.957667512Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient","Output":"=== RUN   TestTransformer_ClientMapping_PublicClient\n"}
+{"Time":"2026-10-18T08:58:11.958089086Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient","Output":"--- PASS: TestTransformer_ClientMapping_PublicClient (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.958107842Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.958113307Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient"}
+{"Time":"2026-10-18T08:58:11.958132324Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient","Output":"=== RUN   TestTransformer_ClientMapping_ConfidentialClient\n"}
+{"Time":"2026-10-18T08:58:11.958137897Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient","Output":"--- PASS: TestTransformer_ClientMapping_ConfidentialClient (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.958144993Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.958151837Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes"}
+{"Time":"2026-10-18T08:58:11.958156003Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes","Output":"=== RUN   TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes\n"}
+{"Time":"2026-10-18T08:58:11.958350066Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes","Output":"--- PASS: TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.958374278Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.958382925Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse"}
+{"Time":"2026-10-18T08:58:11.958389129Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse","Output":"=== RUN   TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse\n"}
+{"Time":"2026-10-18T08:58:11.958586931Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse","Output":"--- PASS: TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.958606904Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.958616751Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty"}
+{"Time":"2026-10-18T08:58:11.958622378Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty","Output":"=== RUN   TestTransformer_IdentityProviders_AlwaysEmpty\n"}
+{"Time":"2026-10-18T08:58:11.958926548Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty","Output":"--- PASS: TestTransformer_IdentityProviders_AlwaysEmpty (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.958966043Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.958985818Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256"}
+{"Time":"2026-10-18T08:58:11.958993356Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256","Output":"=== RUN   TestTransformer_ProfileVersion_RS256\n"}
+{"Time":"2026-10-18T08:58:11.959148135Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256","Output":"--- PASS: TestTransformer_ProfileVersion_RS256 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.959166954Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.95919846Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata"}
+{"Time":"2026-10-18T08:58:11.959209119Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata","Output":"=== RUN   TestTransformer_RealmMetadata\n"}
+{"Time":"2026-10-18T08:58:11.959370936Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata","Output":"--- PASS: TestTransformer_RealmMetadata (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.959390846Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.959397889Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent"}
+{"Time":"2026-10-18T08:58:11.959403164Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent","Output":"=== RUN   TestTransformer_EmitsMigrationEvent\n"}
+{"Time":"2026-10-18T08:58:11.959469197Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent","Output":"--- PASS: TestTransformer_EmitsMigrationEvent (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.959624672Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.959640597Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport"}
+{"Time":"2026-10-18T08:58:11.959646205Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport","Output":"=== RUN   TestTransformer_ValidationReport_IncompatibleExport\n"}
+{"Time":"2026-10-18T08:58:11.95975104Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport","Output":"--- PASS: TestTransformer_ValidationReport_IncompatibleExport (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.959768047Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.959861961Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport"}
+{"Time":"2026-10-18T08:58:11.959875586Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport","Output":"=== RUN   TestTransformer_ValidationReport_CleanExport\n"}
+{"Time":"2026-10-18T08:58:11.960020502Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport","Output":"--- PASS: TestTransformer_ValidationReport_CleanExport (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.960035706Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.960044732Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants"}
+{"Time":"2026-10-18T08:58:11.960050584Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants","Output":"=== RUN   TestMapClient_FlowsFollowDeclaredGrants\n"}
+{"Time":"2026-10-18T08:58:11.960305204Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants","Output":"--- PASS: TestMapClient_FlowsFollowDeclaredGrants (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.960321354Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.960327918Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime"}
+{"Time":"2026-10-18T08:58:11.960348063Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime","Output":"=== RUN   TestMapClient_CarriesProfileClaimsAndLifetime\n"}
+{"Time":"2026-10-18T08:58:11.960554648Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime","Output":"--- PASS: TestMapClient_CarriesProfileClaimsAndLifetime (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.960570951Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.960577552Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues"}
+{"Time":"2026-10-18T08:58:11.96058289Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues","Output":"=== RUN   TestTransform_NeverEmitsSecretValues\n"}
+{"Time":"2026-10-18T08:58:11.962193289Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues","Output":"--- PASS: TestTransform_NeverEmitsSecretValues (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.962245337Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.962257925Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes"}
+{"Time":"2026-10-18T08:58:11.962264769Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes","Output":"=== RUN   TestTransform_DerivesRolesAndScopes\n"}
+{"Time":"2026-10-18T08:58:11.962456575Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes","Output":"--- PASS: TestTransform_DerivesRolesAndScopes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.962483924Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.962539578Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit"}
+{"Time":"2026-10-18T08:58:11.96255057Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit","Output":"=== RUN   TestUnpreservedReport_NamesEveryLimit\n"}
+{"Time":"2026-10-18T08:58:11.962930765Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit","Output":"--- PASS: TestUnpreservedReport_NamesEveryLimit (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.962973416Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.962985689Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved"}
+{"Time":"2026-10-18T08:58:11.963002831Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved","Output":"=== RUN   TestValidationReportStaysSeparateFromUnpreserved\n"}
+{"Time":"2026-10-18T08:58:11.963024535Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved","Output":"--- PASS: TestValidationReportStaysSeparateFromUnpreserved (0.00s)\n"}
+{"Time":"2026-10-18T08:58:11.963160885Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved","Elapsed":0}
+{"Time":"2026-10-18T08:58:11.963177468Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:12.18729115Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token (0.30s)\n"}
+{"Time":"2026-10-18T08:58:12.187354866Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Elapsed":0.3}
+{"Time":"2026-10-18T08:58:12.187474092Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent"}
+{"Time":"2026-10-18T08:58:12.187482902Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent\n"}
+{"Time":"2026-10-18T08:58:12.321281544Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent (0.13s)\n"}
+{"Time":"2026-10-18T08:58:12.321332194Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Elapsed":0.13}
+{"Time":"2026-10-18T08:58:12.321344809Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output"}
+{"Time":"2026-10-18T08:58:12.321352212Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output\n"}
+{"Time":"2026-10-18T08:58:12.387435878Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output (0.07s)\n"}
+{"Time":"2026-10-18T08:58:12.387483598Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:12.387494247Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink"}
+{"Time":"2026-10-18T08:58:12.387500875Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink\n"}
+{"Time":"2026-10-18T08:58:12.725416919Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink (0.34s)\n"}
+{"Time":"2026-10-18T08:58:12.725481735Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Elapsed":0.34}
+{"Time":"2026-10-18T08:58:12.725502619Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag"}
+{"Time":"2026-10-18T08:58:12.725512069Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag\n"}
+{"Time":"2026-10-18T08:58:12.726269639Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Output":"ok  \tkeycape/internal/migration/lldapexport\t1.033s\n"}
+{"Time":"2026-10-18T08:58:12.726300874Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Elapsed":1.033}
+{"Time":"2026-10-18T08:58:12.871686552Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag (0.15s)\n"}
+{"Time":"2026-10-18T08:58:12.871725876Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:12.8717486Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags"}
+{"Time":"2026-10-18T08:58:12.871753289Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags\n"}
+{"Time":"2026-10-18T08:58:12.906139315Z","Action":"output","Package":"keycape/internal/jose","Output":"ok  \tkeycape/internal/jose\t1.245s\n"}
+{"Time":"2026-10-18T08:58:12.906184419Z","Action":"pass","Package":"keycape/internal/jose","Elapsed":1.245}
+{"Time":"2026-10-18T08:58:12.959577578Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags (0.09s)\n"}
+{"Time":"2026-10-18T08:58:12.959784314Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:12.959809409Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput (1.90s)\n"}
+{"Time":"2026-10-18T08:58:12.959816623Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Elapsed":1.9}
+{"Time":"2026-10-18T08:58:12.959824756Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation"}
+{"Time":"2026-10-18T08:58:12.959831213Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"=== RUN   TestOnlineCLIFailureDoesNotDeleteReplacedObservation\n"}
+{"Time":"2026-10-18T08:58:12.966387001Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Output":"ok  \tkeycape/internal/migration/tokeycloak\t1.028s\n"}
+{"Time":"2026-10-18T08:58:12.966444955Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Elapsed":1.028}
+{"Time":"2026-10-18T08:58:13.09597934Z","Action":"start","Package":"keycape/internal/migration/toldap"}
+{"Time":"2026-10-18T08:58:13.11902685Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"--- PASS: TestOnlineCLIFailureDoesNotDeleteReplacedObservation (0.16s)\n"}
+{"Time":"2026-10-18T08:58:13.11907989Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:13.119090115Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer"}
+{"Time":"2026-10-18T08:58:13.11909604Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer","Output":"=== RUN   TestOnlineExportMatchesItsSingleProducer\n"}
+{"Time":"2026-10-18T08:58:13.124104615Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes"}
+{"Time":"2026-10-18T08:58:13.124166077Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes","Output":"=== RUN   TestGenerator_UserLDIF_RequiredAttributes\n"}
+{"Time":"2026-10-18T08:58:13.124463041Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes","Output":"--- PASS: TestGenerator_UserLDIF_RequiredAttributes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.124492708Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.124502708Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs"}
+{"Time":"2026-10-18T08:58:13.124525125Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs","Output":"=== RUN   TestGenerator_GroupLDIF_WithMemberDNs\n"}
+{"Time":"2026-10-18T08:58:13.124824101Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs","Output":"--- PASS: TestGenerator_GroupLDIF_WithMemberDNs (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.124849998Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.124859358Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName"}
+{"Time":"2026-10-18T08:58:13.124864651Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName","Output":"=== RUN   TestGenerator_Target_OpenLDAP_NoSAMAccountName\n"}
+{"Time":"2026-10-18T08:58:13.125135178Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName","Output":"--- PASS: TestGenerator_Target_OpenLDAP_NoSAMAccountName (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.125162347Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.125239021Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable"}
+{"Time":"2026-10-18T08:58:13.125252871Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable","Output":"=== RUN   TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable\n"}
+{"Time":"2026-10-18T08:58:13.125462567Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable","Output":"--- PASS: TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.125482198Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.125670081Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent"}
+{"Time":"2026-10-18T08:58:13.125685762Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent","Output":"=== RUN   TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent\n"}
+{"Time":"2026-10-18T08:58:13.125930207Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent","Output":"--- PASS: TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.125958566Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.125970117Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent"}
+{"Time":"2026-10-18T08:58:13.125976375Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent","Output":"=== RUN   TestGenerator_Target_AD_SAMAccountNamePresent\n"}
+{"Time":"2026-10-18T08:58:13.126324757Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent","Output":"--- PASS: TestGenerator_Target_AD_SAMAccountNamePresent (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.126352908Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.126364721Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN"}
+{"Time":"2026-10-18T08:58:13.126370943Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN","Output":"=== RUN   TestGenerator_Target_AD_UsesCNInDN\n"}
+{"Time":"2026-10-18T08:58:13.126655071Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN","Output":"--- PASS: TestGenerator_Target_AD_UsesCNInDN (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.126689264Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.12670288Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN"}
+{"Time":"2026-10-18T08:58:13.126708363Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN","Output":"=== RUN   TestGenerator_Target_OpenLDAP_UsesUIDInDN\n"}
+{"Time":"2026-10-18T08:58:13.127061903Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN","Output":"--- PASS: TestGenerator_Target_OpenLDAP_UsesUIDInDN (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.127107936Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.127290688Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly"}
+{"Time":"2026-10-18T08:58:13.127304818Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly","Output":"=== RUN   TestGenerator_EmptyExport_StructuralEntriesOnly\n"}
+{"Time":"2026-10-18T08:58:13.127520556Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly","Output":"--- PASS: TestGenerator_EmptyExport_StructuralEntriesOnly (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.12754043Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.127623334Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent"}
+{"Time":"2026-10-18T08:58:13.127638601Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent","Output":"=== RUN   TestGenerator_EmitsMigrationEvent\n"}
+{"Time":"2026-10-18T08:58:13.127913663Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent","Output":"--- PASS: TestGenerator_EmitsMigrationEvent (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.128037578Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.128154784Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput"}
+{"Time":"2026-10-18T08:58:13.128222725Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput","Output":"=== RUN   TestGenerator_ValidationRunsOnOutput\n"}
+{"Time":"2026-10-18T08:58:13.128447967Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput","Output":"--- PASS: TestGenerator_ValidationRunsOnOutput (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.128470799Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.128527111Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData"}
+{"Time":"2026-10-18T08:58:13.128537193Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData","Output":"=== RUN   TestGenerator_ValidationFailsForInvalidData\n"}
+{"Time":"2026-10-18T08:58:13.128973736Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData","Output":"--- PASS: TestGenerator_ValidationFailsForInvalidData (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.129026631Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.129041942Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout"}
+{"Time":"2026-10-18T08:58:13.129048543Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout","Output":"=== RUN   TestMemberDNsAreRewrittenIntoTheTargetLayout\n"}
+{"Time":"2026-10-18T08:58:13.129376013Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout","Output":"--- PASS: TestMemberDNsAreRewrittenIntoTheTargetLayout (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.129420667Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.129434211Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute"}
+{"Time":"2026-10-18T08:58:13.129444499Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute","Output":"=== RUN   TestMemberDNRewriteFollowsTargetNamingAttribute\n"}
+{"Time":"2026-10-18T08:58:13.129940461Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute","Output":"--- PASS: TestMemberDNRewriteFollowsTargetNamingAttribute (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.129989226Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.130000741Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember"}
+{"Time":"2026-10-18T08:58:13.13000699Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember","Output":"=== RUN   TestEmptyGroupsGetALoadablePlaceholderMember\n"}
+{"Time":"2026-10-18T08:58:13.130341845Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember","Output":"--- PASS: TestEmptyGroupsGetALoadablePlaceholderMember (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.130409826Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.130419502Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers"}
+{"Time":"2026-10-18T08:58:13.130425507Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers","Output":"=== RUN   TestNoPlaceholderWhenEveryGroupHasMembers\n"}
+{"Time":"2026-10-18T08:58:13.130475625Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers","Output":"--- PASS: TestNoPlaceholderWhenEveryGroupHasMembers (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.130635961Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.130652571Z","Action":"output","Package":"keycape/internal/migration/toldap","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:13.202345165Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer","Output":"--- PASS: TestOnlineExportMatchesItsSingleProducer (0.08s)\n"}
+{"Time":"2026-10-18T08:58:13.20240238Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:13.202634853Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant"}
+{"Time":"2026-10-18T08:58:13.202651147Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"=== RUN   TestOnlineActualIssuerCurrentRevocationAndFreshGrant\n"}
+{"Time":"2026-10-18T08:58:13.432350269Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"--- PASS: TestOnlineActualIssuerCurrentRevocationAndFreshGrant (0.23s)\n"}
+{"Time":"2026-10-18T08:58:13.432409323Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Elapsed":0.23}
+{"Time":"2026-10-18T08:58:13.432433768Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork"}
+{"Time":"2026-10-18T08:58:13.432446257Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork\n"}
+{"Time":"2026-10-18T08:58:13.432458214Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject"}
+{"Time":"2026-10-18T08:58:13.432465446Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/subject\n"}
+{"Time":"2026-10-18T08:58:13.502993707Z","Action":"start","Package":"keycape/internal/server/errors"}
+{"Time":"2026-10-18T08:58:13.521053014Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect"}
+{"Time":"2026-10-18T08:58:13.521099516Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect","Output":"=== RUN   TestDefaultRegistry_DynamicClientRegistration_PostConnect\n"}
+{"Time":"2026-10-18T08:58:13.522231429Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect","Output":"--- PASS: TestDefaultRegistry_DynamicClientRegistration_PostConnect (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.522260095Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.522273251Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration"}
+{"Time":"2026-10-18T08:58:13.522277795Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration","Output":"=== RUN   TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration\n"}
+{"Time":"2026-10-18T08:58:13.522833835Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration","Output":"--- PASS: TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.522883069Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.522897731Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token"}
+{"Time":"2026-10-18T08:58:13.522903322Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token","Output":"=== RUN   TestDefaultRegistry_ImplicitFlow_Token\n"}
+{"Time":"2026-10-18T08:58:13.523420281Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token","Output":"--- PASS: TestDefaultRegistry_ImplicitFlow_Token (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.523442662Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.523453573Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken"}
+{"Time":"2026-10-18T08:58:13.523478613Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken","Output":"=== RUN   TestDefaultRegistry_ImplicitFlow_IDToken\n"}
+{"Time":"2026-10-18T08:58:13.523915761Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken","Output":"--- PASS: TestDefaultRegistry_ImplicitFlow_IDToken (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.52393403Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.523967655Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI"}
+{"Time":"2026-10-18T08:58:13.523972858Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI","Output":"=== RUN   TestDefaultRegistry_WildcardRedirectURI\n"}
+{"Time":"2026-10-18T08:58:13.52451153Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI","Output":"--- PASS: TestDefaultRegistry_WildcardRedirectURI (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.524535597Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.5245486Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker"}
+{"Time":"2026-10-18T08:58:13.524553163Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker","Output":"=== RUN   TestDefaultRegistry_IdentityBroker\n"}
+{"Time":"2026-10-18T08:58:13.525089662Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker","Output":"--- PASS: TestDefaultRegistry_IdentityBroker (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.52511198Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.52511895Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE"}
+{"Time":"2026-10-18T08:58:13.52512629Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE","Output":"=== RUN   TestDefaultRegistry_MissingPKCE\n"}
+{"Time":"2026-10-18T08:58:13.525666766Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE","Output":"--- PASS: TestDefaultRegistry_MissingPKCE (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.525687064Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.525877265Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough"}
+{"Time":"2026-10-18T08:58:13.525888951Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough","Output":"=== RUN   TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough\n"}
+{"Time":"2026-10-18T08:58:13.526130992Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough","Output":"--- PASS: TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.52617331Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.526253077Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod"}
+{"Time":"2026-10-18T08:58:13.526263681Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod","Output":"=== RUN   TestDefaultRegistry_PKCEPlainMethod\n"}
+{"Time":"2026-10-18T08:58:13.526756302Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod","Output":"--- PASS: TestDefaultRegistry_PKCEPlainMethod (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.526776808Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.526860857Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType"}
+{"Time":"2026-10-18T08:58:13.5269035Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType","Output":"=== RUN   TestDefaultRegistry_UnknownGrantType\n"}
+{"Time":"2026-10-18T08:58:13.527364155Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType","Output":"--- PASS: TestDefaultRegistry_UnknownGrantType (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.527456861Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.527470802Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes"}
+{"Time":"2026-10-18T08:58:13.527475311Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes","Output":"=== RUN   TestDefaultRegistry_UnknownGrantType_AllowedTypes\n"}
+{"Time":"2026-10-18T08:58:13.527814702Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes","Output":"--- PASS: TestDefaultRegistry_UnknownGrantType_AllowedTypes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.527830401Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.527908057Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough"}
+{"Time":"2026-10-18T08:58:13.52791822Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough","Output":"=== RUN   TestDefaultRegistry_NoMatchPassesThrough\n"}
+{"Time":"2026-10-18T08:58:13.528207024Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough","Output":"--- PASS: TestDefaultRegistry_NoMatchPassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.528224274Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.52833479Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature"}
+{"Time":"2026-10-18T08:58:13.528347351Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature","Output":"=== RUN   TestRegistry_CustomFeature\n"}
+{"Time":"2026-10-18T08:58:13.528700818Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature","Output":"--- PASS: TestRegistry_CustomFeature (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.52871529Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.528796996Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough"}
+{"Time":"2026-10-18T08:58:13.528807077Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough","Output":"=== RUN   TestRegistry_CustomFeature_NoMatch_PassesThrough\n"}
+{"Time":"2026-10-18T08:58:13.529027567Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough","Output":"--- PASS: TestRegistry_CustomFeature_NoMatch_PassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T08:58:13.529047378Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough","Elapsed":0}
+{"Time":"2026-10-18T08:58:13.529078217Z","Action":"output","Package":"keycape/internal/server/errors","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:13.621385892Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/subject (0.19s)\n"}
+{"Time":"2026-10-18T08:58:13.621459554Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Elapsed":0.19}
+{"Time":"2026-10-18T08:58:13.621478896Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant"}
+{"Time":"2026-10-18T08:58:13.621486922Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant\n"}
+{"Time":"2026-10-18T08:58:13.679719455Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant (0.06s)\n"}
+{"Time":"2026-10-18T08:58:13.67978345Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Elapsed":0.06}
+{"Time":"2026-10-18T08:58:13.679814073Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal"}
+{"Time":"2026-10-18T08:58:13.679818257Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/principal\n"}
+{"Time":"2026-10-18T08:58:13.882925623Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/principal (0.20s)\n"}
+{"Time":"2026-10-18T08:58:13.883052009Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Elapsed":0.2}
+{"Time":"2026-10-18T08:58:13.8831796Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience"}
+{"Time":"2026-10-18T08:58:13.883193829Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/audience\n"}
+{"Time":"2026-10-18T08:58:13.955114614Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/audience (0.07s)\n"}
+{"Time":"2026-10-18T08:58:13.955160945Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:13.9552827Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer"}
+{"Time":"2026-10-18T08:58:13.955293557Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer\n"}
+{"Time":"2026-10-18T08:58:14.133831646Z","Action":"output","Package":"keycape/internal/migration/toldap","Output":"ok  \tkeycape/internal/migration/toldap\t1.038s\n"}
+{"Time":"2026-10-18T08:58:14.133882647Z","Action":"pass","Package":"keycape/internal/migration/toldap","Elapsed":1.038}
+{"Time":"2026-10-18T08:58:14.211182832Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer (0.26s)\n"}
+{"Time":"2026-10-18T08:58:14.211240723Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Elapsed":0.26}
+{"Time":"2026-10-18T08:58:14.211268009Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper"}
+{"Time":"2026-10-18T08:58:14.211273879Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper\n"}
+{"Time":"2026-10-18T08:58:14.259409154Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper (0.05s)\n"}
+{"Time":"2026-10-18T08:58:14.259471995Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Elapsed":0.05}
+{"Time":"2026-10-18T08:58:14.259484079Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key"}
+{"Time":"2026-10-18T08:58:14.259495431Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/key\n"}
+{"Time":"2026-10-18T08:58:14.484292829Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/key (0.22s)\n"}
+{"Time":"2026-10-18T08:58:14.484344813Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:14.484360449Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti"}
+{"Time":"2026-10-18T08:58:14.484365381Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti\n"}
+{"Time":"2026-10-18T08:58:14.533613953Z","Action":"output","Package":"keycape/internal/server/errors","Output":"ok  \tkeycape/internal/server/errors\t1.031s\n"}
+{"Time":"2026-10-18T08:58:14.533674829Z","Action":"pass","Package":"keycape/internal/server/errors","Elapsed":1.031}
+{"Time":"2026-10-18T08:58:14.641065851Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti (0.16s)\n"}
+{"Time":"2026-10-18T08:58:14.641123616Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:14.641140081Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token"}
+{"Time":"2026-10-18T08:58:14.641147277Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token\n"}
+{"Time":"2026-10-18T08:58:14.991186516Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token (0.35s)\n"}
+{"Time":"2026-10-18T08:58:14.991251963Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Elapsed":0.35}
+{"Time":"2026-10-18T08:58:14.991261458Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale"}
+{"Time":"2026-10-18T08:58:14.99127117Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/stale\n"}
+{"Time":"2026-10-18T08:58:15.048498851Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/stale (0.06s)\n"}
+{"Time":"2026-10-18T08:58:15.048559537Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Elapsed":0.06}
+{"Time":"2026-10-18T08:58:15.04857648Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork (1.62s)\n"}
+{"Time":"2026-10-18T08:58:15.048584388Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Elapsed":1.62}
+{"Time":"2026-10-18T08:58:15.048591151Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus"}
+{"Time":"2026-10-18T08:58:15.048597184Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus\n"}
+{"Time":"2026-10-18T08:58:15.048813093Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active"}
+{"Time":"2026-10-18T08:58:15.048839261Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active\n"}
+{"Time":"2026-10-18T08:58:15.231210488Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active (0.18s)\n"}
+{"Time":"2026-10-18T08:58:15.231265204Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Elapsed":0.18}
+{"Time":"2026-10-18T08:58:15.231276268Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type"}
+{"Time":"2026-10-18T08:58:15.231282635Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type\n"}
+{"Time":"2026-10-18T08:58:15.285810087Z","Action":"start","Package":"keycape/internal/server/oidc"}
+{"Time":"2026-10-18T08:58:15.306702265Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials"}
+{"Time":"2026-10-18T08:58:15.30676204Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials","Output":"=== RUN   TestRecoveryStripsCredentials\n"}
+{"Time":"2026-10-18T08:58:15.307149295Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials","Output":"--- PASS: TestRecoveryStripsCredentials (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.307168988Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.307181414Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn"}
+{"Time":"2026-10-18T08:58:15.307187374Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn","Output":"=== RUN   TestSharedLogoutRequiresConfirmationAndFixedReturn\n"}
+{"Time":"2026-10-18T08:58:15.308980246Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn","Output":"--- PASS: TestSharedLogoutRequiresConfirmationAndFixedReturn (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.309035224Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.309078074Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime"}
+{"Time":"2026-10-18T08:58:15.309084638Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime","Output":"=== RUN   TestAssuranceReportsAuthenticationTimeNotMintTime\n"}
+{"Time":"2026-10-18T08:58:15.309365932Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime","Output":"--- PASS: TestAssuranceReportsAuthenticationTimeNotMintTime (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.309394426Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.309404264Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset"}
+{"Time":"2026-10-18T08:58:15.309410576Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset","Output":"=== RUN   TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset\n"}
+{"Time":"2026-10-18T08:58:15.309435211Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset","Output":"--- PASS: TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.309655214Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.309689795Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape"}
+{"Time":"2026-10-18T08:58:15.309699182Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape","Output":"=== RUN   TestAssuranceCarriesTheDocumentedShape\n"}
+{"Time":"2026-10-18T08:58:15.310191426Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape","Output":"--- PASS: TestAssuranceCarriesTheDocumentedShape (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.310238929Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.310253771Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares"}
+{"Time":"2026-10-18T08:58:15.310284466Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares","Output":"=== RUN   TestHumanTenantBindsTheZoneAClientDeclares\n"}
+{"Time":"2026-10-18T08:58:15.310470898Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares","Output":"--- PASS: TestHumanTenantBindsTheZoneAClientDeclares (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.310489329Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.31049895Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared"}
+{"Time":"2026-10-18T08:58:15.31050492Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared\n"}
+{"Time":"2026-10-18T08:58:15.310692687Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all"}
+{"Time":"2026-10-18T08:58:15.310750731Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all\n"}
+{"Time":"2026-10-18T08:58:15.310931022Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.31097976Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.311002889Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing"}
+{"Time":"2026-10-18T08:58:15.31101068Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing\n"}
+{"Time":"2026-10-18T08:58:15.311248167Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.311267717Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.31137375Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins"}
+{"Time":"2026-10-18T08:58:15.311392092Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins\n"}
+{"Time":"2026-10-18T08:58:15.311598569Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.31161736Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.311782881Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.311802124Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.311906264Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser"}
+{"Time":"2026-10-18T08:58:15.311924876Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser","Output":"=== RUN   TestHumanTenantRefusesToRelabelAPlacedUser\n"}
+{"Time":"2026-10-18T08:58:15.312147971Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser","Output":"--- PASS: TestHumanTenantRefusesToRelabelAPlacedUser (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.312178756Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.312343492Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory"}
+{"Time":"2026-10-18T08:58:15.312363348Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory","Output":"=== RUN   TestHumanTenantAcceptsAgreementBetweenClientAndDirectory\n"}
+{"Time":"2026-10-18T08:58:15.312564451Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory","Output":"--- PASS: TestHumanTenantAcceptsAgreementBetweenClientAndDirectory (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.312587716Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.312599095Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration"}
+{"Time":"2026-10-18T08:58:15.312606057Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration","Output":"=== RUN   TestPrincipalTypeIsNeverSuppliedByConfiguration\n"}
+{"Time":"2026-10-18T08:58:15.376045509Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type (0.15s)\n"}
+{"Time":"2026-10-18T08:58:15.376093589Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:15.376108747Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope"}
+{"Time":"2026-10-18T08:58:15.376113553Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope\n"}
+{"Time":"2026-10-18T08:58:15.456673105Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration","Output":"--- PASS: TestPrincipalTypeIsNeverSuppliedByConfiguration (0.14s)\n"}
+{"Time":"2026-10-18T08:58:15.456726559Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration","Elapsed":0.14}
+{"Time":"2026-10-18T08:58:15.456736027Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones"}
+{"Time":"2026-10-18T08:58:15.456741798Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones","Output":"=== RUN   TestTokenStatusExactExpiryCapacityAndTombstones\n"}
+{"Time":"2026-10-18T08:58:15.457704519Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones","Output":"--- PASS: TestTokenStatusExactExpiryCapacityAndTombstones (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.457757396Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.457781238Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke"}
+{"Time":"2026-10-18T08:58:15.457790733Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke","Output":"=== RUN   TestTokenStatusConcurrentIssueReadAndRevoke\n"}
+{"Time":"2026-10-18T08:58:15.474751178Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke","Output":"--- PASS: TestTokenStatusConcurrentIssueReadAndRevoke (0.02s)\n"}
+{"Time":"2026-10-18T08:58:15.474829791Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke","Elapsed":0.02}
+{"Time":"2026-10-18T08:58:15.474852226Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID"}
+{"Time":"2026-10-18T08:58:15.474865463Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID","Output":"=== RUN   TestServiceAudienceIsStaticAndDefaultsToClientID\n"}
+{"Time":"2026-10-18T08:58:15.475405272Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00"}
+{"Time":"2026-10-18T08:58:15.47543401Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00","Output":"=== RUN   TestServiceAudienceIsStaticAndDefaultsToClientID/#00\n"}
+{"Time":"2026-10-18T08:58:15.483299744Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope (0.11s)\n"}
+{"Time":"2026-10-18T08:58:15.483367102Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:15.483501437Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope"}
+{"Time":"2026-10-18T08:58:15.483514152Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope\n"}
+{"Time":"2026-10-18T08:58:15.526835868Z","Action":"start","Package":"keycape/internal/server/policy"}
+{"Time":"2026-10-18T08:58:15.543928799Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback"}
+{"Time":"2026-10-18T08:58:15.543982921Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback","Output":"=== RUN   TestReviewedApplyReplayRestartRollback\n"}
+{"Time":"2026-10-18T08:58:15.546116429Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback","Output":"--- PASS: TestReviewedApplyReplayRestartRollback (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.546184383Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.546407497Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests"}
+{"Time":"2026-10-18T08:58:15.546447948Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests","Output":"=== RUN   TestStaleExpiredUnsupportedAndAlteredRequests\n"}
+{"Time":"2026-10-18T08:58:15.54760482Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests","Output":"--- PASS: TestStaleExpiredUnsupportedAndAlteredRequests (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.547688004Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.547696877Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter"}
+{"Time":"2026-10-18T08:58:15.547701684Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter","Output":"=== RUN   TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter\n"}
+{"Time":"2026-10-18T08:58:15.549087703Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter","Output":"--- PASS: TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.549143998Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.549156874Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed"}
+{"Time":"2026-10-18T08:58:15.549161275Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed","Output":"=== RUN   TestCorruptPersistenceFailsClosed\n"}
+{"Time":"2026-10-18T08:58:15.549666881Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed","Output":"--- PASS: TestCorruptPersistenceFailsClosed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.549732193Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.549741679Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA"}
+{"Time":"2026-10-18T08:58:15.549745457Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA","Output":"=== RUN   TestHTTPRequiresSignedFreshPlatformMFA\n"}
+{"Time":"2026-10-18T08:58:15.550529426Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00","Output":"--- PASS: TestServiceAudienceIsStaticAndDefaultsToClientID/#00 (0.07s)\n"}
+{"Time":"2026-10-18T08:58:15.550604017Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:15.550614675Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine"}
+{"Time":"2026-10-18T08:58:15.550619039Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine","Output":"=== RUN   TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine\n"}
+{"Time":"2026-10-18T08:58:15.58265963Z","Action":"start","Package":"keycape/internal/server/readiness"}
+{"Time":"2026-10-18T08:58:15.596708961Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine","Output":"--- PASS: TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine (0.05s)\n"}
+{"Time":"2026-10-18T08:58:15.596784733Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine","Elapsed":0.05}
+{"Time":"2026-10-18T08:58:15.596914165Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID","Output":"--- PASS: TestServiceAudienceIsStaticAndDefaultsToClientID (0.12s)\n"}
+{"Time":"2026-10-18T08:58:15.596939161Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:15.596986123Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience"}
+{"Time":"2026-10-18T08:58:15.597000559Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience","Output":"=== RUN   TestHumanResourceAudiencePreservesIDTokenAudience\n"}
+{"Time":"2026-10-18T08:58:15.600197428Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses"}
+{"Time":"2026-10-18T08:58:15.600245364Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses","Output":"=== RUN   TestReadyWhenEveryCheckPasses\n"}
+{"Time":"2026-10-18T08:58:15.601615258Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses","Output":"--- PASS: TestReadyWhenEveryCheckPasses (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.601662661Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.60194381Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails"}
+{"Time":"2026-10-18T08:58:15.601964063Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails","Output":"=== RUN   TestNotReadyWhenAnyCheckFails\n"}
+{"Time":"2026-10-18T08:58:15.602345186Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails","Output":"--- PASS: TestNotReadyWhenAnyCheckFails (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.602390011Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.602407549Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady"}
+{"Time":"2026-10-18T08:58:15.602412554Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady","Output":"=== RUN   TestNilProbeIsNotReady\n"}
+{"Time":"2026-10-18T08:58:15.602953868Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady","Output":"--- PASS: TestNilProbeIsNotReady (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.603047747Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.603069587Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed"}
+{"Time":"2026-10-18T08:58:15.603081138Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed","Output":"=== RUN   TestFailureDetailIsNotDisclosed\n"}
+{"Time":"2026-10-18T08:58:15.60345603Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed","Output":"--- PASS: TestFailureDetailIsNotDisclosed (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.603490404Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.603508772Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL"}
+{"Time":"2026-10-18T08:58:15.603514462Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL","Output":"=== RUN   TestResultsAreCachedWithinTheTTL\n"}
+{"Time":"2026-10-18T08:58:15.604351443Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL","Output":"--- PASS: TestResultsAreCachedWithinTheTTL (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.604381488Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.604397999Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking"}
+{"Time":"2026-10-18T08:58:15.604402913Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking","Output":"=== RUN   TestSlowProbeTimesOutRatherThanBlocking\n"}
+{"Time":"2026-10-18T08:58:15.62236654Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope (0.14s)\n"}
+{"Time":"2026-10-18T08:58:15.622475703Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Elapsed":0.14}
+{"Time":"2026-10-18T08:58:15.622488958Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client"}
+{"Time":"2026-10-18T08:58:15.622493512Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client\n"}
+{"Time":"2026-10-18T08:58:15.655839521Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking","Output":"--- PASS: TestSlowProbeTimesOutRatherThanBlocking (0.05s)\n"}
+{"Time":"2026-10-18T08:58:15.655892994Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking","Elapsed":0.05}
+{"Time":"2026-10-18T08:58:15.655902318Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently"}
+{"Time":"2026-10-18T08:58:15.655920965Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently","Output":"=== RUN   TestChecksRunConcurrently\n"}
+{"Time":"2026-10-18T08:58:15.684591125Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA","Output":"--- PASS: TestHTTPRequiresSignedFreshPlatformMFA (0.13s)\n"}
+{"Time":"2026-10-18T08:58:15.684668285Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA","Elapsed":0.13}
+{"Time":"2026-10-18T08:58:15.684692019Z","Action":"output","Package":"keycape/internal/server/policy","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:15.699500575Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience","Output":"--- PASS: TestHumanResourceAudiencePreservesIDTokenAudience (0.10s)\n"}
+{"Time":"2026-10-18T08:58:15.699572929Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:15.699586888Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication"}
+{"Time":"2026-10-18T08:58:15.699595283Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication","Output":"=== RUN   TestHumanExcessScopeRejectedBeforeAuthentication\n"}
+{"Time":"2026-10-18T08:58:15.699999071Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication","Output":"--- PASS: TestHumanExcessScopeRejectedBeforeAuthentication (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.700025383Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.700034725Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization"}
+{"Time":"2026-10-18T08:58:15.700041695Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization","Output":"=== RUN   TestTokenRejectsScopeRemovedAfterAuthorization\n"}
+{"Time":"2026-10-18T08:58:15.785569958Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client (0.16s)\n"}
+{"Time":"2026-10-18T08:58:15.785618759Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:15.785631789Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject"}
+{"Time":"2026-10-18T08:58:15.78563811Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject\n"}
+{"Time":"2026-10-18T08:58:15.80771779Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently","Output":"--- PASS: TestChecksRunConcurrently (0.15s)\n"}
+{"Time":"2026-10-18T08:58:15.807773589Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:15.807793373Z","Action":"output","Package":"keycape/internal/server/readiness","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:15.883203245Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization","Output":"--- PASS: TestTokenRejectsScopeRemovedAfterAuthorization (0.18s)\n"}
+{"Time":"2026-10-18T08:58:15.883248917Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization","Elapsed":0.18}
+{"Time":"2026-10-18T08:58:15.883278178Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia"}
+{"Time":"2026-10-18T08:58:15.883289829Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia","Output":"=== RUN   TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia\n"}
+{"Time":"2026-10-18T08:58:15.883495671Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia","Output":"--- PASS: TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.883521965Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.883532515Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia"}
+{"Time":"2026-10-18T08:58:15.88353834Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia","Output":"=== RUN   TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia\n"}
+{"Time":"2026-10-18T08:58:15.883848308Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia","Output":"--- PASS: TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.883871573Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.883885062Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart"}
+{"Time":"2026-10-18T08:58:15.883893629Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart","Output":"=== RUN   TestAuthorizeHandler_EmitsAuthStart\n"}
+{"Time":"2026-10-18T08:58:15.884208096Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart","Output":"--- PASS: TestAuthorizeHandler_EmitsAuthStart (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.884289342Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.884306673Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:15.884314969Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:15.884611068Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.884632935Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.884640942Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety"}
+{"Time":"2026-10-18T08:58:15.884648733Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety","Output":"=== RUN   TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety\n"}
+{"Time":"2026-10-18T08:58:15.884883813Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety","Output":"--- PASS: TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.884905689Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.88493063Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:15.884937511Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_UnknownClient_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:15.885194313Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_UnknownClient_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.885212311Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.885221121Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported"}
+{"Time":"2026-10-18T08:58:15.885226333Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported","Output":"=== RUN   TestAuthorizeHandler_WrongResponseType_FeatureNotSupported\n"}
+{"Time":"2026-10-18T08:58:15.885579052Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported","Output":"--- PASS: TestAuthorizeHandler_WrongResponseType_FeatureNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.885612452Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.885622614Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:15.885628178Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:15.885977425Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.886002953Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.886012998Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety"}
+{"Time":"2026-10-18T08:58:15.886018336Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety","Output":"=== RUN   TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety\n"}
+{"Time":"2026-10-18T08:58:15.886432625Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety","Output":"--- PASS: TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.886497783Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.886507143Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:15.886515917Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:15.88684355Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.886919132Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.886935219Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode"}
+{"Time":"2026-10-18T08:58:15.886941883Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode","Output":"=== RUN   TestAuthorizeCallback_Success_RedirectsWithCode\n"}
+{"Time":"2026-10-18T08:58:15.88953149Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode","Output":"--- PASS: TestAuthorizeCallback_Success_RedirectsWithCode (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.889579471Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.889589543Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure"}
+{"Time":"2026-10-18T08:58:15.889594457Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure","Output":"=== RUN   TestAuthorizeCallback_MFAFailed_AuthFailure\n"}
+{"Time":"2026-10-18T08:58:15.889943966Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure","Output":"--- PASS: TestAuthorizeCallback_MFAFailed_AuthFailure (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.890030577Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.890140181Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken"}
+{"Time":"2026-10-18T08:58:15.89015377Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken","Output":"=== RUN   TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken\n"}
+{"Time":"2026-10-18T08:58:15.891213266Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken","Output":"--- PASS: TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.891264827Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.891282735Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode"}
+{"Time":"2026-10-18T08:58:15.891289282Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode","Output":"=== RUN   TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode\n"}
+{"Time":"2026-10-18T08:58:15.891631982Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode","Output":"--- PASS: TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.891648871Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.891657898Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie"}
+{"Time":"2026-10-18T08:58:15.891663326Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie","Output":"=== RUN   TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie\n"}
+{"Time":"2026-10-18T08:58:15.892040518Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie","Output":"--- PASS: TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.892057786Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.8920671Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse"}
+{"Time":"2026-10-18T08:58:15.892072619Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse","Output":"=== RUN   TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse\n"}
+{"Time":"2026-10-18T08:58:15.892425356Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse","Output":"--- PASS: TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.892439639Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.892447917Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA"}
+{"Time":"2026-10-18T08:58:15.892452516Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA","Output":"=== RUN   TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA\n"}
+{"Time":"2026-10-18T08:58:15.89273618Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA","Output":"--- PASS: TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.89275949Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.892770076Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1"}
+{"Time":"2026-10-18T08:58:15.892776785Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1","Output":"=== RUN   TestAuthorizeCallback_ACRStepUpOverridesClientAAL1\n"}
+{"Time":"2026-10-18T08:58:15.893074246Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1","Output":"--- PASS: TestAuthorizeCallback_ACRStepUpOverridesClientAAL1 (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.893091667Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.893099098Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure"}
+{"Time":"2026-10-18T08:58:15.893103777Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure","Output":"=== RUN   TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure\n"}
+{"Time":"2026-10-18T08:58:15.893352951Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure","Output":"--- PASS: TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.893366928Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.893374989Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure"}
+{"Time":"2026-10-18T08:58:15.893379841Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure","Output":"=== RUN   TestAuthorizeCallback_AuthProviderFailed_AuthFailure\n"}
+{"Time":"2026-10-18T08:58:15.893604713Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure","Output":"--- PASS: TestAuthorizeCallback_AuthProviderFailed_AuthFailure (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.893618581Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.893626201Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess"}
+{"Time":"2026-10-18T08:58:15.893630727Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess","Output":"=== RUN   TestAuthorizeCallback_EmitsAuthSuccess\n"}
+{"Time":"2026-10-18T08:58:15.893922553Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess","Output":"--- PASS: TestAuthorizeCallback_EmitsAuthSuccess (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.893936457Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.893944086Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback"}
+{"Time":"2026-10-18T08:58:15.893948685Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback","Output":"=== RUN   TestAuthorizeHandler_ServeHTTP_DispatchesToCallback\n"}
+{"Time":"2026-10-18T08:58:15.894203873Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback","Output":"--- PASS: TestAuthorizeHandler_ServeHTTP_DispatchesToCallback (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.894220564Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.894228111Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider"}
+{"Time":"2026-10-18T08:58:15.894232656Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider","Output":"=== RUN   TestFreshLoginRequirementsReachProvider\n"}
+{"Time":"2026-10-18T08:58:15.894612859Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider","Output":"--- PASS: TestFreshLoginRequirementsReachProvider (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.894627458Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.894635105Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness"}
+{"Time":"2026-10-18T08:58:15.894654699Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness\n"}
+{"Time":"2026-10-18T08:58:15.894850927Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request"}
+{"Time":"2026-10-18T08:58:15.894885806Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request\n"}
+{"Time":"2026-10-18T08:58:15.895257684Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.895277432Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.895299858Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request"}
+{"Time":"2026-10-18T08:58:15.895305088Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request\n"}
+{"Time":"2026-10-18T08:58:15.895635696Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.895708546Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.895721062Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session"}
+{"Time":"2026-10-18T08:58:15.895726049Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session\n"}
+{"Time":"2026-10-18T08:58:15.895944916Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.895961435Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.896021075Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time"}
+{"Time":"2026-10-18T08:58:15.896032311Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time\n"}
+{"Time":"2026-10-18T08:58:15.896230726Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.896246606Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.896262413Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login"}
+{"Time":"2026-10-18T08:58:15.896272097Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login\n"}
+{"Time":"2026-10-18T08:58:15.896511082Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.89652458Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.896600019Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied"}
+{"Time":"2026-10-18T08:58:15.896609784Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/max_age_satisfied\n"}
+{"Time":"2026-10-18T08:58:15.896944784Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/max_age_satisfied (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.896965199Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.896971736Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded"}
+{"Time":"2026-10-18T08:58:15.896976552Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/max_age_exceeded\n"}
+{"Time":"2026-10-18T08:58:15.897154742Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/max_age_exceeded (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.897171072Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.897241371Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested"}
+{"Time":"2026-10-18T08:58:15.897251217Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/no_freshness_requested\n"}
+{"Time":"2026-10-18T08:58:15.897524882Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/no_freshness_requested (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.89753811Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.897628896Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.897738356Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.897752973Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode"}
+{"Time":"2026-10-18T08:58:15.897757419Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode","Output":"=== RUN   TestDiscoveryHandler_ResponseCode\n"}
+{"Time":"2026-10-18T08:58:15.898394965Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode","Output":"--- PASS: TestDiscoveryHandler_ResponseCode (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.89841208Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.898426868Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType"}
+{"Time":"2026-10-18T08:58:15.89843135Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType","Output":"=== RUN   TestDiscoveryHandler_ContentType\n"}
+{"Time":"2026-10-18T08:58:15.898703454Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType","Output":"--- PASS: TestDiscoveryHandler_ContentType (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.898723401Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.898742761Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl"}
+{"Time":"2026-10-18T08:58:15.898747116Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl","Output":"=== RUN   TestDiscoveryHandler_CacheControl\n"}
+{"Time":"2026-10-18T08:58:15.899172703Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl","Output":"--- PASS: TestDiscoveryHandler_CacheControl (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.89922641Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.899236536Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer"}
+{"Time":"2026-10-18T08:58:15.89924586Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer","Output":"=== RUN   TestDiscoveryHandler_Issuer\n"}
+{"Time":"2026-10-18T08:58:15.899646009Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer","Output":"--- PASS: TestDiscoveryHandler_Issuer (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.899665153Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.899672601Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints"}
+{"Time":"2026-10-18T08:58:15.899676884Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints","Output":"=== RUN   TestDiscoveryHandler_Endpoints\n"}
+{"Time":"2026-10-18T08:58:15.900228794Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints","Output":"--- PASS: TestDiscoveryHandler_Endpoints (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.900264673Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.900274899Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured"}
+{"Time":"2026-10-18T08:58:15.900280021Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured","Output":"=== RUN   TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured\n"}
+{"Time":"2026-10-18T08:58:15.900812003Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured","Output":"--- PASS: TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.900840813Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.900849686Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty"}
+{"Time":"2026-10-18T08:58:15.90085414Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty","Output":"=== RUN   TestDiscoveryHandler_EndSessionOmittedWhenEmpty\n"}
+{"Time":"2026-10-18T08:58:15.901330675Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty","Output":"--- PASS: TestDiscoveryHandler_EndSessionOmittedWhenEmpty (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.901344282Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.901350955Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty"}
+{"Time":"2026-10-18T08:58:15.901354913Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty","Output":"=== RUN   TestDiscoveryHandler_UserinfoOmittedWhenEmpty\n"}
+{"Time":"2026-10-18T08:58:15.901772836Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty","Output":"--- PASS: TestDiscoveryHandler_UserinfoOmittedWhenEmpty (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.901800311Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.901807724Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint"}
+{"Time":"2026-10-18T08:58:15.901811944Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint","Output":"=== RUN   TestDiscoveryHandler_NoRegistrationEndpoint\n"}
+{"Time":"2026-10-18T08:58:15.902247017Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint","Output":"--- PASS: TestDiscoveryHandler_NoRegistrationEndpoint (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.902523518Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.902547116Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes"}
+{"Time":"2026-10-18T08:58:15.902552346Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes","Output":"=== RUN   TestDiscoveryHandler_ResponseTypes\n"}
+{"Time":"2026-10-18T08:58:15.903239744Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes","Output":"--- PASS: TestDiscoveryHandler_ResponseTypes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.903280917Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.903287995Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes"}
+{"Time":"2026-10-18T08:58:15.903292143Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes","Output":"=== RUN   TestDiscoveryHandler_GrantTypes\n"}
+{"Time":"2026-10-18T08:58:15.903841041Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes","Output":"--- PASS: TestDiscoveryHandler_GrantTypes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.903854693Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.903861546Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod"}
+{"Time":"2026-10-18T08:58:15.90386555Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod","Output":"=== RUN   TestDiscoveryHandler_CodeChallengeMethod\n"}
+{"Time":"2026-10-18T08:58:15.904300263Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod","Output":"--- PASS: TestDiscoveryHandler_CodeChallengeMethod (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.904315105Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.904322454Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg"}
+{"Time":"2026-10-18T08:58:15.904326602Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg","Output":"=== RUN   TestDiscoveryHandler_SigningAlg\n"}
+{"Time":"2026-10-18T08:58:15.90478631Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg","Output":"--- PASS: TestDiscoveryHandler_SigningAlg (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.904800152Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.904806825Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes"}
+{"Time":"2026-10-18T08:58:15.90481072Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes","Output":"=== RUN   TestDiscoveryHandler_Scopes\n"}
+{"Time":"2026-10-18T08:58:15.905232457Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes","Output":"--- PASS: TestDiscoveryHandler_Scopes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.905244504Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.905251113Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods"}
+{"Time":"2026-10-18T08:58:15.905255063Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods","Output":"=== RUN   TestDiscoveryHandler_TokenEndpointAuthMethods\n"}
+{"Time":"2026-10-18T08:58:15.905720064Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods","Output":"--- PASS: TestDiscoveryHandler_TokenEndpointAuthMethods (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.905734267Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.905741877Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims"}
+{"Time":"2026-10-18T08:58:15.905745791Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims","Output":"=== RUN   TestDiscoveryHandler_Claims\n"}
+{"Time":"2026-10-18T08:58:15.906184489Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims","Output":"--- PASS: TestDiscoveryHandler_Claims (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.906196852Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.906203416Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim"}
+{"Time":"2026-10-18T08:58:15.906207465Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim","Output":"=== RUN   TestDiscoveryAdvertisesEveryCoreProfileClaim\n"}
+{"Time":"2026-10-18T08:58:15.906699145Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim","Output":"--- PASS: TestDiscoveryAdvertisesEveryCoreProfileClaim (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.906719605Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.906732283Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes"}
+{"Time":"2026-10-18T08:58:15.906736837Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes","Output":"=== RUN   TestDiscoveryScopesIncludeConfiguredResourceScopes\n"}
+{"Time":"2026-10-18T08:58:15.907250463Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes","Output":"--- PASS: TestDiscoveryScopesIncludeConfiguredResourceScopes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.907277857Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.907285729Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline"}
+{"Time":"2026-10-18T08:58:15.907290608Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline","Output":"=== RUN   TestDiscoveryScopesFallBackToBaseline\n"}
+{"Time":"2026-10-18T08:58:15.90773789Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline","Output":"--- PASS: TestDiscoveryScopesFallBackToBaseline (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.907750524Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.907770921Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes"}
+{"Time":"2026-10-18T08:58:15.907775168Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes","Output":"=== RUN   TestDiscoveryHandler_SubjectTypes\n"}
+{"Time":"2026-10-18T08:58:15.908244434Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes","Output":"--- PASS: TestDiscoveryHandler_SubjectTypes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.908258276Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.908265129Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported"}
+{"Time":"2026-10-18T08:58:15.908269115Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported","Output":"=== RUN   TestDiscoveryHandler_RequestParameterNotSupported\n"}
+{"Time":"2026-10-18T08:58:15.908689886Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported","Output":"--- PASS: TestDiscoveryHandler_RequestParameterNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.908701933Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.90870894Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported"}
+{"Time":"2026-10-18T08:58:15.908712907Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported","Output":"=== RUN   TestDiscoveryHandler_ClaimsParameterNotSupported\n"}
+{"Time":"2026-10-18T08:58:15.909152706Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported","Output":"--- PASS: TestDiscoveryHandler_ClaimsParameterNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.909165068Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.909172228Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList"}
+{"Time":"2026-10-18T08:58:15.909176169Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList","Output":"=== RUN   TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList\n"}
+{"Time":"2026-10-18T08:58:15.909845537Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList","Output":"--- PASS: TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.909865086Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.909875979Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected"}
+{"Time":"2026-10-18T08:58:15.909882111Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected","Output":"=== RUN   TestHandoff_PromptCreate_IneligibleClientRejected\n"}
+{"Time":"2026-10-18T08:58:15.910106316Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected","Output":"--- PASS: TestHandoff_PromptCreate_IneligibleClientRejected (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.910123512Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.910134026Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken"}
+{"Time":"2026-10-18T08:58:15.910155496Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken","Output":"=== RUN   TestHandoff_ReturnRestartsAuthorizeWithoutToken\n"}
+{"Time":"2026-10-18T08:58:15.911397811Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken","Output":"--- PASS: TestHandoff_ReturnRestartsAuthorizeWithoutToken (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.911441139Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.911451617Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected"}
+{"Time":"2026-10-18T08:58:15.911456938Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected","Output":"=== RUN   TestHandoff_ReplayRejected\n"}
+{"Time":"2026-10-18T08:58:15.9124909Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected","Output":"--- PASS: TestHandoff_ReplayRejected (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.912520423Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.912527646Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected"}
+{"Time":"2026-10-18T08:58:15.912532317Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected","Output":"=== RUN   TestHandoff_TamperedEnvelopeRejected\n"}
+{"Time":"2026-10-18T08:58:15.912975487Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected","Output":"--- PASS: TestHandoff_TamperedEnvelopeRejected (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.913075016Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.9130914Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken"}
+{"Time":"2026-10-18T08:58:15.913095106Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken","Output":"=== RUN   TestHandoff_UnknownUserOffersSignupWithoutToken\n"}
+{"Time":"2026-10-18T08:58:15.913740263Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken","Output":"--- PASS: TestHandoff_UnknownUserOffersSignupWithoutToken (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.913758929Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.91377938Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink"}
+{"Time":"2026-10-18T08:58:15.913788352Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink","Output":"=== RUN   TestHandoff_UnknownUserIneligibleHasNoSignupLink\n"}
+{"Time":"2026-10-18T08:58:15.914046318Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink","Output":"--- PASS: TestHandoff_UnknownUserIneligibleHasNoSignupLink (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.914066796Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.914074055Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected"}
+{"Time":"2026-10-18T08:58:15.914077256Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected","Output":"=== RUN   TestAuthorizeCallback_ExpiredStateRejected\n"}
+{"Time":"2026-10-18T08:58:15.914330446Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected","Output":"--- PASS: TestAuthorizeCallback_ExpiredStateRejected (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.91442446Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.914440312Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected"}
+{"Time":"2026-10-18T08:58:15.914448212Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected","Output":"=== RUN   TestAuthorizeCallback_ReplayAfterSuccessRejected\n"}
+{"Time":"2026-10-18T08:58:15.914949587Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected","Output":"--- PASS: TestAuthorizeCallback_ReplayAfterSuccessRejected (0.00s)\n"}
+{"Time":"2026-10-18T08:58:15.914995404Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected","Elapsed":0}
+{"Time":"2026-10-18T08:58:15.915002852Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission"}
+{"Time":"2026-10-18T08:58:15.915025945Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission\n"}
+{"Time":"2026-10-18T08:58:15.915168517Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing"}
+{"Time":"2026-10-18T08:58:15.915182449Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing\n"}
+{"Time":"2026-10-18T08:58:16.102335798Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing (0.19s)\n"}
+{"Time":"2026-10-18T08:58:16.102452039Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing","Elapsed":0.19}
+{"Time":"2026-10-18T08:58:16.102479731Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted"}
+{"Time":"2026-10-18T08:58:16.102500092Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted\n"}
+{"Time":"2026-10-18T08:58:16.139944265Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject (0.35s)\n"}
+{"Time":"2026-10-18T08:58:16.140007584Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Elapsed":0.35}
+{"Time":"2026-10-18T08:58:16.140022742Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer"}
+{"Time":"2026-10-18T08:58:16.140029487Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer\n"}
+{"Time":"2026-10-18T08:58:16.207614021Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted (0.11s)\n"}
+{"Time":"2026-10-18T08:58:16.207683075Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:16.207720776Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different"}
+{"Time":"2026-10-18T08:58:16.207731849Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different\n"}
+{"Time":"2026-10-18T08:58:16.253477515Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer (0.11s)\n"}
+{"Time":"2026-10-18T08:58:16.253531573Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:16.25354215Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience"}
+{"Time":"2026-10-18T08:58:16.253546488Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience\n"}
+{"Time":"2026-10-18T08:58:16.320319398Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience (0.07s)\n"}
+{"Time":"2026-10-18T08:58:16.320373745Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:16.320427244Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti"}
+{"Time":"2026-10-18T08:58:16.320435414Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti\n"}
+{"Time":"2026-10-18T08:58:16.394215824Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different (0.19s)\n"}
+{"Time":"2026-10-18T08:58:16.394287403Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different","Elapsed":0.19}
+{"Time":"2026-10-18T08:58:16.394302885Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix"}
+{"Time":"2026-10-18T08:58:16.394312164Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix\n"}
+{"Time":"2026-10-18T08:58:16.406090745Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti (0.09s)\n"}
+{"Time":"2026-10-18T08:58:16.406163198Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:16.406177166Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry"}
+{"Time":"2026-10-18T08:58:16.40618429Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry\n"}
+{"Time":"2026-10-18T08:58:16.487876798Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix (0.09s)\n"}
+{"Time":"2026-10-18T08:58:16.487946637Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:16.487969577Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission (0.57s)\n"}
+{"Time":"2026-10-18T08:58:16.487977927Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission","Elapsed":0.57}
+{"Time":"2026-10-18T08:58:16.487987575Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient"}
+{"Time":"2026-10-18T08:58:16.487994437Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient","Output":"=== RUN   TestCodeExchangeRejectsServiceOnlyClient\n"}
+{"Time":"2026-10-18T08:58:16.574234871Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient","Output":"--- PASS: TestCodeExchangeRejectsServiceOnlyClient (0.09s)\n"}
+{"Time":"2026-10-18T08:58:16.574317559Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:16.574337929Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient"}
+{"Time":"2026-10-18T08:58:16.574346622Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient","Output":"=== RUN   TestCodeExchangeAllowsImplicitAuthorizationCodeClient\n"}
+{"Time":"2026-10-18T08:58:16.625805708Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry (0.22s)\n"}
+{"Time":"2026-10-18T08:58:16.625856583Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:16.625871426Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued"}
+{"Time":"2026-10-18T08:58:16.625878107Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued\n"}
+{"Time":"2026-10-18T08:58:16.688995762Z","Action":"output","Package":"keycape/internal/server/policy","Output":"ok  \tkeycape/internal/server/policy\t1.162s\n"}
+{"Time":"2026-10-18T08:58:16.6890645Z","Action":"pass","Package":"keycape/internal/server/policy","Elapsed":1.162}
+{"Time":"2026-10-18T08:58:16.691145898Z","Action":"start","Package":"keycape/internal/server/telemetry"}
+{"Time":"2026-10-18T08:58:16.70988488Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic"}
+{"Time":"2026-10-18T08:58:16.709946792Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic","Output":"=== RUN   TestNoopEmitter_DoesNotPanic\n"}
+{"Time":"2026-10-18T08:58:16.710176975Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic","Output":"--- PASS: TestNoopEmitter_DoesNotPanic (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.71019978Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.710216354Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface"}
+{"Time":"2026-10-18T08:58:16.710238293Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface","Output":"=== RUN   TestNoopEmitter_ImplementsInterface\n"}
+{"Time":"2026-10-18T08:58:16.710600479Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface","Output":"--- PASS: TestNoopEmitter_ImplementsInterface (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.710703002Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.710753436Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON"}
+{"Time":"2026-10-18T08:58:16.710761443Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON","Output":"=== RUN   TestLogEmitter_WritesJSON\n"}
+{"Time":"2026-10-18T08:58:16.711352235Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON","Output":"--- PASS: TestLogEmitter_WritesJSON (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.711393913Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.711539996Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields"}
+{"Time":"2026-10-18T08:58:16.711557769Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields","Output":"=== RUN   TestLogEmitter_ContainsEventFields\n"}
+{"Time":"2026-10-18T08:58:16.711974275Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields","Output":"--- PASS: TestLogEmitter_ContainsEventFields (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.712008279Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.712106811Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue"}
+{"Time":"2026-10-18T08:58:16.712121942Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue","Output":"=== RUN   TestLogEmitter_EventTypeValue\n"}
+{"Time":"2026-10-18T08:58:16.712537734Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue","Output":"--- PASS: TestLogEmitter_EventTypeValue (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.71256098Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.712656079Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface"}
+{"Time":"2026-10-18T08:58:16.712705637Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface","Output":"=== RUN   TestLogEmitter_ImplementsInterface\n"}
+{"Time":"2026-10-18T08:58:16.712909307Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface","Output":"--- PASS: TestLogEmitter_ImplementsInterface (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.712929145Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.713026387Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut"}
+{"Time":"2026-10-18T08:58:16.713036811Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut","Output":"=== RUN   TestMultiEmitter_FansOut\n"}
+{"Time":"2026-10-18T08:58:16.713278978Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut","Output":"--- PASS: TestMultiEmitter_FansOut (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.713297816Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.713331441Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop"}
+{"Time":"2026-10-18T08:58:16.713337248Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop","Output":"=== RUN   TestMultiEmitter_EmptyIsNoop\n"}
+{"Time":"2026-10-18T08:58:16.713540551Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop","Output":"--- PASS: TestMultiEmitter_EmptyIsNoop (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.713553824Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.713644631Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface"}
+{"Time":"2026-10-18T08:58:16.713664559Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface","Output":"=== RUN   TestMultiEmitter_ImplementsInterface\n"}
+{"Time":"2026-10-18T08:58:16.713830969Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface","Output":"--- PASS: TestMultiEmitter_ImplementsInterface (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.713852061Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.713862927Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip"}
+{"Time":"2026-10-18T08:58:16.713869491Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip","Output":"=== RUN   TestWithEmitter_RoundTrip\n"}
+{"Time":"2026-10-18T08:58:16.714135692Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip","Output":"--- PASS: TestWithEmitter_RoundTrip (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.71415645Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.714176107Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop"}
+{"Time":"2026-10-18T08:58:16.714214584Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop","Output":"=== RUN   TestEmitterFromContext_FallsBackToNoop\n"}
+{"Time":"2026-10-18T08:58:16.714399014Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop","Output":"--- PASS: TestEmitterFromContext_FallsBackToNoop (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.714413784Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.714493154Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants"}
+{"Time":"2026-10-18T08:58:16.714506048Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants","Output":"=== RUN   TestEventTypeConstants\n"}
+{"Time":"2026-10-18T08:58:16.714652705Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants","Output":"--- PASS: TestEventTypeConstants (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.714801462Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued (0.09s)\n"}
+{"Time":"2026-10-18T08:58:16.714849786Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:16.71478574Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.71488594Z","Action":"output","Package":"keycape/internal/server/telemetry","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:16.714949084Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope"}
+{"Time":"2026-10-18T08:58:16.714960013Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope\n"}
+{"Time":"2026-10-18T08:58:16.811960865Z","Action":"output","Package":"keycape/internal/server/readiness","Output":"ok  \tkeycape/internal/server/readiness\t1.229s\n"}
+{"Time":"2026-10-18T08:58:16.812037611Z","Action":"pass","Package":"keycape/internal/server/readiness","Elapsed":1.229}
+{"Time":"2026-10-18T08:58:16.816286403Z","Action":"start","Package":"keycape/internal/validator"}
+{"Time":"2026-10-18T08:58:16.819759141Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope (0.10s)\n"}
+{"Time":"2026-10-18T08:58:16.819833326Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:16.819929233Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type"}
+{"Time":"2026-10-18T08:58:16.819940306Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type\n"}
+{"Time":"2026-10-18T08:58:16.830930124Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass"}
+{"Time":"2026-10-18T08:58:16.830992712Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass","Output":"=== RUN   TestValidDNStructure_Pass\n"}
+{"Time":"2026-10-18T08:58:16.831218913Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass","Output":"--- PASS: TestValidDNStructure_Pass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.831244333Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.83125794Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID"}
+{"Time":"2026-10-18T08:58:16.831264126Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID","Output":"=== RUN   TestValidDNStructure_EmptyID\n"}
+{"Time":"2026-10-18T08:58:16.831363694Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID","Output":"--- PASS: TestValidDNStructure_EmptyID (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.831384235Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.831477185Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername"}
+{"Time":"2026-10-18T08:58:16.831492875Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername","Output":"=== RUN   TestValidDNStructure_InvalidUsername\n"}
+{"Time":"2026-10-18T08:58:16.831698844Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername","Output":"--- PASS: TestValidDNStructure_InvalidUsername (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.831717762Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.83172751Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName"}
+{"Time":"2026-10-18T08:58:16.831732956Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName","Output":"=== RUN   TestValidDNStructure_InvalidGroupName\n"}
+{"Time":"2026-10-18T08:58:16.831949055Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName","Output":"--- PASS: TestValidDNStructure_InvalidGroupName (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.831963789Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.831972085Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass"}
+{"Time":"2026-10-18T08:58:16.83197708Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass","Output":"=== RUN   TestRequiredAttributesPresent_Pass\n"}
+{"Time":"2026-10-18T08:58:16.832182917Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass","Output":"--- PASS: TestRequiredAttributesPresent_Pass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.832203026Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.83224675Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername"}
+{"Time":"2026-10-18T08:58:16.832253549Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername","Output":"=== RUN   TestRequiredAttributesPresent_MissingUsername\n"}
+{"Time":"2026-10-18T08:58:16.832451045Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername","Output":"--- PASS: TestRequiredAttributesPresent_MissingUsername (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.832463696Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.832549495Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName"}
+{"Time":"2026-10-18T08:58:16.83255964Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName","Output":"=== RUN   TestRequiredAttributesPresent_MissingDisplayName\n"}
+{"Time":"2026-10-18T08:58:16.832741725Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName","Output":"--- PASS: TestRequiredAttributesPresent_MissingDisplayName (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.832755161Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.832840321Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes"}
+{"Time":"2026-10-18T08:58:16.832886516Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes\n"}
+{"Time":"2026-10-18T08:58:16.833030575Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes"}
+{"Time":"2026-10-18T08:58:16.833046959Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/no_attributes\n"}
+{"Time":"2026-10-18T08:58:16.833208351Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/no_attributes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.833255755Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.833273311Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor"}
+{"Time":"2026-10-18T08:58:16.833280101Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor\n"}
+{"Time":"2026-10-18T08:58:16.833564856Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.833592773Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.833604964Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits"}
+{"Time":"2026-10-18T08:58:16.833610808Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits\n"}
+{"Time":"2026-10-18T08:58:16.833763615Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.833779558Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.833793805Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid"}
+{"Time":"2026-10-18T08:58:16.833799738Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid\n"}
+{"Time":"2026-10-18T08:58:16.834020284Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.834039211Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.834132897Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes"}
+{"Time":"2026-10-18T08:58:16.834146721Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes\n"}
+{"Time":"2026-10-18T08:58:16.834329536Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.834346895Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.83449246Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.834506428Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.834603021Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors"}
+{"Time":"2026-10-18T08:58:16.834613445Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors\n"}
+{"Time":"2026-10-18T08:58:16.834861444Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid"}
+{"Time":"2026-10-18T08:58:16.834909253Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid\n"}
+{"Time":"2026-10-18T08:58:16.834920047Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.835027091Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.835045856Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc"}
+{"Time":"2026-10-18T08:58:16.835055333Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc\n"}
+{"Time":"2026-10-18T08:58:16.835301296Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.835316463Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.835324227Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only"}
+{"Time":"2026-10-18T08:58:16.835328555Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/whitespace_only\n"}
+{"Time":"2026-10-18T08:58:16.835522552Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/whitespace_only (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.835545375Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.835654575Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit"}
+{"Time":"2026-10-18T08:58:16.835675712Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/leading_digit\n"}
+{"Time":"2026-10-18T08:58:16.835944942Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/leading_digit (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.835971858Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.835990542Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore"}
+{"Time":"2026-10-18T08:58:16.835996917Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/underscore\n"}
+{"Time":"2026-10-18T08:58:16.836284144Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/underscore (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.836318896Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.836481546Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside"}
+{"Time":"2026-10-18T08:58:16.836502511Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/space_inside\n"}
+{"Time":"2026-10-18T08:58:16.836729351Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/space_inside (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.836751732Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.836841147Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option"}
+{"Time":"2026-10-18T08:58:16.836853158Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/transfer_option\n"}
+{"Time":"2026-10-18T08:58:16.837044766Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/transfer_option (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.837096786Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.837168185Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc"}
+{"Time":"2026-10-18T08:58:16.837176886Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc\n"}
+{"Time":"2026-10-18T08:58:16.837425843Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.837523102Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.837608802Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank"}
+{"Time":"2026-10-18T08:58:16.837617639Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/blank\n"}
+{"Time":"2026-10-18T08:58:16.837865027Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/blank (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.837900204Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.838022928Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen"}
+{"Time":"2026-10-18T08:58:16.838034777Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen\n"}
+{"Time":"2026-10-18T08:58:16.838241155Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.838284005Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.838303166Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid"}
+{"Time":"2026-10-18T08:58:16.838306926Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid\n"}
+{"Time":"2026-10-18T08:58:16.838508669Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.838530212Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.83862822Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.838726131Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.83883321Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings"}
+{"Time":"2026-10-18T08:58:16.838856259Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings\n"}
+{"Time":"2026-10-18T08:58:16.8389903Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid"}
+{"Time":"2026-10-18T08:58:16.839009795Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/uid\n"}
+{"Time":"2026-10-18T08:58:16.839184134Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/uid (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.839198327Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.839204477Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn"}
+{"Time":"2026-10-18T08:58:16.839207769Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/cn\n"}
+{"Time":"2026-10-18T08:58:16.8393976Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/cn (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.839414589Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.839421559Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail"}
+{"Time":"2026-10-18T08:58:16.83942604Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/mail\n"}
+{"Time":"2026-10-18T08:58:16.839604528Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/mail (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.839621886Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.839643609Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID"}
+{"Time":"2026-10-18T08:58:16.839648757Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/UID\n"}
+{"Time":"2026-10-18T08:58:16.83981032Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/UID (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.839848607Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.839959447Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail"}
+{"Time":"2026-10-18T08:58:16.839970123Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/Mail\n"}
+{"Time":"2026-10-18T08:58:16.840117519Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/Mail (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.840131243Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.840137826Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN"}
+{"Time":"2026-10-18T08:58:16.84014201Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/cN\n"}
+{"Time":"2026-10-18T08:58:16.84041076Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/cN (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.840429155Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.84043783Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.840447947Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.840462862Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates"}
+{"Time":"2026-10-18T08:58:16.840471122Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates","Output":"=== RUN   TestRawAttributes_RejectsCaseOnlyDuplicates\n"}
+{"Time":"2026-10-18T08:58:16.840663234Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates","Output":"--- PASS: TestRawAttributes_RejectsCaseOnlyDuplicates (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.840676742Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.840686273Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute"}
+{"Time":"2026-10-18T08:58:16.840690448Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute","Output":"=== RUN   TestRawAttributes_MessageNamesUserAndAttribute\n"}
+{"Time":"2026-10-18T08:58:16.840863219Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute","Output":"--- PASS: TestRawAttributes_MessageNamesUserAndAttribute (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.840892074Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.840900325Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass"}
+{"Time":"2026-10-18T08:58:16.840905789Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass","Output":"=== RUN   TestValidGroupMemberships_Pass\n"}
+{"Time":"2026-10-18T08:58:16.841128858Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass","Output":"--- PASS: TestValidGroupMemberships_Pass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.841143574Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.841225387Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember"}
+{"Time":"2026-10-18T08:58:16.841235415Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember","Output":"=== RUN   TestValidGroupMemberships_BlankMember\n"}
+{"Time":"2026-10-18T08:58:16.841436446Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember","Output":"--- PASS: TestValidGroupMemberships_BlankMember (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.841457177Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.841495969Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass"}
+{"Time":"2026-10-18T08:58:16.841505726Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass","Output":"=== RUN   TestReferencedUsersExist_Pass\n"}
+{"Time":"2026-10-18T08:58:16.841699469Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass","Output":"--- PASS: TestReferencedUsersExist_Pass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.841713924Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.8417212Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser"}
+{"Time":"2026-10-18T08:58:16.841725249Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser","Output":"=== RUN   TestReferencedUsersExist_UnknownUser\n"}
+{"Time":"2026-10-18T08:58:16.841893655Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser","Output":"--- PASS: TestReferencedUsersExist_UnknownUser (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.841907488Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.841997841Z","Action":"run","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass"}
+{"Time":"2026-10-18T08:58:16.8420084Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass","Output":"=== RUN   TestNoCyclicGroups_Pass\n"}
+{"Time":"2026-10-18T08:58:16.842186536Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass","Output":"--- PASS: TestNoCyclicGroups_Pass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.842200025Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.842213777Z","Action":"run","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers"}
+{"Time":"2026-10-18T08:58:16.842217852Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers","Output":"=== RUN   TestNoCyclicGroups_GroupInMembers\n"}
+{"Time":"2026-10-18T08:58:16.842412273Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers","Output":"--- PASS: TestNoCyclicGroups_GroupInMembers (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.842462662Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.842486359Z","Action":"run","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass"}
+{"Time":"2026-10-18T08:58:16.842497459Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass","Output":"=== RUN   TestUsernamesUnique_Pass\n"}
+{"Time":"2026-10-18T08:58:16.842647813Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass","Output":"--- PASS: TestUsernamesUnique_Pass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.842661564Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.842678661Z","Action":"run","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate"}
+{"Time":"2026-10-18T08:58:16.842682917Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate","Output":"=== RUN   TestUsernamesUnique_Duplicate\n"}
+{"Time":"2026-10-18T08:58:16.842972506Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate","Output":"--- PASS: TestUsernamesUnique_Duplicate (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.843009278Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.843095528Z","Action":"run","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass"}
+{"Time":"2026-10-18T08:58:16.843105763Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass","Output":"=== RUN   TestEmailFormatValid_Pass\n"}
+{"Time":"2026-10-18T08:58:16.843297578Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass","Output":"--- PASS: TestEmailFormatValid_Pass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.843309372Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.843403449Z","Action":"run","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail"}
+{"Time":"2026-10-18T08:58:16.843415578Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail","Output":"=== RUN   TestEmailFormatValid_InvalidEmail\n"}
+{"Time":"2026-10-18T08:58:16.84362384Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail","Output":"--- PASS: TestEmailFormatValid_InvalidEmail (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.843637591Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.843722056Z","Action":"run","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped"}
+{"Time":"2026-10-18T08:58:16.843732146Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped","Output":"=== RUN   TestEmailFormatValid_EmptyEmailSkipped\n"}
+{"Time":"2026-10-18T08:58:16.843906549Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped","Output":"--- PASS: TestEmailFormatValid_EmptyEmailSkipped (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.843920174Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.844002682Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood"}
+{"Time":"2026-10-18T08:58:16.844012465Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood","Output":"=== RUN   TestReportPassed_AllGood\n"}
+{"Time":"2026-10-18T08:58:16.844288223Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood","Output":"--- PASS: TestReportPassed_AllGood (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.844337052Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.844501391Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails"}
+{"Time":"2026-10-18T08:58:16.844515972Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails","Output":"=== RUN   TestReportFailed_OneRuleFails\n"}
+{"Time":"2026-10-18T08:58:16.844746308Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails","Output":"--- PASS: TestReportFailed_OneRuleFails (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.844776922Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.844866445Z","Action":"run","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport"}
+{"Time":"2026-10-18T08:58:16.844875147Z","Action":"output","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport","Output":"=== RUN   TestModeRecordedInReport\n"}
+{"Time":"2026-10-18T08:58:16.845128081Z","Action":"output","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport","Output":"--- PASS: TestModeRecordedInReport (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.84514965Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.845228344Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations"}
+{"Time":"2026-10-18T08:58:16.845236675Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations","Output":"=== RUN   TestRawAttributes_IgnoresToolingAnnotations\n"}
+{"Time":"2026-10-18T08:58:16.845447832Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations","Output":"--- PASS: TestRawAttributes_IgnoresToolingAnnotations (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.845465127Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.845505768Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule"}
+{"Time":"2026-10-18T08:58:16.845513171Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule","Output":"=== RUN   TestRawAttributes_ExemptionDoesNotWeakenTheRule\n"}
+{"Time":"2026-10-18T08:58:16.84578772Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule","Output":"--- PASS: TestRawAttributes_ExemptionDoesNotWeakenTheRule (0.00s)\n"}
+{"Time":"2026-10-18T08:58:16.845807224Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule","Elapsed":0}
+{"Time":"2026-10-18T08:58:16.845829028Z","Action":"output","Package":"keycape/internal/validator","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:16.924060901Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type (0.10s)\n"}
+{"Time":"2026-10-18T08:58:16.924120668Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:16.924279976Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field"}
+{"Time":"2026-10-18T08:58:16.924293773Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field\n"}
+{"Time":"2026-10-18T08:58:16.974466521Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field (0.05s)\n"}
+{"Time":"2026-10-18T08:58:16.974568533Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Elapsed":0.05}
+{"Time":"2026-10-18T08:58:16.974587334Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active"}
+{"Time":"2026-10-18T08:58:16.974594079Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active\n"}
+{"Time":"2026-10-18T08:58:17.000755409Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient","Output":"--- PASS: TestCodeExchangeAllowsImplicitAuthorizationCodeClient (0.43s)\n"}
+{"Time":"2026-10-18T08:58:17.000811298Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient","Elapsed":0.43}
+{"Time":"2026-10-18T08:58:17.000828142Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret"}
+{"Time":"2026-10-18T08:58:17.000835193Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret\n"}
+{"Time":"2026-10-18T08:58:17.000858187Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials"}
+{"Time":"2026-10-18T08:58:17.000864598Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/no_credentials\n"}
+{"Time":"2026-10-18T08:58:17.180995126Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active (0.21s)\n"}
+{"Time":"2026-10-18T08:58:17.181057002Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Elapsed":0.21}
+{"Time":"2026-10-18T08:58:17.181070573Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json"}
+{"Time":"2026-10-18T08:58:17.181084343Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json\n"}
+{"Time":"2026-10-18T08:58:17.208259454Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/no_credentials (0.21s)\n"}
+{"Time":"2026-10-18T08:58:17.208352386Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials","Elapsed":0.21}
+{"Time":"2026-10-18T08:58:17.208375641Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret"}
+{"Time":"2026-10-18T08:58:17.208385777Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/wrong_secret\n"}
+{"Time":"2026-10-18T08:58:17.251389274Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json (0.07s)\n"}
+{"Time":"2026-10-18T08:58:17.25145427Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:17.251468572Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect"}
+{"Time":"2026-10-18T08:58:17.251475109Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect\n"}
+{"Time":"2026-10-18T08:58:17.257850746Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/wrong_secret (0.05s)\n"}
+{"Time":"2026-10-18T08:58:17.257929566Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret","Elapsed":0.05}
+{"Time":"2026-10-18T08:58:17.257955608Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity"}
+{"Time":"2026-10-18T08:58:17.257973507Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/other_client_identity\n"}
+{"Time":"2026-10-18T08:58:17.333146296Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/other_client_identity (0.08s)\n"}
+{"Time":"2026-10-18T08:58:17.333212924Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:17.33323645Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret"}
+{"Time":"2026-10-18T08:58:17.333242266Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/correct_secret\n"}
+{"Time":"2026-10-18T08:58:17.406065289Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect (0.15s)\n"}
+{"Time":"2026-10-18T08:58:17.406114415Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:17.406125082Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable"}
+{"Time":"2026-10-18T08:58:17.406130033Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable\n"}
+{"Time":"2026-10-18T08:58:17.452410184Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/correct_secret (0.12s)\n"}
+{"Time":"2026-10-18T08:58:17.452463638Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:17.452478246Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret (0.45s)\n"}
+{"Time":"2026-10-18T08:58:17.452486263Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret","Elapsed":0.45}
+{"Time":"2026-10-18T08:58:17.452513396Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected"}
+{"Time":"2026-10-18T08:58:17.452520222Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected","Output":"=== RUN   TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected\n"}
+{"Time":"2026-10-18T08:58:17.541184462Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable (0.13s)\n"}
+{"Time":"2026-10-18T08:58:17.541247889Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Elapsed":0.13}
+{"Time":"2026-10-18T08:58:17.541258214Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize"}
+{"Time":"2026-10-18T08:58:17.541264697Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize\n"}
+{"Time":"2026-10-18T08:58:17.717748209Z","Action":"output","Package":"keycape/internal/server/telemetry","Output":"ok  \tkeycape/internal/server/telemetry\t1.027s\n"}
+{"Time":"2026-10-18T08:58:17.717801078Z","Action":"pass","Package":"keycape/internal/server/telemetry","Elapsed":1.027}
+{"Time":"2026-10-18T08:58:17.797565353Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected","Output":"--- PASS: TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected (0.34s)\n"}
+{"Time":"2026-10-18T08:58:17.797627464Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected","Elapsed":0.34}
+{"Time":"2026-10-18T08:58:17.797639601Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce"}
+{"Time":"2026-10-18T08:58:17.797652622Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce","Output":"=== RUN   TestConcurrentCodeExchangeSucceedsExactlyOnce\n"}
+{"Time":"2026-10-18T08:58:17.848883289Z","Action":"output","Package":"keycape/internal/validator","Output":"ok  \tkeycape/internal/validator\t1.033s\n"}
+{"Time":"2026-10-18T08:58:17.848935607Z","Action":"pass","Package":"keycape/internal/validator","Elapsed":1.033}
+{"Time":"2026-10-18T08:58:17.908683557Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize (0.37s)\n"}
+{"Time":"2026-10-18T08:58:17.908752963Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Elapsed":0.37}
+{"Time":"2026-10-18T08:58:17.908765425Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached"}
+{"Time":"2026-10-18T08:58:17.908769591Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached\n"}
+{"Time":"2026-10-18T08:58:17.910862774Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce","Output":"--- PASS: TestConcurrentCodeExchangeSucceedsExactlyOnce (0.11s)\n"}
+{"Time":"2026-10-18T08:58:17.910939141Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:17.91095704Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode"}
+{"Time":"2026-10-18T08:58:17.910984083Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode","Output":"=== RUN   TestFailedExchangeConsumesTheCode\n"}
+{"Time":"2026-10-18T08:58:17.989370271Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached (0.08s)\n"}
+{"Time":"2026-10-18T08:58:17.989426782Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:17.98944772Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type"}
+{"Time":"2026-10-18T08:58:17.989458802Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type\n"}
+{"Time":"2026-10-18T08:58:18.280993565Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode","Output":"--- PASS: TestFailedExchangeConsumesTheCode (0.37s)\n"}
+{"Time":"2026-10-18T08:58:18.281071961Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode","Elapsed":0.37}
+{"Time":"2026-10-18T08:58:18.281094215Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes"}
+{"Time":"2026-10-18T08:58:18.28110711Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes\n"}
+{"Time":"2026-10-18T08:58:18.281123142Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token"}
+{"Time":"2026-10-18T08:58:18.2811305Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token\n"}
+{"Time":"2026-10-18T08:58:18.378914997Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token (0.10s)\n"}
+{"Time":"2026-10-18T08:58:18.378992392Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:18.379011815Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer"}
+{"Time":"2026-10-18T08:58:18.379020526Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer\n"}
+{"Time":"2026-10-18T08:58:18.417050105Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type (0.43s)\n"}
+{"Time":"2026-10-18T08:58:18.417115182Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Elapsed":0.43}
+{"Time":"2026-10-18T08:58:18.417133929Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus (3.37s)\n"}
+{"Time":"2026-10-18T08:58:18.417316844Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Elapsed":3.37}
+{"Time":"2026-10-18T08:58:18.417354815Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope"}
+{"Time":"2026-10-18T08:58:18.417375303Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"=== RUN   TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope\n"}
+{"Time":"2026-10-18T08:58:18.468966396Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer (0.09s)\n"}
+{"Time":"2026-10-18T08:58:18.469069464Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:18.469091998Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer"}
+{"Time":"2026-10-18T08:58:18.469097706Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer\n"}
+{"Time":"2026-10-18T08:58:18.469773372Z","Action":"start","Package":"keycape/tests/conformance"}
+{"Time":"2026-10-18T08:58:18.498176545Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself"}
+{"Time":"2026-10-18T08:58:18.498254815Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Output":"=== RUN   TestIssuerAdvertisesItself\n"}
+{"Time":"2026-10-18T08:58:18.498595604Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Output":"    external_test.go:101: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T08:58:18.498695723Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Output":"--- SKIP: TestIssuerAdvertisesItself (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.498726093Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.498768727Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface"}
+{"Time":"2026-10-18T08:58:18.498793903Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Output":"=== RUN   TestProfileAuthorizationSurface\n"}
+{"Time":"2026-10-18T08:58:18.4990602Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Output":"    external_test.go:111: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T08:58:18.499091453Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Output":"--- SKIP: TestProfileAuthorizationSurface (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.499217551Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.499360195Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable"}
+{"Time":"2026-10-18T08:58:18.499370059Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Output":"=== RUN   TestPublishedKeysAreUsable\n"}
+{"Time":"2026-10-18T08:58:18.499665149Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Output":"    external_test.go:145: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T08:58:18.499697332Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Output":"--- SKIP: TestPublishedKeysAreUsable (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.499730055Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.499773897Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised"}
+{"Time":"2026-10-18T08:58:18.499789696Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Output":"=== RUN   TestExcludedGrantsAreNotAdvertised\n"}
+{"Time":"2026-10-18T08:58:18.500078767Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Output":"    external_test.go:162: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T08:58:18.500104655Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Output":"--- SKIP: TestExcludedGrantsAreNotAdvertised (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.500309964Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.500337241Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys"}
+{"Time":"2026-10-18T08:58:18.500345501Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Output":"=== RUN   TestServiceTokenVerifiesAgainstPublishedKeys\n"}
+{"Time":"2026-10-18T08:58:18.500474447Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Output":"    external_test.go:177: KEYCAPE_TEST_CLIENT_ID/SECRET not set; skipping token exchange\n"}
+{"Time":"2026-10-18T08:58:18.500507622Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Output":"--- SKIP: TestServiceTokenVerifiesAgainstPublishedKeys (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.500671443Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.500688116Z","Action":"output","Package":"keycape/tests/conformance","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:18.543036792Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer (0.07s)\n"}
+{"Time":"2026-10-18T08:58:18.543344167Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:18.543367098Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token"}
+{"Time":"2026-10-18T08:58:18.543372382Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token\n"}
+{"Time":"2026-10-18T08:58:18.57678597Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"--- PASS: TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope (0.16s)\n"}
+{"Time":"2026-10-18T08:58:18.576846674Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:18.576856674Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles"}
+{"Time":"2026-10-18T08:58:18.576863329Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles\n"}
+{"Time":"2026-10-18T08:58:18.577030319Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret"}
+{"Time":"2026-10-18T08:58:18.57704454Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret\n"}
+{"Time":"2026-10-18T08:58:18.672040667Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token (0.13s)\n"}
+{"Time":"2026-10-18T08:58:18.672133553Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token","Elapsed":0.13}
+{"Time":"2026-10-18T08:58:18.672154591Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes (0.39s)\n"}
+{"Time":"2026-10-18T08:58:18.672235926Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes","Elapsed":0.39}
+{"Time":"2026-10-18T08:58:18.672249912Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms"}
+{"Time":"2026-10-18T08:58:18.672255485Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms","Output":"=== RUN   TestUserinfoRejectsNonRS256Algorithms\n"}
+{"Time":"2026-10-18T08:58:18.754424258Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret (0.18s)\n"}
+{"Time":"2026-10-18T08:58:18.7544948Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Elapsed":0.18}
+{"Time":"2026-10-18T08:58:18.754507596Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys"}
+{"Time":"2026-10-18T08:58:18.754514106Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/keys\n"}
+{"Time":"2026-10-18T08:58:18.77151121Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms","Output":"--- PASS: TestUserinfoRejectsNonRS256Algorithms (0.10s)\n"}
+{"Time":"2026-10-18T08:58:18.771577757Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:18.771596315Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode"}
+{"Time":"2026-10-18T08:58:18.771603222Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode","Output":"=== RUN   TestJWKSHandler_ResponseCode\n"}
+{"Time":"2026-10-18T08:58:18.935014073Z","Action":"start","Package":"keycape/tests/migration"}
+{"Time":"2026-10-18T08:58:18.959395353Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode","Output":"--- PASS: TestJWKSHandler_ResponseCode (0.19s)\n"}
+{"Time":"2026-10-18T08:58:18.959666346Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode","Elapsed":0.19}
+{"Time":"2026-10-18T08:58:18.959710919Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType"}
+{"Time":"2026-10-18T08:58:18.959722001Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType","Output":"=== RUN   TestJWKSHandler_ContentType\n"}
+{"Time":"2026-10-18T08:58:18.962503722Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients"}
+{"Time":"2026-10-18T08:58:18.962544083Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients","Output":"=== RUN   TestScenarioBRealmPreservesClients\n"}
+{"Time":"2026-10-18T08:58:18.963044201Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients","Output":"--- PASS: TestScenarioBRealmPreservesClients (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.963105491Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.963113057Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow"}
+{"Time":"2026-10-18T08:58:18.963117854Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow","Output":"=== RUN   TestScenarioBNoImplicitFlow\n"}
+{"Time":"2026-10-18T08:58:18.963358236Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow","Output":"--- PASS: TestScenarioBNoImplicitFlow (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.963379904Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.963464892Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers"}
+{"Time":"2026-10-18T08:58:18.963473602Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers","Output":"=== RUN   TestScenarioBNoIdentityBrokers\n"}
+{"Time":"2026-10-18T08:58:18.96371531Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers","Output":"--- PASS: TestScenarioBNoIdentityBrokers (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.963737898Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.963778313Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved"}
+{"Time":"2026-10-18T08:58:18.963785184Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved","Output":"=== RUN   TestScenarioBUsersPreserved\n"}
+{"Time":"2026-10-18T08:58:18.964173296Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved","Output":"--- PASS: TestScenarioBUsersPreserved (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.964210492Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.964285038Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved"}
+{"Time":"2026-10-18T08:58:18.964292603Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved","Output":"=== RUN   TestScenarioBGroupsPreserved\n"}
+{"Time":"2026-10-18T08:58:18.964554347Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved","Output":"--- PASS: TestScenarioBGroupsPreserved (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.964641616Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.964660723Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved"}
+{"Time":"2026-10-18T08:58:18.964669371Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved","Output":"=== RUN   TestScenarioBSigningAlgorithmPreserved\n"}
+{"Time":"2026-10-18T08:58:18.965098466Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved","Output":"--- PASS: TestScenarioBSigningAlgorithmPreserved (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.965131893Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.965151271Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport"}
+{"Time":"2026-10-18T08:58:18.965156311Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport","Output":"=== RUN   TestScenarioBValidationReport\n"}
+{"Time":"2026-10-18T08:58:18.965435098Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport","Output":"--- PASS: TestScenarioBValidationReport (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.96545636Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.965490545Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping"}
+{"Time":"2026-10-18T08:58:18.965499192Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping","Output":"=== RUN   TestScenarioBPublicClientMapping\n"}
+{"Time":"2026-10-18T08:58:18.965906195Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping","Output":"--- PASS: TestScenarioBPublicClientMapping (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.965926592Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.966020831Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip"}
+{"Time":"2026-10-18T08:58:18.966033131Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip","Output":"=== RUN   TestScenarioCLDIFRoundTrip\n"}
+{"Time":"2026-10-18T08:58:18.966484453Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip","Output":"--- PASS: TestScenarioCLDIFRoundTrip (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.966513398Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.966539738Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences"}
+{"Time":"2026-10-18T08:58:18.966546266Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences","Output":"=== RUN   TestScenarioCTargetDifferences\n"}
+{"Time":"2026-10-18T08:58:18.967207348Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences","Output":"--- PASS: TestScenarioCTargetDifferences (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.967262443Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.967323769Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated"}
+{"Time":"2026-10-18T08:58:18.967340478Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated","Output":"=== RUN   TestScenarioCMFANotMigrated\n"}
+{"Time":"2026-10-18T08:58:18.96775472Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated","Output":"--- PASS: TestScenarioCMFANotMigrated (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.967787867Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.967797425Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries"}
+{"Time":"2026-10-18T08:58:18.967802186Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries","Output":"=== RUN   TestScenarioCStructuralEntries\n"}
+{"Time":"2026-10-18T08:58:18.968253879Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries","Output":"--- PASS: TestScenarioCStructuralEntries (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.968280101Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.968301264Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation"}
+{"Time":"2026-10-18T08:58:18.96830864Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation","Output":"=== RUN   TestScenarioCUserPreservation\n"}
+{"Time":"2026-10-18T08:58:18.968643388Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation","Output":"--- PASS: TestScenarioCUserPreservation (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.968781252Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.968796392Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved"}
+{"Time":"2026-10-18T08:58:18.968821469Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved","Output":"=== RUN   TestScenarioCGroupMembersPreserved\n"}
+{"Time":"2026-10-18T08:58:18.969081599Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved","Output":"--- PASS: TestScenarioCGroupMembersPreserved (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.969103448Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.969240961Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality"}
+{"Time":"2026-10-18T08:58:18.96925592Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality","Output":"=== RUN   TestScenarioCOrthogonality\n"}
+{"Time":"2026-10-18T08:58:18.969512939Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality","Output":"--- PASS: TestScenarioCOrthogonality (0.00s)\n"}
+{"Time":"2026-10-18T08:58:18.969534436Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality","Elapsed":0}
+{"Time":"2026-10-18T08:58:18.969550523Z","Action":"output","Package":"keycape/tests/migration","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:19.028257682Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/keys (0.27s)\n"}
+{"Time":"2026-10-18T08:58:19.028312868Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Elapsed":0.27}
+{"Time":"2026-10-18T08:58:19.028333202Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca"}
+{"Time":"2026-10-18T08:58:19.028342129Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/ca\n"}
+{"Time":"2026-10-18T08:58:19.067592511Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType","Output":"--- PASS: TestJWKSHandler_ContentType (0.11s)\n"}
+{"Time":"2026-10-18T08:58:19.067653333Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:19.067964779Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid"}
+{"Time":"2026-10-18T08:58:19.067984293Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid","Output":"=== RUN   TestJWKSHandler_StructureValid\n"}
+{"Time":"2026-10-18T08:58:19.086329687Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/ca (0.06s)\n"}
+{"Time":"2026-10-18T08:58:19.086372745Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Elapsed":0.06}
+{"Time":"2026-10-18T08:58:19.086383268Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable"}
+{"Time":"2026-10-18T08:58:19.08638682Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable\n"}
+{"Time":"2026-10-18T08:58:19.136526755Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid","Output":"--- PASS: TestJWKSHandler_StructureValid (0.07s)\n"}
+{"Time":"2026-10-18T08:58:19.136577883Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:19.136603348Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields"}
+{"Time":"2026-10-18T08:58:19.136609542Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields","Output":"=== RUN   TestJWKSHandler_CorrectAlgorithmFields\n"}
+{"Time":"2026-10-18T08:58:19.174640319Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields","Output":"--- PASS: TestJWKSHandler_CorrectAlgorithmFields (0.04s)\n"}
+{"Time":"2026-10-18T08:58:19.174717128Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields","Elapsed":0.04}
+{"Time":"2026-10-18T08:58:19.174729788Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys"}
+{"Time":"2026-10-18T08:58:19.174737768Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys","Output":"=== RUN   TestJWKSHandler_MultipleKeys\n"}
+{"Time":"2026-10-18T08:58:19.305697925Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable (0.22s)\n"}
+{"Time":"2026-10-18T08:58:19.305752804Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:19.305764472Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable"}
+{"Time":"2026-10-18T08:58:19.305774066Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable\n"}
+{"Time":"2026-10-18T08:58:19.393453099Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys","Output":"--- PASS: TestJWKSHandler_MultipleKeys (0.22s)\n"}
+{"Time":"2026-10-18T08:58:19.39353393Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:19.393548583Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid"}
+{"Time":"2026-10-18T08:58:19.393556653Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid","Output":"=== RUN   TestLoadPublicKeyFromPEM_Valid\n"}
+{"Time":"2026-10-18T08:58:19.473281234Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid","Output":"--- PASS: TestLoadPublicKeyFromPEM_Valid (0.08s)\n"}
+{"Time":"2026-10-18T08:58:19.473327962Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:19.473337971Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM"}
+{"Time":"2026-10-18T08:58:19.473342245Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM","Output":"=== RUN   TestLoadPublicKeyFromPEM_InvalidPEM\n"}
+{"Time":"2026-10-18T08:58:19.473514592Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM","Output":"--- PASS: TestLoadPublicKeyFromPEM_InvalidPEM (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.473567451Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.473578758Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected"}
+{"Time":"2026-10-18T08:58:19.47358214Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected","Output":"=== RUN   TestLoadPublicKeyFromPEM_PrivateKeyRejected\n"}
+{"Time":"2026-10-18T08:58:19.504450673Z","Action":"output","Package":"keycape/tests/conformance","Output":"ok  \tkeycape/tests/conformance\t1.035s\n"}
+{"Time":"2026-10-18T08:58:19.504527256Z","Action":"pass","Package":"keycape/tests/conformance","Elapsed":1.035}
+{"Time":"2026-10-18T08:58:19.509812883Z","Action":"start","Package":"keycape/tests/negative"}
+{"Time":"2026-10-18T08:58:19.529279009Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration"}
+{"Time":"2026-10-18T08:58:19.529330777Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration","Output":"=== RUN   TestNegative_DynamicClientRegistration\n"}
+{"Time":"2026-10-18T08:58:19.534078692Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration","Output":"--- PASS: TestNegative_DynamicClientRegistration (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.534137169Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.534320922Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow"}
+{"Time":"2026-10-18T08:58:19.534338768Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow","Output":"=== RUN   TestNegative_ImplicitFlow\n"}
+{"Time":"2026-10-18T08:58:19.537630011Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow","Output":"--- PASS: TestNegative_ImplicitFlow (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.537682229Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.537699479Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI"}
+{"Time":"2026-10-18T08:58:19.537711139Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI","Output":"=== RUN   TestNegative_WildcardRedirectURI\n"}
+{"Time":"2026-10-18T08:58:19.541017744Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI","Output":"--- PASS: TestNegative_WildcardRedirectURI (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.541072109Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.541079665Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker"}
+{"Time":"2026-10-18T08:58:19.541086825Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker","Output":"=== RUN   TestNegative_IdentityBroker\n"}
+{"Time":"2026-10-18T08:58:19.543500291Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker","Output":"--- PASS: TestNegative_IdentityBroker (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.543545197Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.543641799Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE"}
+{"Time":"2026-10-18T08:58:19.543650843Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE","Output":"=== RUN   TestNegative_MissingPKCE\n"}
+{"Time":"2026-10-18T08:58:19.546593881Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE","Output":"--- PASS: TestNegative_MissingPKCE (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.546628615Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.546638119Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod"}
+{"Time":"2026-10-18T08:58:19.546642817Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod","Output":"=== RUN   TestNegative_PKCEPlainMethod\n"}
+{"Time":"2026-10-18T08:58:19.549299138Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod","Output":"--- PASS: TestNegative_PKCEPlainMethod (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.549371627Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.549392178Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType"}
+{"Time":"2026-10-18T08:58:19.549403476Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType","Output":"=== RUN   TestNegative_UnknownGrantType\n"}
+{"Time":"2026-10-18T08:58:19.549426479Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable (0.24s)\n"}
+{"Time":"2026-10-18T08:58:19.549444099Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Elapsed":0.24}
+{"Time":"2026-10-18T08:58:19.549603777Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo"}
+{"Time":"2026-10-18T08:58:19.549624994Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo\n"}
+{"Time":"2026-10-18T08:58:19.551971679Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType","Output":"--- PASS: TestNegative_UnknownGrantType (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.552018316Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.552037893Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough"}
+{"Time":"2026-10-18T08:58:19.552044033Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough","Output":"=== RUN   TestNegative_ValidRequest_PassesThrough\n"}
+{"Time":"2026-10-18T08:58:19.554907372Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough","Output":"--- PASS: TestNegative_ValidRequest_PassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.554961052Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.55497438Z","Action":"output","Package":"keycape/tests/negative","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:19.626387808Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo (0.08s)\n"}
+{"Time":"2026-10-18T08:58:19.626453634Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:19.626662347Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles (1.05s)\n"}
+{"Time":"2026-10-18T08:58:19.626740427Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Elapsed":1.05}
+{"Time":"2026-10-18T08:58:19.626761663Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus"}
+{"Time":"2026-10-18T08:58:19.627133074Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus\n"}
+{"Time":"2026-10-18T08:58:19.627171055Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry"}
+{"Time":"2026-10-18T08:58:19.627177728Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry\n"}
+{"Time":"2026-10-18T08:58:19.674441917Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected","Output":"--- PASS: TestLoadPublicKeyFromPEM_PrivateKeyRejected (0.20s)\n"}
+{"Time":"2026-10-18T08:58:19.674499547Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected","Elapsed":0.2}
+{"Time":"2026-10-18T08:58:19.67451016Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding"}
+{"Time":"2026-10-18T08:58:19.674516598Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding","Output":"=== RUN   TestJWKSHandler_NEncoding\n"}
+{"Time":"2026-10-18T08:58:19.749309782Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry (0.12s)\n"}
+{"Time":"2026-10-18T08:58:19.74936265Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:19.749373281Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards"}
+{"Time":"2026-10-18T08:58:19.749379512Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards\n"}
+{"Time":"2026-10-18T08:58:19.772360737Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding","Output":"--- PASS: TestJWKSHandler_NEncoding (0.10s)\n"}
+{"Time":"2026-10-18T08:58:19.772440792Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:19.772461054Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession"}
+{"Time":"2026-10-18T08:58:19.772471379Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Output":"=== RUN   TestNativeOptionalEnrollmentAndOldSession\n"}
+{"Time":"2026-10-18T08:58:19.772513733Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Output":"    native_optional_test.go:27: requires disposable installed-provider fixture\n"}
+{"Time":"2026-10-18T08:58:19.772532227Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Output":"--- SKIP: TestNativeOptionalEnrollmentAndOldSession (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.772545095Z","Action":"skip","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.772565005Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment"}
+{"Time":"2026-10-18T08:58:19.77258377Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment","Output":"=== RUN   TestOptionalMFAFollowsEnrollment\n"}
+{"Time":"2026-10-18T08:58:19.772597052Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement"}
+{"Time":"2026-10-18T08:58:19.772606854Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement\n"}
+{"Time":"2026-10-18T08:58:19.772866405Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.772907686Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.772943827Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled"}
+{"Time":"2026-10-18T08:58:19.772955514Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/enrolled\n"}
+{"Time":"2026-10-18T08:58:19.77327487Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/enrolled (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.77331845Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.773331633Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable"}
+{"Time":"2026-10-18T08:58:19.773337125Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/lookup_unavailable\n"}
+{"Time":"2026-10-18T08:58:19.773400264Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/lookup_unavailable (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.773437929Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.77349224Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up"}
+{"Time":"2026-10-18T08:58:19.773500472Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/explicit_step_up\n"}
+{"Time":"2026-10-18T08:58:19.773815066Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/explicit_step_up (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.773839818Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.77385091Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment","Output":"--- PASS: TestOptionalMFAFollowsEnrollment (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.77388853Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.773903498Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule"}
+{"Time":"2026-10-18T08:58:19.773909179Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule","Output":"=== RUN   TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule\n"}
+{"Time":"2026-10-18T08:58:19.77421022Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule","Output":"--- PASS: TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.77422949Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.774236604Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA"}
+{"Time":"2026-10-18T08:58:19.77424197Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA","Output":"=== RUN   TestPolicy_ProfileActionStepUpForcesMFA\n"}
+{"Time":"2026-10-18T08:58:19.774592768Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA","Output":"--- PASS: TestPolicy_ProfileActionStepUpForcesMFA (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.77464642Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.774666403Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA"}
+{"Time":"2026-10-18T08:58:19.774722634Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA","Output":"=== RUN   TestPolicy_OpenBaoKeepsMandatoryMFA\n"}
+{"Time":"2026-10-18T08:58:19.774898696Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA","Output":"--- PASS: TestPolicy_OpenBaoKeepsMandatoryMFA (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.774945Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.774960329Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance"}
+{"Time":"2026-10-18T08:58:19.774969842Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance","Output":"=== RUN   TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance\n"}
+{"Time":"2026-10-18T08:58:19.775405375Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance","Output":"--- PASS: TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.7754313Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.775438604Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass"}
+{"Time":"2026-10-18T08:58:19.775450642Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass","Output":"=== RUN   TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass\n"}
+{"Time":"2026-10-18T08:58:19.775799222Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass","Output":"--- PASS: TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.775821512Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.775829141Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced"}
+{"Time":"2026-10-18T08:58:19.775835408Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced","Output":"=== RUN   TestPolicy_ExactRedirectStillEnforced\n"}
+{"Time":"2026-10-18T08:58:19.776061407Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced","Output":"--- PASS: TestPolicy_ExactRedirectStillEnforced (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.776078405Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.776085231Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain"}
+{"Time":"2026-10-18T08:58:19.776090695Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain","Output":"=== RUN   TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain\n"}
+{"Time":"2026-10-18T08:58:19.776843554Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain","Output":"--- PASS: TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.776905079Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.776914366Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect"}
+{"Time":"2026-10-18T08:58:19.776919695Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect","Output":"=== RUN   TestLogout_RejectsUnregisteredPostLogoutRedirect\n"}
+{"Time":"2026-10-18T08:58:19.777271801Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect","Output":"--- PASS: TestLogout_RejectsUnregisteredPostLogoutRedirect (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.777305111Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.777316166Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp"}
+{"Time":"2026-10-18T08:58:19.777324733Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp","Output":"=== RUN   TestRuntimePolicyEnrollmentOldSessionAndStepUp\n"}
+{"Time":"2026-10-18T08:58:19.778999993Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp","Output":"--- PASS: TestRuntimePolicyEnrollmentOldSessionAndStepUp (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.7790448Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.779054259Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged"}
+{"Time":"2026-10-18T08:58:19.779058821Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged","Output":"=== RUN   TestSignInDiagnosis_FlagOff_RedirectUnchanged\n"}
+{"Time":"2026-10-18T08:58:19.779395408Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged","Output":"--- PASS: TestSignInDiagnosis_FlagOff_RedirectUnchanged (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.779412794Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.779424588Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue"}
+{"Time":"2026-10-18T08:58:19.77942943Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue","Output":"=== RUN   TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue\n"}
+{"Time":"2026-10-18T08:58:19.780286493Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue","Output":"--- PASS: TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.780332499Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.780350515Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP"}
+{"Time":"2026-10-18T08:58:19.780356701Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP","Output":"=== RUN   TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP\n"}
+{"Time":"2026-10-18T08:58:19.780884129Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP","Output":"--- PASS: TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.780916312Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.780949225Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest"}
+{"Time":"2026-10-18T08:58:19.780963364Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest","Output":"=== RUN   TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest\n"}
+{"Time":"2026-10-18T08:58:19.781482243Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest","Output":"--- PASS: TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.781521838Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.781536139Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets"}
+{"Time":"2026-10-18T08:58:19.781540585Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets","Output":"=== RUN   TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets\n"}
+{"Time":"2026-10-18T08:58:19.781947804Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets","Output":"--- PASS: TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets (0.00s)\n"}
+{"Time":"2026-10-18T08:58:19.781983196Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets","Elapsed":0}
+{"Time":"2026-10-18T08:58:19.781994883Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration"}
+{"Time":"2026-10-18T08:58:19.782000203Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration","Output":"=== RUN   TestRegistrationBoundTenantRequiresStaticRegistration\n"}
+{"Time":"2026-10-18T08:58:19.832344856Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards (0.08s)\n"}
+{"Time":"2026-10-18T08:58:19.832409888Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:19.83242162Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key"}
+{"Time":"2026-10-18T08:58:19.832435876Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key\n"}
+{"Time":"2026-10-18T08:58:19.879710129Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration","Output":"--- PASS: TestRegistrationBoundTenantRequiresStaticRegistration (0.10s)\n"}
+{"Time":"2026-10-18T08:58:19.879785738Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:19.879801176Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance"}
+{"Time":"2026-10-18T08:58:19.879812024Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance\n"}
+{"Time":"2026-10-18T08:58:19.879821086Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied"}
+{"Time":"2026-10-18T08:58:19.879827443Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/human,_registration-supplied\n"}
+{"Time":"2026-10-18T08:58:19.973094831Z","Action":"output","Package":"keycape/tests/migration","Output":"ok  \tkeycape/tests/migration\t1.038s\n"}
+{"Time":"2026-10-18T08:58:19.973166518Z","Action":"pass","Package":"keycape/tests/migration","Elapsed":1.038}
+{"Time":"2026-10-18T08:58:19.977089833Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/human,_registration-supplied (0.10s)\n"}
+{"Time":"2026-10-18T08:58:19.977137823Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:19.977246467Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted"}
+{"Time":"2026-10-18T08:58:19.977262887Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/human,_directory-asserted\n"}
+{"Time":"2026-10-18T08:58:20.062044344Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key (0.23s)\n"}
+{"Time":"2026-10-18T08:58:20.062221289Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Elapsed":0.23}
+{"Time":"2026-10-18T08:58:20.062348739Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus (0.44s)\n"}
+{"Time":"2026-10-18T08:58:20.06253389Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Elapsed":0.44}
+{"Time":"2026-10-18T08:58:20.062555928Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs"}
+{"Time":"2026-10-18T08:58:20.062566992Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"=== RUN   TestOnlineCancellationAndAmbientProxyDoNotLeakInputs\n"}
+{"Time":"2026-10-18T08:58:20.301642291Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"--- PASS: TestOnlineCancellationAndAmbientProxyDoNotLeakInputs (0.24s)\n"}
+{"Time":"2026-10-18T08:58:20.301692066Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Elapsed":0.24}
+{"Time":"2026-10-18T08:58:20.301705015Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus"}
+{"Time":"2026-10-18T08:58:20.301709704Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"=== RUN   TestOnlineMalformedAdmissionAndNegativeStatus\n"}
+{"Time":"2026-10-18T08:58:20.31949639Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/human,_directory-asserted (0.34s)\n"}
+{"Time":"2026-10-18T08:58:20.319553496Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted","Elapsed":0.34}
+{"Time":"2026-10-18T08:58:20.319566553Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted"}
+{"Time":"2026-10-18T08:58:20.319572423Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted\n"}
+{"Time":"2026-10-18T08:58:20.461096642Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted (0.14s)\n"}
+{"Time":"2026-10-18T08:58:20.46115052Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted","Elapsed":0.14}
+{"Time":"2026-10-18T08:58:20.461177004Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied"}
+{"Time":"2026-10-18T08:58:20.461182514Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied\n"}
+{"Time":"2026-10-18T08:58:20.559525372Z","Action":"output","Package":"keycape/tests/negative","Output":"ok  \tkeycape/tests/negative\t1.050s\n"}
+{"Time":"2026-10-18T08:58:20.559605842Z","Action":"pass","Package":"keycape/tests/negative","Elapsed":1.05}
+{"Time":"2026-10-18T08:58:20.671702131Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"--- PASS: TestOnlineMalformedAdmissionAndNegativeStatus (0.37s)\n"}
+{"Time":"2026-10-18T08:58:20.671751933Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Elapsed":0.37}
+{"Time":"2026-10-18T08:58:20.671834071Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier"}
+{"Time":"2026-10-18T08:58:20.671845622Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"=== RUN   TestOnlineUsesSharedTypedJOSEVerifier\n"}
+{"Time":"2026-10-18T08:58:20.685249391Z","Action":"start","Package":"keycape/tests/profile"}
+{"Time":"2026-10-18T08:58:20.70905602Z","Action":"run","Package":"keycape/tests/profile","Test":"TestDiscovery"}
+{"Time":"2026-10-18T08:58:20.709113136Z","Action":"output","Package":"keycape/tests/profile","Test":"TestDiscovery","Output":"=== RUN   TestDiscovery\n"}
+{"Time":"2026-10-18T08:58:20.746171016Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied (0.28s)\n"}
+{"Time":"2026-10-18T08:58:20.746224642Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied","Elapsed":0.28}
+{"Time":"2026-10-18T08:58:20.746238826Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance (0.87s)\n"}
+{"Time":"2026-10-18T08:58:20.746380622Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance","Elapsed":0.87}
+{"Time":"2026-10-18T08:58:20.746395735Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters"}
+{"Time":"2026-10-18T08:58:20.746401488Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters","Output":"=== RUN   TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters\n"}
+{"Time":"2026-10-18T08:58:20.819282382Z","Action":"output","Package":"keycape/tests/profile","Test":"TestDiscovery","Output":"--- PASS: TestDiscovery (0.11s)\n"}
+{"Time":"2026-10-18T08:58:20.819345836Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestDiscovery","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:20.81953496Z","Action":"run","Package":"keycape/tests/profile","Test":"TestJWKS"}
+{"Time":"2026-10-18T08:58:20.819553473Z","Action":"output","Package":"keycape/tests/profile","Test":"TestJWKS","Output":"=== RUN   TestJWKS\n"}
+{"Time":"2026-10-18T08:58:21.122903127Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"--- PASS: TestOnlineUsesSharedTypedJOSEVerifier (0.45s)\n"}
+{"Time":"2026-10-18T08:58:21.122946879Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Elapsed":0.45}
+{"Time":"2026-10-18T08:58:21.122955734Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration"}
+{"Time":"2026-10-18T08:58:21.12295916Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration","Output":"=== RUN   TestVerifyClientPassesOnCorrectRegistration\n"}
+{"Time":"2026-10-18T08:58:21.196385566Z","Action":"output","Package":"keycape/tests/profile","Test":"TestJWKS","Output":"--- PASS: TestJWKS (0.38s)\n"}
+{"Time":"2026-10-18T08:58:21.196481184Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestJWKS","Elapsed":0.38}
+{"Time":"2026-10-18T08:58:21.196495856Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect"}
+{"Time":"2026-10-18T08:58:21.196501446Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect","Output":"=== RUN   TestAuthorize_Redirect\n"}
+{"Time":"2026-10-18T08:58:21.211802792Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration","Output":"--- PASS: TestVerifyClientPassesOnCorrectRegistration (0.09s)\n"}
+{"Time":"2026-10-18T08:58:21.21185134Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:21.211884984Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens"}
+{"Time":"2026-10-18T08:58:21.211892189Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens","Output":"=== RUN   TestVerifyClientNeverPrintsSecretsOrTokens\n"}
+{"Time":"2026-10-18T08:58:21.364988026Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters","Output":"--- PASS: TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters (0.62s)\n"}
+{"Time":"2026-10-18T08:58:21.365062733Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters","Elapsed":0.62}
+{"Time":"2026-10-18T08:58:21.365109371Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration"}
+{"Time":"2026-10-18T08:58:21.365129398Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration","Output":"=== RUN   TestServiceTenantsAreDistinctPerRegistration\n"}
+{"Time":"2026-10-18T08:58:21.624200289Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect","Output":"--- PASS: TestAuthorize_Redirect (0.43s)\n"}
+{"Time":"2026-10-18T08:58:21.624247088Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect","Elapsed":0.43}
+{"Time":"2026-10-18T08:58:21.624393799Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient"}
+{"Time":"2026-10-18T08:58:21.624408398Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient","Output":"=== RUN   TestAuthorize_InvalidClient\n"}
+{"Time":"2026-10-18T08:58:21.721836248Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens","Output":"--- PASS: TestVerifyClientNeverPrintsSecretsOrTokens (0.51s)\n"}
+{"Time":"2026-10-18T08:58:21.721886636Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens","Elapsed":0.51}
+{"Time":"2026-10-18T08:58:21.72189459Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted"}
+{"Time":"2026-10-18T08:58:21.721918422Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted","Output":"=== RUN   TestVerifyClientFailsWhenExcessScopeIsGranted\n"}
+{"Time":"2026-10-18T08:58:21.740138863Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient","Output":"--- PASS: TestAuthorize_InvalidClient (0.12s)\n"}
+{"Time":"2026-10-18T08:58:21.740196104Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:21.74020624Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI"}
+{"Time":"2026-10-18T08:58:21.74021193Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI","Output":"=== RUN   TestAuthorize_WildcardRedirectURI\n"}
+{"Time":"2026-10-18T08:58:21.789234545Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration","Output":"--- PASS: TestServiceTenantsAreDistinctPerRegistration (0.42s)\n"}
+{"Time":"2026-10-18T08:58:21.789291832Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration","Elapsed":0.42}
+{"Time":"2026-10-18T08:58:21.789306413Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault"}
+{"Time":"2026-10-18T08:58:21.789312004Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault","Output":"=== RUN   TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault\n"}
+{"Time":"2026-10-18T08:58:21.789485595Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory"}
+{"Time":"2026-10-18T08:58:21.789500735Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory","Output":"=== RUN   TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory\n"}
+{"Time":"2026-10-18T08:58:21.970321985Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted","Output":"--- PASS: TestVerifyClientFailsWhenExcessScopeIsGranted (0.25s)\n"}
+{"Time":"2026-10-18T08:58:21.970373095Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted","Elapsed":0.25}
+{"Time":"2026-10-18T08:58:21.970385728Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor"}
+{"Time":"2026-10-18T08:58:21.970391301Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor","Output":"=== RUN   TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor\n"}
+{"Time":"2026-10-18T08:58:22.048544547Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI","Output":"--- PASS: TestAuthorize_WildcardRedirectURI (0.31s)\n"}
+{"Time":"2026-10-18T08:58:22.048601086Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI","Elapsed":0.31}
+{"Time":"2026-10-18T08:58:22.048616081Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE"}
+{"Time":"2026-10-18T08:58:22.048622844Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE","Output":"=== RUN   TestAuthorize_MissingPKCE\n"}
+{"Time":"2026-10-18T08:58:22.221869046Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor","Output":"--- PASS: TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor (0.25s)\n"}
+{"Time":"2026-10-18T08:58:22.221913456Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor","Elapsed":0.25}
+{"Time":"2026-10-18T08:58:22.221939525Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments"}
+{"Time":"2026-10-18T08:58:22.221944656Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments","Output":"=== RUN   TestVerifyClientRequiresCompleteArguments\n"}
+{"Time":"2026-10-18T08:58:22.222213243Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments","Output":"--- PASS: TestVerifyClientRequiresCompleteArguments (0.00s)\n"}
+{"Time":"2026-10-18T08:58:22.222232162Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments","Elapsed":0}
+{"Time":"2026-10-18T08:58:22.222322226Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants"}
+{"Time":"2026-10-18T08:58:22.222331983Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants","Output":"=== RUN   TestNoExcessScopeCatchesUnrequestedGrants\n"}
+{"Time":"2026-10-18T08:58:22.222553645Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants","Output":"--- PASS: TestNoExcessScopeCatchesUnrequestedGrants (0.00s)\n"}
+{"Time":"2026-10-18T08:58:22.222569199Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants","Elapsed":0}
+{"Time":"2026-10-18T08:58:22.222660084Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing"}
+{"Time":"2026-10-18T08:58:22.222670355Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing","Output":"=== RUN   TestHasAllRolesNamesWhatIsMissing\n"}
+{"Time":"2026-10-18T08:58:22.222990621Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing","Output":"--- PASS: TestHasAllRolesNamesWhatIsMissing (0.00s)\n"}
+{"Time":"2026-10-18T08:58:22.223029286Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing","Elapsed":0}
+{"Time":"2026-10-18T08:58:22.223040432Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals"}
+{"Time":"2026-10-18T08:58:22.22304595Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals\n"}
+{"Time":"2026-10-18T08:58:22.22323846Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport"}
+{"Time":"2026-10-18T08:58:22.223261472Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport\n"}
+{"Time":"2026-10-18T08:58:22.224691211Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory","Output":"--- PASS: TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory (0.44s)\n"}
+{"Time":"2026-10-18T08:58:22.224743826Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory","Elapsed":0.44}
+{"Time":"2026-10-18T08:58:22.224756297Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default"}
+{"Time":"2026-10-18T08:58:22.224763024Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default","Output":"=== RUN   TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default\n"}
+{"Time":"2026-10-18T08:58:22.293119412Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE","Output":"--- PASS: TestAuthorize_MissingPKCE (0.24s)\n"}
+{"Time":"2026-10-18T08:58:22.293214643Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE","Elapsed":0.24}
+{"Time":"2026-10-18T08:58:22.293238395Z","Action":"run","Package":"keycape/tests/profile","Test":"TestHealthz"}
+{"Time":"2026-10-18T08:58:22.29324596Z","Action":"output","Package":"keycape/tests/profile","Test":"TestHealthz","Output":"=== RUN   TestHealthz\n"}
+{"Time":"2026-10-18T08:58:22.361009726Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport (0.14s)\n"}
+{"Time":"2026-10-18T08:58:22.361126996Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport","Elapsed":0.14}
+{"Time":"2026-10-18T08:58:22.36115118Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server"}
+{"Time":"2026-10-18T08:58:22.361168331Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server\n"}
+{"Time":"2026-10-18T08:58:22.386975793Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default","Output":"--- PASS: TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default (0.16s)\n"}
+{"Time":"2026-10-18T08:58:22.387046588Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:22.387239491Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault","Output":"--- PASS: TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault (0.60s)\n"}
+{"Time":"2026-10-18T08:58:22.38733199Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault","Elapsed":0.6}
+{"Time":"2026-10-18T08:58:22.387369493Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases"}
+{"Time":"2026-10-18T08:58:22.387380711Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases","Output":"=== RUN   TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases\n"}
+{"Time":"2026-10-18T08:58:22.580897144Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server (0.22s)\n"}
+{"Time":"2026-10-18T08:58:22.580997956Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:22.581009679Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token"}
+{"Time":"2026-10-18T08:58:22.581016703Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token\n"}
+{"Time":"2026-10-18T08:58:22.597429334Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases","Output":"--- PASS: TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases (0.21s)\n"}
+{"Time":"2026-10-18T08:58:22.597566207Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases","Elapsed":0.21}
+{"Time":"2026-10-18T08:58:22.597593178Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant"}
+{"Time":"2026-10-18T08:58:22.597627569Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant","Output":"=== RUN   TestUnrelatedServiceClientKeepsCoulombTenant\n"}
+{"Time":"2026-10-18T08:58:22.668372714Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token (0.09s)\n"}
+{"Time":"2026-10-18T08:58:22.668428892Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:22.668579354Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal"}
+{"Time":"2026-10-18T08:58:22.668591175Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal\n"}
+{"Time":"2026-10-18T08:58:22.755903816Z","Action":"output","Package":"keycape/tests/profile","Test":"TestHealthz","Output":"--- PASS: TestHealthz (0.46s)\n"}
+{"Time":"2026-10-18T08:58:22.756205756Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestHealthz","Elapsed":0.46}
+{"Time":"2026-10-18T08:58:22.756246145Z","Action":"run","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow"}
+{"Time":"2026-10-18T08:58:22.756253313Z","Action":"output","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow","Output":"=== RUN   TestCompleteTokenFlow\n"}
+{"Time":"2026-10-18T08:58:22.767888595Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal (0.10s)\n"}
+{"Time":"2026-10-18T08:58:22.767939308Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:22.767947703Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal"}
+{"Time":"2026-10-18T08:58:22.767951643Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal\n"}
+{"Time":"2026-10-18T08:58:22.804301297Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant","Output":"--- PASS: TestUnrelatedServiceClientKeepsCoulombTenant (0.21s)\n"}
+{"Time":"2026-10-18T08:58:22.804352876Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant","Elapsed":0.21}
+{"Time":"2026-10-18T08:58:22.804439522Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile"}
+{"Time":"2026-10-18T08:58:22.80450662Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile","Output":"=== RUN   TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile\n"}
+{"Time":"2026-10-18T08:58:22.805833454Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile","Output":"--- PASS: TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile (0.00s)\n"}
+{"Time":"2026-10-18T08:58:22.805861092Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile","Elapsed":0}
+{"Time":"2026-10-18T08:58:22.805866773Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant"}
+{"Time":"2026-10-18T08:58:22.805886728Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant","Output":"=== RUN   TestTokenStatusActualIssueRevokeAndFreshGrant\n"}
+{"Time":"2026-10-18T08:58:22.885762288Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant","Output":"--- PASS: TestTokenStatusActualIssueRevokeAndFreshGrant (0.08s)\n"}
+{"Time":"2026-10-18T08:58:22.885820855Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:22.88583613Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority"}
+{"Time":"2026-10-18T08:58:22.885841829Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority","Output":"=== RUN   TestTokenStatusNoCrossClientOrIDTokenAuthority\n"}
+{"Time":"2026-10-18T08:58:22.918128606Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal (0.15s)\n"}
+{"Time":"2026-10-18T08:58:22.918183304Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:22.918335754Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport"}
+{"Time":"2026-10-18T08:58:22.918357918Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport\n"}
+{"Time":"2026-10-18T08:58:22.92769906Z","Action":"output","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow","Output":"--- PASS: TestCompleteTokenFlow (0.17s)\n"}
+{"Time":"2026-10-18T08:58:22.927749439Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow","Elapsed":0.17}
+{"Time":"2026-10-18T08:58:22.92787826Z","Action":"output","Package":"keycape/tests/profile","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:23.010394851Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority","Output":"--- PASS: TestTokenStatusNoCrossClientOrIDTokenAuthority (0.12s)\n"}
+{"Time":"2026-10-18T08:58:23.01045569Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:23.010581508Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken"}
+{"Time":"2026-10-18T08:58:23.010588343Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken","Output":"=== RUN   TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken\n"}
+{"Time":"2026-10-18T08:58:23.198705333Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport (0.28s)\n"}
+{"Time":"2026-10-18T08:58:23.198751736Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport","Elapsed":0.28}
+{"Time":"2026-10-18T08:58:23.19875959Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server"}
+{"Time":"2026-10-18T08:58:23.198763666Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server\n"}
+{"Time":"2026-10-18T08:58:23.217329219Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken","Output":"--- PASS: TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken (0.21s)\n"}
+{"Time":"2026-10-18T08:58:23.217381023Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken","Elapsed":0.21}
+{"Time":"2026-10-18T08:58:23.217395803Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse"}
+{"Time":"2026-10-18T08:58:23.21740271Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse","Output":"=== RUN   TestTokenStatusRestartAndUnavailableStoreRefuse\n"}
+{"Time":"2026-10-18T08:58:23.473204772Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse","Output":"--- PASS: TestTokenStatusRestartAndUnavailableStoreRefuse (0.26s)\n"}
+{"Time":"2026-10-18T08:58:23.473267658Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse","Elapsed":0.26}
+{"Time":"2026-10-18T08:58:23.473279876Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition"}
+{"Time":"2026-10-18T08:58:23.473287045Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition\n"}
+{"Time":"2026-10-18T08:58:23.473300932Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed"}
+{"Time":"2026-10-18T08:58:23.473308055Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed\n"}
+{"Time":"2026-10-18T08:58:23.541115972Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed (0.07s)\n"}
+{"Time":"2026-10-18T08:58:23.541191347Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:23.541207307Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience"}
+{"Time":"2026-10-18T08:58:23.541215414Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience\n"}
+{"Time":"2026-10-18T08:58:23.602530317Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server (0.40s)\n"}
+{"Time":"2026-10-18T08:58:23.602587748Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server","Elapsed":0.4}
+{"Time":"2026-10-18T08:58:23.602609046Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token"}
+{"Time":"2026-10-18T08:58:23.602615872Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token\n"}
+{"Time":"2026-10-18T08:58:23.615877081Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience (0.07s)\n"}
+{"Time":"2026-10-18T08:58:23.615980437Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:23.616005459Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret"}
+{"Time":"2026-10-18T08:58:23.616016415Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret\n"}
+{"Time":"2026-10-18T08:58:23.675628627Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token (0.07s)\n"}
+{"Time":"2026-10-18T08:58:23.675685986Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:23.67570576Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal"}
+{"Time":"2026-10-18T08:58:23.675720702Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal\n"}
+{"Time":"2026-10-18T08:58:23.751094446Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal (0.08s)\n"}
+{"Time":"2026-10-18T08:58:23.751141173Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:23.751150912Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal"}
+{"Time":"2026-10-18T08:58:23.751155808Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal\n"}
+{"Time":"2026-10-18T08:58:23.774507159Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret (0.16s)\n"}
+{"Time":"2026-10-18T08:58:23.774569946Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:23.774587809Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes"}
+{"Time":"2026-10-18T08:58:23.774594473Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes\n"}
+{"Time":"2026-10-18T08:58:23.841653429Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes (0.07s)\n"}
+{"Time":"2026-10-18T08:58:23.841730788Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:23.841753493Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime"}
+{"Time":"2026-10-18T08:58:23.841795378Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime\n"}
+{"Time":"2026-10-18T08:58:23.90910658Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime (0.07s)\n"}
+{"Time":"2026-10-18T08:58:23.909186103Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:23.909213082Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended"}
+{"Time":"2026-10-18T08:58:23.909226013Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended\n"}
+{"Time":"2026-10-18T08:58:23.937072017Z","Action":"output","Package":"keycape/tests/profile","Output":"ok  \tkeycape/tests/profile\t3.252s\n"}
+{"Time":"2026-10-18T08:58:23.937132784Z","Action":"pass","Package":"keycape/tests/profile","Elapsed":3.252}
+{"Time":"2026-10-18T08:58:23.94888336Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal (0.20s)\n"}
+{"Time":"2026-10-18T08:58:23.948939042Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal","Elapsed":0.2}
+{"Time":"2026-10-18T08:58:23.948965724Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals (1.73s)\n"}
+{"Time":"2026-10-18T08:58:23.948982559Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals","Elapsed":1.73}
+{"Time":"2026-10-18T08:58:23.94903137Z","Action":"output","Package":"keycape/internal/authclient","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:24.138180113Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended (0.23s)\n"}
+{"Time":"2026-10-18T08:58:24.138236579Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended","Elapsed":0.23}
+{"Time":"2026-10-18T08:58:24.138248076Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled"}
+{"Time":"2026-10-18T08:58:24.13825557Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled\n"}
+{"Time":"2026-10-18T08:58:24.239859918Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled (0.10s)\n"}
+{"Time":"2026-10-18T08:58:24.239916168Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:24.239927971Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed"}
+{"Time":"2026-10-18T08:58:24.239953977Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed\n"}
+{"Time":"2026-10-18T08:58:24.298371825Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed (0.06s)\n"}
+{"Time":"2026-10-18T08:58:24.298459969Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed","Elapsed":0.06}
+{"Time":"2026-10-18T08:58:24.298481881Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition (0.83s)\n"}
+{"Time":"2026-10-18T08:58:24.298498418Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition","Elapsed":0.83}
+{"Time":"2026-10-18T08:58:24.298720879Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect"}
+{"Time":"2026-10-18T08:58:24.298755794Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect","Output":"=== RUN   TestTokenStatusPublicClientMayRevokeButNotIntrospect\n"}
+{"Time":"2026-10-18T08:58:24.374226743Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect","Output":"--- PASS: TestTokenStatusPublicClientMayRevokeButNotIntrospect (0.08s)\n"}
+{"Time":"2026-10-18T08:58:24.374304138Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:24.374338223Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct"}
+{"Time":"2026-10-18T08:58:24.37434999Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct","Output":"=== RUN   TestTokenStatusServiceGrantIsCurrentAndDistinct\n"}
+{"Time":"2026-10-18T08:58:24.643011668Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct","Output":"--- PASS: TestTokenStatusServiceGrantIsCurrentAndDistinct (0.27s)\n"}
+{"Time":"2026-10-18T08:58:24.643067124Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct","Elapsed":0.27}
+{"Time":"2026-10-18T08:58:24.643078585Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests"}
+{"Time":"2026-10-18T08:58:24.643085628Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests\n"}
+{"Time":"2026-10-18T08:58:24.643094861Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get"}
+{"Time":"2026-10-18T08:58:24.643101408Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get\n"}
+{"Time":"2026-10-18T08:58:24.958330515Z","Action":"output","Package":"keycape/internal/authclient","Output":"ok  \tkeycape/internal/authclient\t15.326s\n"}
+{"Time":"2026-10-18T08:58:24.95838974Z","Action":"pass","Package":"keycape/internal/authclient","Elapsed":15.326}
+{"Time":"2026-10-18T08:58:24.982626073Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get (0.34s)\n"}
+{"Time":"2026-10-18T08:58:24.982713477Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get","Elapsed":0.34}
+{"Time":"2026-10-18T08:58:24.98272786Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query"}
+{"Time":"2026-10-18T08:58:24.982941479Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query\n"}
+{"Time":"2026-10-18T08:58:25.079370601Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query (0.10s)\n"}
+{"Time":"2026-10-18T08:58:25.079448645Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:25.079466518Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json"}
+{"Time":"2026-10-18T08:58:25.079476662Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json\n"}
+{"Time":"2026-10-18T08:58:25.148086503Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json (0.07s)\n"}
+{"Time":"2026-10-18T08:58:25.148138307Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:25.148148849Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token"}
+{"Time":"2026-10-18T08:58:25.148154989Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token\n"}
+{"Time":"2026-10-18T08:58:25.226956944Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token (0.08s)\n"}
+{"Time":"2026-10-18T08:58:25.227018216Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:25.227199887Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize"}
+{"Time":"2026-10-18T08:58:25.22721334Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize\n"}
+{"Time":"2026-10-18T08:58:25.37428164Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize (0.15s)\n"}
+{"Time":"2026-10-18T08:58:25.374340342Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:25.374351063Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret"}
+{"Time":"2026-10-18T08:58:25.3745224Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret\n"}
+{"Time":"2026-10-18T08:58:25.557093516Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret (0.18s)\n"}
+{"Time":"2026-10-18T08:58:25.557147737Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret","Elapsed":0.18}
+{"Time":"2026-10-18T08:58:25.557168134Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth"}
+{"Time":"2026-10-18T08:58:25.557175303Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth\n"}
+{"Time":"2026-10-18T08:58:25.668008639Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth (0.11s)\n"}
+{"Time":"2026-10-18T08:58:25.668160327Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:25.668184619Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth"}
+{"Time":"2026-10-18T08:58:25.668193799Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth\n"}
+{"Time":"2026-10-18T08:58:25.813227284Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth (0.14s)\n"}
+{"Time":"2026-10-18T08:58:25.813283326Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth","Elapsed":0.14}
+{"Time":"2026-10-18T08:58:25.813295382Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret"}
+{"Time":"2026-10-18T08:58:25.813302749Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret\n"}
+{"Time":"2026-10-18T08:58:25.960563711Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret (0.15s)\n"}
+{"Time":"2026-10-18T08:58:25.960621602Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:25.960631629Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client"}
+{"Time":"2026-10-18T08:58:25.960637824Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client\n"}
+{"Time":"2026-10-18T08:58:26.211694588Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client (0.25s)\n"}
+{"Time":"2026-10-18T08:58:26.21184156Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client","Elapsed":0.25}
+{"Time":"2026-10-18T08:58:26.211863878Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests (1.57s)\n"}
+{"Time":"2026-10-18T08:58:26.211873499Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests","Elapsed":1.57}
+{"Time":"2026-10-18T08:58:26.21188212Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses"}
+{"Time":"2026-10-18T08:58:26.211888946Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses","Output":"=== RUN   TestTokenStatusRevocationDuringDirectoryLookupRefuses\n"}
+{"Time":"2026-10-18T08:58:26.276350391Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses","Output":"--- PASS: TestTokenStatusRevocationDuringDirectoryLookupRefuses (0.06s)\n"}
+{"Time":"2026-10-18T08:58:26.27640582Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses","Elapsed":0.06}
+{"Time":"2026-10-18T08:58:26.276665853Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding"}
+{"Time":"2026-10-18T08:58:26.276688568Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding","Output":"=== RUN   TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding\n"}
+{"Time":"2026-10-18T08:58:26.438142929Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding","Output":"--- PASS: TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding (0.16s)\n"}
+{"Time":"2026-10-18T08:58:26.438187537Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:26.438198583Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses"}
+{"Time":"2026-10-18T08:58:26.438203488Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses","Output":"=== RUN   TestTokenStatusRevocationDuringUserInfoLookupRefuses\n"}
+{"Time":"2026-10-18T08:58:26.500372847Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses","Output":"--- PASS: TestTokenStatusRevocationDuringUserInfoLookupRefuses (0.06s)\n"}
+{"Time":"2026-10-18T08:58:26.500421531Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses","Elapsed":0.06}
+{"Time":"2026-10-18T08:58:26.500434363Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim"}
+{"Time":"2026-10-18T08:58:26.500440594Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim","Output":"=== RUN   TestTokenStatusLegacyGrantHasNoStatusClaim\n"}
+{"Time":"2026-10-18T08:58:26.618091841Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim","Output":"--- PASS: TestTokenStatusLegacyGrantHasNoStatusClaim (0.12s)\n"}
+{"Time":"2026-10-18T08:58:26.61814782Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:26.618159236Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT"}
+{"Time":"2026-10-18T08:58:26.618188993Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT","Output":"=== RUN   TestTokenHandler_ValidExchange_ReturnsJWT\n"}
+{"Time":"2026-10-18T08:58:26.878318246Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT","Output":"--- PASS: TestTokenHandler_ValidExchange_ReturnsJWT (0.26s)\n"}
+{"Time":"2026-10-18T08:58:26.878544876Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT","Elapsed":0.26}
+{"Time":"2026-10-18T08:58:26.878563254Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode"}
+{"Time":"2026-10-18T08:58:26.878571649Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode","Output":"=== RUN   TestTokenHandler_SuspendedUserCannotExchangeCode\n"}
+{"Time":"2026-10-18T08:58:27.022738501Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode","Output":"--- PASS: TestTokenHandler_SuspendedUserCannotExchangeCode (0.14s)\n"}
+{"Time":"2026-10-18T08:58:27.022806915Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode","Elapsed":0.14}
+{"Time":"2026-10-18T08:58:27.022853804Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported"}
+{"Time":"2026-10-18T08:58:27.022862226Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported","Output":"=== RUN   TestTokenHandler_WrongGrantType_FeatureNotSupported\n"}
+{"Time":"2026-10-18T08:58:27.23640082Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported","Output":"--- PASS: TestTokenHandler_WrongGrantType_FeatureNotSupported (0.21s)\n"}
+{"Time":"2026-10-18T08:58:27.2364567Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported","Elapsed":0.21}
+{"Time":"2026-10-18T08:58:27.236468765Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken"}
+{"Time":"2026-10-18T08:58:27.236479495Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken","Output":"=== RUN   TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken\n"}
+{"Time":"2026-10-18T08:58:27.455136995Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken","Output":"--- PASS: TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken (0.22s)\n"}
+{"Time":"2026-10-18T08:58:27.455216283Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:27.455281983Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime"}
+{"Time":"2026-10-18T08:58:27.455297195Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime","Output":"=== RUN   TestTokenHandler_ClientCredentials_UsesPerClientLifetime\n"}
+{"Time":"2026-10-18T08:58:27.489519707Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime","Output":"--- PASS: TestTokenHandler_ClientCredentials_UsesPerClientLifetime (0.03s)\n"}
+{"Time":"2026-10-18T08:58:27.489577526Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime","Elapsed":0.03}
+{"Time":"2026-10-18T08:58:27.489589771Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret"}
+{"Time":"2026-10-18T08:58:27.48961492Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret","Output":"=== RUN   TestTokenHandler_ClientCredentials_RejectsWrongSecret\n"}
+{"Time":"2026-10-18T08:58:27.673765773Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret","Output":"--- PASS: TestTokenHandler_ClientCredentials_RejectsWrongSecret (0.18s)\n"}
+{"Time":"2026-10-18T08:58:27.673826279Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret","Elapsed":0.18}
+{"Time":"2026-10-18T08:58:27.673839281Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope"}
+{"Time":"2026-10-18T08:58:27.67384691Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope","Output":"=== RUN   TestTokenHandler_ClientCredentials_RejectsExcessScope\n"}
+{"Time":"2026-10-18T08:58:27.788992672Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope","Output":"--- PASS: TestTokenHandler_ClientCredentials_RejectsExcessScope (0.11s)\n"}
+{"Time":"2026-10-18T08:58:27.789048498Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:27.789061068Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:27.789068173Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage","Output":"=== RUN   TestTokenHandler_PKCEMismatch_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:27.872683508Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage","Output":"--- PASS: TestTokenHandler_PKCEMismatch_InvalidProfileUsage (0.08s)\n"}
+{"Time":"2026-10-18T08:58:27.872900517Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:27.872927488Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage"}
+{"Time":"2026-10-18T08:58:27.87293444Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage","Output":"=== RUN   TestTokenHandler_CodeNotFound_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T08:58:27.918914005Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage","Output":"--- PASS: TestTokenHandler_CodeNotFound_InvalidProfileUsage (0.05s)\n"}
+{"Time":"2026-10-18T08:58:27.918973086Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage","Elapsed":0.05}
+{"Time":"2026-10-18T08:58:27.918986089Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer"}
+{"Time":"2026-10-18T08:58:27.918993979Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer","Output":"=== RUN   TestTokenHandler_JWTClaims_CorrectSubAndIssuer\n"}
+{"Time":"2026-10-18T08:58:28.031566559Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer","Output":"--- PASS: TestTokenHandler_JWTClaims_CorrectSubAndIssuer (0.11s)\n"}
+{"Time":"2026-10-18T08:58:28.031622529Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:28.031633863Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope"}
+{"Time":"2026-10-18T08:58:28.031658562Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope","Output":"=== RUN   TestTokenHandler_ScopeFiltering_ProfileScope\n"}
+{"Time":"2026-10-18T08:58:28.247850644Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope","Output":"--- PASS: TestTokenHandler_ScopeFiltering_ProfileScope (0.22s)\n"}
+{"Time":"2026-10-18T08:58:28.247904973Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope","Elapsed":0.22}
+{"Time":"2026-10-18T08:58:28.247919364Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes"}
+{"Time":"2026-10-18T08:58:28.247926136Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes","Output":"=== RUN   TestTokenHandler_ScopeFiltering_AllScopes\n"}
+{"Time":"2026-10-18T08:58:28.328104694Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes","Output":"--- PASS: TestTokenHandler_ScopeFiltering_AllScopes (0.08s)\n"}
+{"Time":"2026-10-18T08:58:28.32815997Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes","Elapsed":0.08}
+{"Time":"2026-10-18T08:58:28.328172233Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry"}
+{"Time":"2026-10-18T08:58:28.328331938Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry","Output":"=== RUN   TestTokenHandler_TokenIssuedTelemetry\n"}
+{"Time":"2026-10-18T08:58:28.501690766Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry","Output":"--- PASS: TestTokenHandler_TokenIssuedTelemetry (0.17s)\n"}
+{"Time":"2026-10-18T08:58:28.501758116Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry","Elapsed":0.17}
+{"Time":"2026-10-18T08:58:28.501770316Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse"}
+{"Time":"2026-10-18T08:58:28.501777142Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse","Output":"=== RUN   TestTokenHandler_CodeDeletedAfterUse\n"}
+{"Time":"2026-10-18T08:58:28.677209802Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse","Output":"--- PASS: TestTokenHandler_CodeDeletedAfterUse (0.18s)\n"}
+{"Time":"2026-10-18T08:58:28.677286791Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse","Elapsed":0.18}
+{"Time":"2026-10-18T08:58:28.677300362Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable"}
+{"Time":"2026-10-18T08:58:28.677307765Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable","Output":"=== RUN   TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable\n"}
+{"Time":"2026-10-18T08:58:28.832462481Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable","Output":"--- PASS: TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable (0.15s)\n"}
+{"Time":"2026-10-18T08:58:28.832515746Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable","Elapsed":0.15}
+{"Time":"2026-10-18T08:58:28.832529434Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable"}
+{"Time":"2026-10-18T08:58:28.832535917Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable","Output":"=== RUN   TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable\n"}
+{"Time":"2026-10-18T08:58:28.994043163Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable","Output":"--- PASS: TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable (0.16s)\n"}
+{"Time":"2026-10-18T08:58:28.994094742Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable","Elapsed":0.16}
+{"Time":"2026-10-18T08:58:28.994187214Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured"}
+{"Time":"2026-10-18T08:58:28.9941989Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured","Output":"=== RUN   TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured\n"}
+{"Time":"2026-10-18T08:58:29.119324261Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured","Output":"--- PASS: TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured (0.12s)\n"}
+{"Time":"2026-10-18T08:58:29.119377102Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured","Elapsed":0.12}
+{"Time":"2026-10-18T08:58:29.119392575Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims"}
+{"Time":"2026-10-18T08:58:29.119399446Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims","Output":"=== RUN   TestUserinfoHandler_ValidToken_ReturnsClaims\n"}
+{"Time":"2026-10-18T08:58:29.246792064Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims","Output":"--- PASS: TestUserinfoHandler_ValidToken_ReturnsClaims (0.13s)\n"}
+{"Time":"2026-10-18T08:58:29.246887286Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims","Elapsed":0.13}
+{"Time":"2026-10-18T08:58:29.246913841Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername"}
+{"Time":"2026-10-18T08:58:29.246921759Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername","Output":"=== RUN   TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername\n"}
+{"Time":"2026-10-18T08:58:29.495815249Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername","Output":"--- PASS: TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername (0.25s)\n"}
+{"Time":"2026-10-18T08:58:29.496210682Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername","Elapsed":0.25}
+{"Time":"2026-10-18T08:58:29.496249808Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken"}
+{"Time":"2026-10-18T08:58:29.496257824Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken","Output":"=== RUN   TestUserinfoHandler_SuspendedUserInvalidatesToken\n"}
+{"Time":"2026-10-18T08:58:29.587883759Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken","Output":"--- PASS: TestUserinfoHandler_SuspendedUserInvalidatesToken (0.09s)\n"}
+{"Time":"2026-10-18T08:58:29.587942317Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken","Elapsed":0.09}
+{"Time":"2026-10-18T08:58:29.5879555Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401"}
+{"Time":"2026-10-18T08:58:29.587963237Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401","Output":"=== RUN   TestUserinfoHandler_MissingAuthorization_Returns401\n"}
+{"Time":"2026-10-18T08:58:29.656775152Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401","Output":"--- PASS: TestUserinfoHandler_MissingAuthorization_Returns401 (0.07s)\n"}
+{"Time":"2026-10-18T08:58:29.656847723Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401","Elapsed":0.07}
+{"Time":"2026-10-18T08:58:29.656950222Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401"}
+{"Time":"2026-10-18T08:58:29.65696593Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401","Output":"=== RUN   TestUserinfoHandler_ExpiredToken_Returns401\n"}
+{"Time":"2026-10-18T08:58:29.861034911Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401","Output":"--- PASS: TestUserinfoHandler_ExpiredToken_Returns401 (0.20s)\n"}
+{"Time":"2026-10-18T08:58:29.861274562Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401","Elapsed":0.2}
+{"Time":"2026-10-18T08:58:29.861310631Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401"}
+{"Time":"2026-10-18T08:58:29.861320316Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401","Output":"=== RUN   TestUserinfoHandler_InvalidSignature_Returns401\n"}
+{"Time":"2026-10-18T08:58:30.199955054Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401","Output":"--- PASS: TestUserinfoHandler_InvalidSignature_Returns401 (0.34s)\n"}
+{"Time":"2026-10-18T08:58:30.200093477Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401","Elapsed":0.34}
+{"Time":"2026-10-18T08:58:30.200154804Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent"}
+{"Time":"2026-10-18T08:58:30.200165994Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent","Output":"=== RUN   TestUserinfoHandler_WithEmailScope_EmailPresent\n"}
+{"Time":"2026-10-18T08:58:30.310101425Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent","Output":"--- PASS: TestUserinfoHandler_WithEmailScope_EmailPresent (0.11s)\n"}
+{"Time":"2026-10-18T08:58:30.310242337Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:30.310266467Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent"}
+{"Time":"2026-10-18T08:58:30.310277135Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent","Output":"=== RUN   TestUserinfoHandler_WithoutEmailScope_EmailAbsent\n"}
+{"Time":"2026-10-18T08:58:30.415417045Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent","Output":"--- PASS: TestUserinfoHandler_WithoutEmailScope_EmailAbsent (0.10s)\n"}
+{"Time":"2026-10-18T08:58:30.415529274Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent","Elapsed":0.1}
+{"Time":"2026-10-18T08:58:30.415556776Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent"}
+{"Time":"2026-10-18T08:58:30.415566903Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent","Output":"=== RUN   TestUserinfoHandler_WithProfileScope_UsernamePresent\n"}
+{"Time":"2026-10-18T08:58:30.527979249Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent","Output":"--- PASS: TestUserinfoHandler_WithProfileScope_UsernamePresent (0.11s)\n"}
+{"Time":"2026-10-18T08:58:30.528156366Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:30.528184319Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry"}
+{"Time":"2026-10-18T08:58:30.528192254Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry","Output":"=== RUN   TestUserinfoHandler_EmitsTelemetry\n"}
+{"Time":"2026-10-18T08:58:30.635090874Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry","Output":"--- PASS: TestUserinfoHandler_EmitsTelemetry (0.11s)\n"}
+{"Time":"2026-10-18T08:58:30.635220353Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry","Elapsed":0.11}
+{"Time":"2026-10-18T08:58:30.635396324Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401"}
+{"Time":"2026-10-18T08:58:30.635407848Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401","Output":"=== RUN   TestUserinfoHandler_UserNotFound_Returns401\n"}
+{"Time":"2026-10-18T08:58:30.8862873Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401","Output":"--- PASS: TestUserinfoHandler_UserNotFound_Returns401 (0.25s)\n"}
+{"Time":"2026-10-18T08:58:30.886498917Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401","Elapsed":0.25}
+{"Time":"2026-10-18T08:58:30.886521694Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"PASS\n"}
+{"Time":"2026-10-18T08:58:31.8998774Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"ok  \tkeycape/internal/server/oidc\t16.614s\n"}
+{"Time":"2026-10-18T08:58:31.900821091Z","Action":"pass","Package":"keycape/internal/server/oidc","Elapsed":16.615}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt2.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt2.json
new file mode 100644
index 0000000..4456812
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt2.json
@@ -0,0 +1,222 @@
+{
+  "returncode": 0,
+  "seconds": 26.13,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--",
+    "go",
+    "test",
+    "-p",
+    "4",
+    "-race",
+    "-json",
+    "-count=1",
+    "./..."
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a",
+    "src/internal/authclient/online_export_test.go": "sha256:5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f",
+    "src/internal/authclient/online_test.go": "sha256:6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a",
+    "src/internal/authclient/online_human_test.go": "sha256:e501c30b6d710a6dea89559ccf8b98de68502c2ee58d1778a56e97f1b7f3b6e0",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 724,
+    "fail": 0,
+    "skip": 6
+  },
+  "failures": [],
+  "skips": [
+    "keycape/tests/conformance:TestIssuerAdvertisesItself",
+    "keycape/tests/conformance:TestProfileAuthorizationSurface",
+    "keycape/tests/conformance:TestPublishedKeysAreUsable",
+    "keycape/tests/conformance:TestExcludedGrantsAreNotAdvertised",
+    "keycape/tests/conformance:TestServiceTokenVerifiesAgainstPublishedKeys",
+    "keycape/internal/server/oidc:TestNativeOptionalEnrollmentAndOldSession"
+  ],
+  "source": "/tmp/custodian-keycape-current-client-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt2.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt2.jsonl
new file mode 100644
index 0000000..dce03e1
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/full-attempt2.jsonl
@@ -0,0 +1,3032 @@
+{"Time":"2026-10-18T09:12:46.483673923Z","Action":"start","Package":"keycape/cmd/keycape"}
+{"Time":"2026-10-18T09:12:46.508693952Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey"}
+{"Time":"2026-10-18T09:12:46.508865261Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey","Output":"=== RUN   TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey\n"}
+{"Time":"2026-10-18T09:12:46.512568777Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey","Output":"--- PASS: TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey (0.00s)\n"}
+{"Time":"2026-10-18T09:12:46.512630681Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigAcceptsValidConfigWithoutSecretsOrKey","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.512797545Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup"}
+{"Time":"2026-10-18T09:12:46.512809493Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup\n"}
+{"Time":"2026-10-18T09:12:46.513254439Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing"}
+{"Time":"2026-10-18T09:12:46.51328975Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing\n"}
+{"Time":"2026-10-18T09:12:46.519549635Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing (0.00s)\n"}
+{"Time":"2026-10-18T09:12:46.519628662Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/policy_store_client_missing","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.519649537Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client"}
+{"Time":"2026-10-18T09:12:46.519658753Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client\n"}
+{"Time":"2026-10-18T09:12:46.519665768Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client (0.00s)\n"}
+{"Time":"2026-10-18T09:12:46.519700006Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/explicit_mfa_false_on_policy_client","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.519715669Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client"}
+{"Time":"2026-10-18T09:12:46.519724308Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/duplicate_client\n"}
+{"Time":"2026-10-18T09:12:46.521755415Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/duplicate_client (0.00s)\n"}
+{"Time":"2026-10-18T09:12:46.52180602Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/duplicate_client","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.521828626Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect"}
+{"Time":"2026-10-18T09:12:46.521834505Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/query_in_redirect\n"}
+{"Time":"2026-10-18T09:12:46.523937388Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/query_in_redirect (0.00s)\n"}
+{"Time":"2026-10-18T09:12:46.523995026Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/query_in_redirect","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.524012799Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided"}
+{"Time":"2026-10-18T09:12:46.524020022Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided","Output":"=== RUN   TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided\n"}
+{"Time":"2026-10-18T09:12:46.526627898Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided (0.00s)\n"}
+{"Time":"2026-10-18T09:12:46.526686033Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup/secret_env_not_provided","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.526696691Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup","Output":"--- PASS: TestCheckConfigRefusesWhatStopsStartup (0.01s)\n"}
+{"Time":"2026-10-18T09:12:46.526818839Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigRefusesWhatStopsStartup","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:46.526998246Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem"}
+{"Time":"2026-10-18T09:12:46.527019076Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem","Output":"=== RUN   TestCheckConfigWithoutEnvNamesOnlyListsThem\n"}
+{"Time":"2026-10-18T09:12:46.529897805Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem","Output":"--- PASS: TestCheckConfigWithoutEnvNamesOnlyListsThem (0.00s)\n"}
+{"Time":"2026-10-18T09:12:46.529949889Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestCheckConfigWithoutEnvNamesOnlyListsThem","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.529961945Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation"}
+{"Time":"2026-10-18T09:12:46.529967473Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation","Output":"=== RUN   TestServiceRegistrationAudienceAndScopeIsolation\n"}
+{"Time":"2026-10-18T09:12:46.541580441Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation","Output":"--- PASS: TestServiceRegistrationAudienceAndScopeIsolation (0.01s)\n"}
+{"Time":"2026-10-18T09:12:46.543537052Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationAudienceAndScopeIsolation","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:46.543611742Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision"}
+{"Time":"2026-10-18T09:12:46.543618973Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision","Output":"=== RUN   TestServiceRegistrationTenantsAreExactPerDecision\n"}
+{"Time":"2026-10-18T09:12:46.552737327Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision","Output":"--- PASS: TestServiceRegistrationTenantsAreExactPerDecision (0.01s)\n"}
+{"Time":"2026-10-18T09:12:46.552791836Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestServiceRegistrationTenantsAreExactPerDecision","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:46.552804136Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact"}
+{"Time":"2026-10-18T09:12:46.552835678Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact","Output":"=== RUN   TestApproverRegistrationShapeIsExact\n"}
+{"Time":"2026-10-18T09:12:46.561649818Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact","Output":"--- PASS: TestApproverRegistrationShapeIsExact (0.01s)\n"}
+{"Time":"2026-10-18T09:12:46.561699476Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestApproverRegistrationShapeIsExact","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:46.561744535Z","Action":"run","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact"}
+{"Time":"2026-10-18T09:12:46.561751325Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact","Output":"=== RUN   TestSittingRequesterRegistrationShapeIsExact\n"}
+{"Time":"2026-10-18T09:12:46.569327175Z","Action":"output","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact","Output":"--- PASS: TestSittingRequesterRegistrationShapeIsExact (0.01s)\n"}
+{"Time":"2026-10-18T09:12:46.569375507Z","Action":"pass","Package":"keycape/cmd/keycape","Test":"TestSittingRequesterRegistrationShapeIsExact","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:46.569385102Z","Action":"output","Package":"keycape/cmd/keycape","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:46.984830335Z","Action":"start","Package":"keycape/cmd/keycape-to-keycloak"}
+{"Time":"2026-10-18T09:12:46.984874772Z","Action":"output","Package":"keycape/cmd/keycape-to-keycloak","Output":"?   \tkeycape/cmd/keycape-to-keycloak\t[no test files]\n"}
+{"Time":"2026-10-18T09:12:46.984891436Z","Action":"skip","Package":"keycape/cmd/keycape-to-keycloak","Elapsed":0}
+{"Time":"2026-10-18T09:12:46.984903952Z","Action":"start","Package":"keycape/cmd/lldap-export"}
+{"Time":"2026-10-18T09:12:47.015658741Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword"}
+{"Time":"2026-10-18T09:12:47.015714314Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword","Output":"=== RUN   TestResolveBindPassword\n"}
+{"Time":"2026-10-18T09:12:47.015776164Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins"}
+{"Time":"2026-10-18T09:12:47.015782061Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins","Output":"=== RUN   TestResolveBindPassword/environment_wins\n"}
+{"Time":"2026-10-18T09:12:47.016103792Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins","Output":"--- PASS: TestResolveBindPassword/environment_wins (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.016125884Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/environment_wins","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.016139446Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed"}
+{"Time":"2026-10-18T09:12:47.01614491Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed","Output":"=== RUN   TestResolveBindPassword/file,_trailing_newline_trimmed\n"}
+{"Time":"2026-10-18T09:12:47.016888256Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed","Output":"--- PASS: TestResolveBindPassword/file,_trailing_newline_trimmed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.016929789Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/file,_trailing_newline_trimmed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.016949772Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works"}
+{"Time":"2026-10-18T09:12:47.016957481Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Output":"=== RUN   TestResolveBindPassword/deprecated_flag_still_works\n"}
+{"Time":"2026-10-18T09:12:47.017165473Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Output":"lldap-export: warning: --bind-pw exposes the password to any local user via ps; prefer KEYCAPE_LLDAP_BIND_PW or --bind-pw-file\n"}
+{"Time":"2026-10-18T09:12:47.017199955Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Output":"--- PASS: TestResolveBindPassword/deprecated_flag_still_works (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.017362013Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/deprecated_flag_still_works","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.017377045Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password"}
+{"Time":"2026-10-18T09:12:47.017385936Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password","Output":"=== RUN   TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password\n"}
+{"Time":"2026-10-18T09:12:47.017966737Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password","Output":"--- PASS: TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.018000723Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/missing_file_is_an_error,_not_an_empty_password","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.018012797Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected"}
+{"Time":"2026-10-18T09:12:47.018018Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected","Output":"=== RUN   TestResolveBindPassword/conflicting_sources_are_rejected\n"}
+{"Time":"2026-10-18T09:12:47.018336201Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected","Output":"--- PASS: TestResolveBindPassword/conflicting_sources_are_rejected (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.018368311Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/conflicting_sources_are_rejected","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.018381999Z","Action":"run","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error"}
+{"Time":"2026-10-18T09:12:47.018389078Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error","Output":"=== RUN   TestResolveBindPassword/no_password_at_all_is_an_error\n"}
+{"Time":"2026-10-18T09:12:47.018662805Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error","Output":"--- PASS: TestResolveBindPassword/no_password_at_all_is_an_error (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.018686836Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword/no_password_at_all_is_an_error","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.018803848Z","Action":"output","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword","Output":"--- PASS: TestResolveBindPassword (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.018923864Z","Action":"pass","Package":"keycape/cmd/lldap-export","Test":"TestResolveBindPassword","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.018944252Z","Action":"output","Package":"keycape/cmd/lldap-export","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:47.030351401Z","Action":"start","Package":"keycape/cmd/lldap-to-ldap"}
+{"Time":"2026-10-18T09:12:47.03039343Z","Action":"output","Package":"keycape/cmd/lldap-to-ldap","Output":"?   \tkeycape/cmd/lldap-to-ldap\t[no test files]\n"}
+{"Time":"2026-10-18T09:12:47.030401149Z","Action":"skip","Package":"keycape/cmd/lldap-to-ldap","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.030426325Z","Action":"start","Package":"keycape/cmd/validator"}
+{"Time":"2026-10-18T09:12:47.03043105Z","Action":"output","Package":"keycape/cmd/validator","Output":"?   \tkeycape/cmd/validator\t[no test files]\n"}
+{"Time":"2026-10-18T09:12:47.030434909Z","Action":"skip","Package":"keycape/cmd/validator","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.030443719Z","Action":"start","Package":"keycape/internal/adapters/authelia"}
+{"Time":"2026-10-18T09:12:47.133592514Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams"}
+{"Time":"2026-10-18T09:12:47.133655869Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams","Output":"=== RUN   TestAuthorizeURL_ContainsRequiredParams\n"}
+{"Time":"2026-10-18T09:12:47.133954719Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams","Output":"--- PASS: TestAuthorizeURL_ContainsRequiredParams (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.133975648Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_ContainsRequiredParams","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.133988371Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL"}
+{"Time":"2026-10-18T09:12:47.133995243Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL","Output":"=== RUN   TestAuthorizeURL_UsesBaseURL\n"}
+{"Time":"2026-10-18T09:12:47.134213911Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL","Output":"--- PASS: TestAuthorizeURL_UsesBaseURL (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.134233947Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBaseURL","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.13424447Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured"}
+{"Time":"2026-10-18T09:12:47.134252243Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured","Output":"=== RUN   TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured\n"}
+{"Time":"2026-10-18T09:12:47.134469279Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured","Output":"--- PASS: TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.134488513Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURL_UsesBrowserBaseURLWhenConfigured","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.134496106Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername"}
+{"Time":"2026-10-18T09:12:47.134502183Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername","Output":"=== RUN   TestHandleCallback_Success_PreferredUsername\n"}
+{"Time":"2026-10-18T09:12:47.138841173Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername","Output":"--- PASS: TestHandleCallback_Success_PreferredUsername (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.138906467Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_PreferredUsername","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.138922581Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured"}
+{"Time":"2026-10-18T09:12:47.138928857Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured","Output":"=== RUN   TestHandleCallback_UsesTokenBaseURLWhenConfigured\n"}
+{"Time":"2026-10-18T09:12:47.142568376Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured","Output":"--- PASS: TestHandleCallback_UsesTokenBaseURLWhenConfigured (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.142639378Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_UsesTokenBaseURLWhenConfigured","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.14264853Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP"}
+{"Time":"2026-10-18T09:12:47.142653336Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP","Output":"=== RUN   TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP\n"}
+{"Time":"2026-10-18T09:12:47.142824686Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local"}
+{"Time":"2026-10-18T09:12:47.142849466Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local","Output":"=== RUN   TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local\n"}
+{"Time":"2026-10-18T09:12:47.146504085Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local","Output":"--- PASS: TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.146575483Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/_https://authelia.local","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.146588423Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091"}
+{"Time":"2026-10-18T09:12:47.146594492Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091","Output":"=== RUN   TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091\n"}
+{"Time":"2026-10-18T09:12:47.149852415Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091","Output":"--- PASS: TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.149921884Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP/http://localhost:9091_http://authelia:9091","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.149943642Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP","Output":"--- PASS: TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP (0.01s)\n"}
+{"Time":"2026-10-18T09:12:47.149954183Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestTokenRequestOmitsForwardedHeadersForSameOriginAndPlainHTTP","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:47.149977213Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders"}
+{"Time":"2026-10-18T09:12:47.149993616Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders","Output":"=== RUN   TestDiscoveryFetch_CarriesPublicOriginHeaders\n"}
+{"Time":"2026-10-18T09:12:47.153151024Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders","Output":"--- PASS: TestDiscoveryFetch_CarriesPublicOriginHeaders (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.15323786Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestDiscoveryFetch_CarriesPublicOriginHeaders","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.153275398Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub"}
+{"Time":"2026-10-18T09:12:47.1532864Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub","Output":"=== RUN   TestHandleCallback_Success_FallsBackToSub\n"}
+{"Time":"2026-10-18T09:12:47.157127646Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub","Output":"--- PASS: TestHandleCallback_Success_FallsBackToSub (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.157182236Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_Success_FallsBackToSub","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.157193905Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T09:12:47.157198693Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_CallbackError_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T09:12:47.157458158Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_CallbackError_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.15749631Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CallbackError_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.157505336Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T09:12:47.157511089Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_HTTPError_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T09:12:47.157778Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_HTTPError_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.157795989Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_HTTPError_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.157803852Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T09:12:47.15780883Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T09:12:47.160957112Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.161009547Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_MissingUsernameClaim_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.161022334Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed"}
+{"Time":"2026-10-18T09:12:47.161027996Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed","Output":"=== RUN   TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed\n"}
+{"Time":"2026-10-18T09:12:47.161251525Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed","Output":"--- PASS: TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.161288514Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_TokenExchangeNetworkError_ReturnsErrAuthFailed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.161296611Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens"}
+{"Time":"2026-10-18T09:12:47.161302554Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens","Output":"=== RUN   TestHandleCallback_AuthResultContainsNoRawTokens\n"}
+{"Time":"2026-10-18T09:12:47.164358716Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens","Output":"--- PASS: TestHandleCallback_AuthResultContainsNoRawTokens (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.164408302Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_AuthResultContainsNoRawTokens","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.164417093Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge"}
+{"Time":"2026-10-18T09:12:47.164425696Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge","Output":"=== RUN   TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge\n"}
+{"Time":"2026-10-18T09:12:47.164695483Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge","Output":"--- PASS: TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.16471937Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestAuthorizeURLTranslatesFreshLoginToBoundedMaxAge","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.164734131Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime"}
+{"Time":"2026-10-18T09:12:47.164740344Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime","Output":"=== RUN   TestHandleCallback_CarriesUpstreamAuthTime\n"}
+{"Time":"2026-10-18T09:12:47.170953548Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime","Output":"--- PASS: TestHandleCallback_CarriesUpstreamAuthTime (0.01s)\n"}
+{"Time":"2026-10-18T09:12:47.171025488Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestHandleCallback_CarriesUpstreamAuthTime","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:47.17104575Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens"}
+{"Time":"2026-10-18T09:12:47.171053559Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens","Output":"=== RUN   TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens\n"}
+{"Time":"2026-10-18T09:12:47.171172721Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local"}
+{"Time":"2026-10-18T09:12:47.171193344Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local","Output":"=== RUN   TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local\n"}
+{"Time":"2026-10-18T09:12:47.175974321Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local","Output":"--- PASS: TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.176040688Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/https://authelia.local","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.176080183Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091"}
+{"Time":"2026-10-18T09:12:47.176105377Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091","Output":"=== RUN   TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091\n"}
+{"Time":"2026-10-18T09:12:47.179624124Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091","Output":"--- PASS: TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.179682187Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens/http://authelia.sso.svc.cluster.local:9091","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.179696145Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens","Output":"--- PASS: TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens (0.01s)\n"}
+{"Time":"2026-10-18T09:12:47.179710627Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeVerifiesSignedIssuerWithoutDisclosingTokens","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:47.179721718Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange"}
+{"Time":"2026-10-18T09:12:47.179729608Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange","Output":"=== RUN   TestIssuerProbeRefusesUnboundCallbacksBeforeExchange\n"}
+{"Time":"2026-10-18T09:12:47.185029211Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange","Output":"--- PASS: TestIssuerProbeRefusesUnboundCallbacksBeforeExchange (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.185098058Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRefusesUnboundCallbacksBeforeExchange","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.185116615Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory"}
+{"Time":"2026-10-18T09:12:47.185126417Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory\n"}
+{"Time":"2026-10-18T09:12:47.315459528Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer"}
+{"Time":"2026-10-18T09:12:47.315586455Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer\n"}
+{"Time":"2026-10-18T09:12:47.318441145Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.318483661Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unreviewed_issuer","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.318497476Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience"}
+{"Time":"2026-10-18T09:12:47.318505104Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience\n"}
+{"Time":"2026-10-18T09:12:47.322749987Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.322833279Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_audience","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.322854758Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired"}
+{"Time":"2026-10-18T09:12:47.322859817Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired\n"}
+{"Time":"2026-10-18T09:12:47.326346495Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.326404241Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/expired","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.326418299Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce"}
+{"Time":"2026-10-18T09:12:47.326426911Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce\n"}
+{"Time":"2026-10-18T09:12:47.329853916Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.32990196Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/wrong_nonce","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.329914945Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature"}
+{"Time":"2026-10-18T09:12:47.329920806Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature\n"}
+{"Time":"2026-10-18T09:12:47.33295525Z","Action":"start","Package":"keycape/internal/adapters/lldap"}
+{"Time":"2026-10-18T09:12:47.333714601Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.333756811Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/forged_signature","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.333833799Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys"}
+{"Time":"2026-10-18T09:12:47.333846234Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys\n"}
+{"Time":"2026-10-18T09:12:47.337569664Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.33762797Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/unavailable_keys","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.33763586Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused"}
+{"Time":"2026-10-18T09:12:47.337640756Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused\n"}
+{"Time":"2026-10-18T09:12:47.340369897Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.340426814Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_refused","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.340434713Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed"}
+{"Time":"2026-10-18T09:12:47.340439952Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed\n"}
+{"Time":"2026-10-18T09:12:47.343613492Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.3436714Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/provider_malformed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.343678948Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize"}
+{"Time":"2026-10-18T09:12:47.343684097Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize","Output":"=== RUN   TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize\n"}
+{"Time":"2026-10-18T09:12:47.355191979Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch"}
+{"Time":"2026-10-18T09:12:47.355255326Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch","Output":"=== RUN   TestUserBaseDNDefaultsToLLDAPsPeopleBranch\n"}
+{"Time":"2026-10-18T09:12:47.355523135Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch","Output":"--- PASS: TestUserBaseDNDefaultsToLLDAPsPeopleBranch (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.35556879Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestUserBaseDNDefaultsToLLDAPsPeopleBranch","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.355704962Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults"}
+{"Time":"2026-10-18T09:12:47.355719146Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults","Output":"=== RUN   TestExplicitOUOverridesDefaults\n"}
+{"Time":"2026-10-18T09:12:47.355931195Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults","Output":"--- PASS: TestExplicitOUOverridesDefaults (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.355986165Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestExplicitOUOverridesDefaults","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.356054551Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped"}
+{"Time":"2026-10-18T09:12:47.356062901Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped","Output":"=== RUN   TestRailianceAdminGroupIsExplicitAndScoped\n"}
+{"Time":"2026-10-18T09:12:47.356321805Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped","Output":"--- PASS: TestRailianceAdminGroupIsExplicitAndScoped (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.356350164Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestRailianceAdminGroupIsExplicitAndScoped","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.356458001Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success"}
+{"Time":"2026-10-18T09:12:47.356468587Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success","Output":"=== RUN   TestLookupUser_Success\n"}
+{"Time":"2026-10-18T09:12:47.35678824Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success","Output":"--- PASS: TestLookupUser_Success (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.356808267Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_Success","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.356901839Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup"}
+{"Time":"2026-10-18T09:12:47.356911767Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup","Output":"=== RUN   TestLookupUser_MapsExplicitTenantAdminGroup\n"}
+{"Time":"2026-10-18T09:12:47.357170138Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup","Output":"--- PASS: TestLookupUser_MapsExplicitTenantAdminGroup (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.357187145Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsExplicitTenantAdminGroup","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.357239905Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups"}
+{"Time":"2026-10-18T09:12:47.357249427Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups","Output":"=== RUN   TestLookupUser_IgnoresAmbiguousTenantGroups\n"}
+{"Time":"2026-10-18T09:12:47.357443559Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups","Output":"--- PASS: TestLookupUser_IgnoresAmbiguousTenantGroups (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.357462388Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_IgnoresAmbiguousTenantGroups","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.357571478Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup"}
+{"Time":"2026-10-18T09:12:47.357581406Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup","Output":"=== RUN   TestLookupUser_MapsEstablishedPlatformAdminGroup\n"}
+{"Time":"2026-10-18T09:12:47.357803456Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup","Output":"--- PASS: TestLookupUser_MapsEstablishedPlatformAdminGroup (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.357818019Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_MapsEstablishedPlatformAdminGroup","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.357890175Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN"}
+{"Time":"2026-10-18T09:12:47.357914206Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN","Output":"=== RUN   TestLookupUser_DisplayName_FallsBackToSN\n"}
+{"Time":"2026-10-18T09:12:47.358066841Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN","Output":"--- PASS: TestLookupUser_DisplayName_FallsBackToSN (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.358078365Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_DisplayName_FallsBackToSN","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.358085452Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound"}
+{"Time":"2026-10-18T09:12:47.358089564Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound","Output":"=== RUN   TestLookupUser_NotFound\n"}
+{"Time":"2026-10-18T09:12:47.358269269Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound","Output":"--- PASS: TestLookupUser_NotFound (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.358288395Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_NotFound","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.358660618Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin"}
+{"Time":"2026-10-18T09:12:47.358676623Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin","Output":"=== RUN   TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin\n"}
+{"Time":"2026-10-18T09:12:47.35888209Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin","Output":"--- PASS: TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.358898709Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupUser_ValidationWarningDoesNotBlockRuntimeLogin","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.358971541Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success"}
+{"Time":"2026-10-18T09:12:47.358981686Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success","Output":"=== RUN   TestLookupGroups_Success\n"}
+{"Time":"2026-10-18T09:12:47.359155385Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success","Output":"--- PASS: TestLookupGroups_Success (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.35918755Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Success","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.359269233Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty"}
+{"Time":"2026-10-18T09:12:47.359286735Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty","Output":"=== RUN   TestLookupGroups_Empty\n"}
+{"Time":"2026-10-18T09:12:47.359534032Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty","Output":"--- PASS: TestLookupGroups_Empty (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.359591255Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLookupGroups_Empty","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.359605034Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success"}
+{"Time":"2026-10-18T09:12:47.359612022Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success","Output":"=== RUN   TestValidatePassword_Success\n"}
+{"Time":"2026-10-18T09:12:47.359807774Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success","Output":"--- PASS: TestValidatePassword_Success (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.359842869Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_Success","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.359931689Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword"}
+{"Time":"2026-10-18T09:12:47.359942897Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword","Output":"=== RUN   TestValidatePassword_WrongPassword\n"}
+{"Time":"2026-10-18T09:12:47.360318722Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword","Output":"--- PASS: TestValidatePassword_WrongPassword (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.360360607Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_WrongPassword","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.360440978Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure"}
+{"Time":"2026-10-18T09:12:47.360449427Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure","Output":"=== RUN   TestValidatePassword_BindFailure\n"}
+{"Time":"2026-10-18T09:12:47.360707257Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure","Output":"--- PASS: TestValidatePassword_BindFailure (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.36079916Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_BindFailure","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.360906601Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound"}
+{"Time":"2026-10-18T09:12:47.360915546Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound","Output":"=== RUN   TestValidatePassword_UserNotFound\n"}
+{"Time":"2026-10-18T09:12:47.361099615Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound","Output":"--- PASS: TestValidatePassword_UserNotFound (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.361140003Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestValidatePassword_UserNotFound","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.361215477Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers"}
+{"Time":"2026-10-18T09:12:47.361224152Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers","Output":"=== RUN   TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers\n"}
+{"Time":"2026-10-18T09:12:47.361442883Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers","Output":"--- PASS: TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.361529647Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_ReturnsAllGroupsWithMembers","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.361551695Z","Action":"run","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError"}
+{"Time":"2026-10-18T09:12:47.36155733Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError","Output":"=== RUN   TestLDAPAdapter_ListGroups_PropagatesSearchError\n"}
+{"Time":"2026-10-18T09:12:47.361821752Z","Action":"output","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError","Output":"--- PASS: TestLDAPAdapter_ListGroups_PropagatesSearchError (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.361843006Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Test":"TestLDAPAdapter_ListGroups_PropagatesSearchError","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.361940491Z","Action":"output","Package":"keycape/internal/adapters/lldap","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:47.37790768Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize (0.03s)\n"}
+{"Time":"2026-10-18T09:12:47.378020423Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory/oversize","Elapsed":0.03}
+{"Time":"2026-10-18T09:12:47.3780377Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory","Output":"--- PASS: TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory (0.19s)\n"}
+{"Time":"2026-10-18T09:12:47.378043516Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeRejectsTokensAndWritesOnlyFailureCategory","Elapsed":0.19}
+{"Time":"2026-10-18T09:12:47.378048449Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration"}
+{"Time":"2026-10-18T09:12:47.378052669Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration","Output":"=== RUN   TestIssuerProbeBoundsLifetimeAndConfiguration\n"}
+{"Time":"2026-10-18T09:12:47.380035Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration","Output":"--- PASS: TestIssuerProbeBoundsLifetimeAndConfiguration (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.380093658Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeBoundsLifetimeAndConfiguration","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.380201883Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments"}
+{"Time":"2026-10-18T09:12:47.380210449Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments","Output":"=== RUN   TestIssuerProbeErrorsDoNotPrintArguments\n"}
+{"Time":"2026-10-18T09:12:47.380776247Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments","Output":"--- PASS: TestIssuerProbeErrorsDoNotPrintArguments (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.380811072Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeErrorsDoNotPrintArguments","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.380819548Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun"}
+{"Time":"2026-10-18T09:12:47.380823254Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun","Output":"=== RUN   TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun\n"}
+{"Time":"2026-10-18T09:12:47.383509556Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun","Output":"--- PASS: TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.383567789Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestIssuerProbeCLIReadsOnlyUpstreamAndBoundsIdleRun","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.383599926Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine"}
+{"Time":"2026-10-18T09:12:47.383610837Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine","Output":"=== RUN   TestUpstreamTokenIsAcceptedWhenGenuine\n"}
+{"Time":"2026-10-18T09:12:47.386870113Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine","Output":"--- PASS: TestUpstreamTokenIsAcceptedWhenGenuine (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.386896416Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenIsAcceptedWhenGenuine","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.386907048Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections"}
+{"Time":"2026-10-18T09:12:47.387091117Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections","Output":"=== RUN   TestUpstreamTokenRejections\n"}
+{"Time":"2026-10-18T09:12:47.472268284Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id"}
+{"Time":"2026-10-18T09:12:47.472314921Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id","Output":"=== RUN   TestUpstreamTokenRejections/unknown_key_id\n"}
+{"Time":"2026-10-18T09:12:47.473049412Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id","Output":"--- PASS: TestUpstreamTokenRejections/unknown_key_id (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.473071631Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unknown_key_id","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.473086509Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key"}
+{"Time":"2026-10-18T09:12:47.473092857Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key","Output":"=== RUN   TestUpstreamTokenRejections/undersized_signing_key\n"}
+{"Time":"2026-10-18T09:12:47.473489292Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key","Output":"--- PASS: TestUpstreamTokenRejections/undersized_signing_key (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.473507462Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/undersized_signing_key","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.47351601Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set"}
+{"Time":"2026-10-18T09:12:47.473522115Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set","Output":"=== RUN   TestUpstreamTokenRejections/malformed_key_set\n"}
+{"Time":"2026-10-18T09:12:47.47392515Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set","Output":"--- PASS: TestUpstreamTokenRejections/malformed_key_set (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.47394258Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/malformed_key_set","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.473950001Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set"}
+{"Time":"2026-10-18T09:12:47.473955835Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set","Output":"=== RUN   TestUpstreamTokenRejections/empty_key_set\n"}
+{"Time":"2026-10-18T09:12:47.474234631Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set","Output":"--- PASS: TestUpstreamTokenRejections/empty_key_set (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.474250131Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/empty_key_set","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.474371954Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set"}
+{"Time":"2026-10-18T09:12:47.474384993Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set","Output":"=== RUN   TestUpstreamTokenRejections/unreachable_key_set\n"}
+{"Time":"2026-10-18T09:12:47.474701535Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set","Output":"--- PASS: TestUpstreamTokenRejections/unreachable_key_set (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.474987886Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/unreachable_key_set","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.475004514Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature"}
+{"Time":"2026-10-18T09:12:47.475009717Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature","Output":"=== RUN   TestUpstreamTokenRejections/forged_signature\n"}
+{"Time":"2026-10-18T09:12:47.475695984Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature","Output":"--- PASS: TestUpstreamTokenRejections/forged_signature (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.475754749Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/forged_signature","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.475770809Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer"}
+{"Time":"2026-10-18T09:12:47.475776364Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer","Output":"=== RUN   TestUpstreamTokenRejections/wrong_issuer\n"}
+{"Time":"2026-10-18T09:12:47.47642566Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer","Output":"--- PASS: TestUpstreamTokenRejections/wrong_issuer (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.476441539Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/wrong_issuer","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.47645649Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client"}
+{"Time":"2026-10-18T09:12:47.476461783Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client","Output":"=== RUN   TestUpstreamTokenRejections/audience_is_another_client\n"}
+{"Time":"2026-10-18T09:12:47.477424107Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client","Output":"--- PASS: TestUpstreamTokenRejections/audience_is_another_client (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.477460356Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_is_another_client","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.477469166Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client"}
+{"Time":"2026-10-18T09:12:47.477474838Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client","Output":"=== RUN   TestUpstreamTokenRejections/audience_array_without_this_client\n"}
+{"Time":"2026-10-18T09:12:47.47856606Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client","Output":"--- PASS: TestUpstreamTokenRejections/audience_array_without_this_client (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.478606268Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/audience_array_without_this_client","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.478615105Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired"}
+{"Time":"2026-10-18T09:12:47.478621462Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired","Output":"=== RUN   TestUpstreamTokenRejections/expired\n"}
+{"Time":"2026-10-18T09:12:47.479739664Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired","Output":"--- PASS: TestUpstreamTokenRejections/expired (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.479800819Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/expired","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.479812812Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future"}
+{"Time":"2026-10-18T09:12:47.479821054Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future","Output":"=== RUN   TestUpstreamTokenRejections/issued_in_the_future\n"}
+{"Time":"2026-10-18T09:12:47.480924765Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future","Output":"--- PASS: TestUpstreamTokenRejections/issued_in_the_future (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.480971934Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/issued_in_the_future","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.481030032Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid"}
+{"Time":"2026-10-18T09:12:47.481069393Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid","Output":"=== RUN   TestUpstreamTokenRejections/not_yet_valid\n"}
+{"Time":"2026-10-18T09:12:47.482096602Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid","Output":"--- PASS: TestUpstreamTokenRejections/not_yet_valid (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.482125628Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/not_yet_valid","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.482133581Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry"}
+{"Time":"2026-10-18T09:12:47.482140173Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry","Output":"=== RUN   TestUpstreamTokenRejections/missing_expiry\n"}
+{"Time":"2026-10-18T09:12:47.483123116Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry","Output":"--- PASS: TestUpstreamTokenRejections/missing_expiry (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.483148004Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections/missing_expiry","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.483159771Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections","Output":"--- PASS: TestUpstreamTokenRejections (0.10s)\n"}
+{"Time":"2026-10-18T09:12:47.483168726Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejections","Elapsed":0.1}
+{"Time":"2026-10-18T09:12:47.483189177Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms"}
+{"Time":"2026-10-18T09:12:47.483195507Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms","Output":"=== RUN   TestUpstreamTokenRejectsNonRS256Algorithms\n"}
+{"Time":"2026-10-18T09:12:47.494395227Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms","Output":"--- PASS: TestUpstreamTokenRejectsNonRS256Algorithms (0.01s)\n"}
+{"Time":"2026-10-18T09:12:47.49444906Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamTokenRejectsNonRS256Algorithms","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:47.494460349Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart"}
+{"Time":"2026-10-18T09:12:47.494468122Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart","Output":"=== RUN   TestUpstreamKeyRotationIsPickedUpWithoutRestart\n"}
+{"Time":"2026-10-18T09:12:47.573960356Z","Action":"output","Package":"keycape/cmd/keycape","Output":"ok  \tkeycape/cmd/keycape\t1.089s\n"}
+{"Time":"2026-10-18T09:12:47.574014884Z","Action":"pass","Package":"keycape/cmd/keycape","Elapsed":1.09}
+{"Time":"2026-10-18T09:12:47.576795406Z","Action":"start","Package":"keycape/internal/adapters/privacyidea"}
+{"Time":"2026-10-18T09:12:47.592803561Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue"}
+{"Time":"2026-10-18T09:12:47.592868738Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue","Output":"=== RUN   TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue\n"}
+{"Time":"2026-10-18T09:12:47.593815918Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue","Output":"--- PASS: TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.593853791Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.594030727Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList"}
+{"Time":"2026-10-18T09:12:47.594042287Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList","Output":"=== RUN   TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList\n"}
+{"Time":"2026-10-18T09:12:47.594219422Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList","Output":"--- PASS: TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.594257628Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.594411186Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse"}
+{"Time":"2026-10-18T09:12:47.594429779Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse","Output":"=== RUN   TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse\n"}
+{"Time":"2026-10-18T09:12:47.594950062Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse","Output":"--- PASS: TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.594979639Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.594990442Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens"}
+{"Time":"2026-10-18T09:12:47.594995843Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens","Output":"=== RUN   TestHasEnrolledFactor_RequireForAllStillListsTokens\n"}
+{"Time":"2026-10-18T09:12:47.595510898Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens","Output":"--- PASS: TestHasEnrolledFactor_RequireForAllStillListsTokens (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.595559916Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_RequireForAllStillListsTokens","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.59556906Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue"}
+{"Time":"2026-10-18T09:12:47.595587536Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue","Output":"=== RUN   TestHasEnrolledFactor_ActiveToken_ReturnsTrue\n"}
+{"Time":"2026-10-18T09:12:47.595878685Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue","Output":"--- PASS: TestHasEnrolledFactor_ActiveToken_ReturnsTrue (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.595892851Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestHasEnrolledFactor_ActiveToken_ReturnsTrue","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.595926314Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse"}
+{"Time":"2026-10-18T09:12:47.59593158Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse","Output":"=== RUN   TestCheckMFARequired_NoTokens_ReturnsFalse\n"}
+{"Time":"2026-10-18T09:12:47.596318808Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse","Output":"--- PASS: TestCheckMFARequired_NoTokens_ReturnsFalse (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.596332333Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_NoTokens_ReturnsFalse","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.596406852Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError"}
+{"Time":"2026-10-18T09:12:47.596420396Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError","Output":"=== RUN   TestCheckMFARequired_HTTPError_ReturnsError\n"}
+{"Time":"2026-10-18T09:12:47.596625223Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError","Output":"--- PASS: TestCheckMFARequired_HTTPError_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.596638171Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_HTTPError_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.596712329Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError"}
+{"Time":"2026-10-18T09:12:47.596721815Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError","Output":"=== RUN   TestCheckMFARequired_Non200Status_ReturnsError\n"}
+{"Time":"2026-10-18T09:12:47.596951864Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError","Output":"--- PASS: TestCheckMFARequired_Non200Status_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.597045183Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_Non200Status_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.597149188Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken"}
+{"Time":"2026-10-18T09:12:47.597159107Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken","Output":"=== RUN   TestCheckMFARequired_SendsAdminToken\n"}
+{"Time":"2026-10-18T09:12:47.597486568Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken","Output":"--- PASS: TestCheckMFARequired_SendsAdminToken (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.597500338Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_SendsAdminToken","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.5975929Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil"}
+{"Time":"2026-10-18T09:12:47.597602467Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil","Output":"=== RUN   TestValidateMFAToken_ValidOTP_ReturnsNil\n"}
+{"Time":"2026-10-18T09:12:47.597994465Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil","Output":"--- PASS: TestValidateMFAToken_ValidOTP_ReturnsNil (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.598020912Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_ValidOTP_ReturnsNil","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.598035349Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed"}
+{"Time":"2026-10-18T09:12:47.598039533Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed","Output":"=== RUN   TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed\n"}
+{"Time":"2026-10-18T09:12:47.598352224Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed","Output":"--- PASS: TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.598365092Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_InvalidOTP_ReturnsErrMFAFailed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.598372233Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError"}
+{"Time":"2026-10-18T09:12:47.598376174Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError","Output":"=== RUN   TestValidateMFAToken_HTTPError_ReturnsError\n"}
+{"Time":"2026-10-18T09:12:47.598560351Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError","Output":"--- PASS: TestValidateMFAToken_HTTPError_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.598571596Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_HTTPError_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.598588728Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError"}
+{"Time":"2026-10-18T09:12:47.598593246Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError","Output":"=== RUN   TestValidateMFAToken_Non200Status_ReturnsError\n"}
+{"Time":"2026-10-18T09:12:47.598791923Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError","Output":"--- PASS: TestValidateMFAToken_Non200Status_ReturnsError (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.598810607Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_Non200Status_ReturnsError","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.598815711Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm"}
+{"Time":"2026-10-18T09:12:47.598819624Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm","Output":"=== RUN   TestValidateMFAToken_IncludesRealm\n"}
+{"Time":"2026-10-18T09:12:47.59904107Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm","Output":"--- PASS: TestValidateMFAToken_IncludesRealm (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.599054632Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestValidateMFAToken_IncludesRealm","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.599075759Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm"}
+{"Time":"2026-10-18T09:12:47.599083162Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm","Output":"=== RUN   TestCheckMFARequired_IncludesRealm\n"}
+{"Time":"2026-10-18T09:12:47.59965812Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm","Output":"--- PASS: TestCheckMFARequired_IncludesRealm (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.599696894Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCheckMFARequired_IncludesRealm","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.599705379Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery"}
+{"Time":"2026-10-18T09:12:47.599709978Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery","Output":"=== RUN   TestCredentialFileRenewalAndFailureRecovery\n"}
+{"Time":"2026-10-18T09:12:47.60086553Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery","Output":"--- PASS: TestCredentialFileRenewalAndFailureRecovery (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.600892022Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialFileRenewalAndFailureRecovery","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.600903916Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues"}
+{"Time":"2026-10-18T09:12:47.600908046Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues\n"}
+{"Time":"2026-10-18T09:12:47.601220557Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous"}
+{"Time":"2026-10-18T09:12:47.601232279Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous\n"}
+{"Time":"2026-10-18T09:12:47.601440406Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.601458288Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/ambiguous","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.601468008Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty"}
+{"Time":"2026-10-18T09:12:47.601472354Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty\n"}
+{"Time":"2026-10-18T09:12:47.601742917Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.601755505Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/empty","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.601827995Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline"}
+{"Time":"2026-10-18T09:12:47.601838347Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline\n"}
+{"Time":"2026-10-18T09:12:47.602075139Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.602099711Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/newline","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.602110776Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized"}
+{"Time":"2026-10-18T09:12:47.602114906Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized\n"}
+{"Time":"2026-10-18T09:12:47.602672163Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.602686608Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/oversized","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.602694336Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing"}
+{"Time":"2026-10-18T09:12:47.602698466Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing\n"}
+{"Time":"2026-10-18T09:12:47.60291873Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.602931075Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/missing","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.602948613Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory"}
+{"Time":"2026-10-18T09:12:47.602953005Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory","Output":"=== RUN   TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory\n"}
+{"Time":"2026-10-18T09:12:47.603166759Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.603181502Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues/directory","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.603550551Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues","Output":"--- PASS: TestCredentialSourceErrorsNeverReachProviderOrExposeValues (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.603581155Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestCredentialSourceErrorsNeverReachProviderOrExposeValues","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.603588712Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2"}
+{"Time":"2026-10-18T09:12:47.603592959Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2","Output":"=== RUN   TestProviderFailureFlagCannotGrantAAL2\n"}
+{"Time":"2026-10-18T09:12:47.603956805Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2","Output":"--- PASS: TestProviderFailureFlagCannotGrantAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.603981512Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestProviderFailureFlagCannotGrantAAL2","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.603989438Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects"}
+{"Time":"2026-10-18T09:12:47.60399355Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects","Output":"=== RUN   TestProductionClientDoesNotFollowProviderRedirects\n"}
+{"Time":"2026-10-18T09:12:47.609531982Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects","Output":"--- PASS: TestProductionClientDoesNotFollowProviderRedirects (0.01s)\n"}
+{"Time":"2026-10-18T09:12:47.609578412Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestProductionClientDoesNotFollowProviderRedirects","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:47.609588818Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal"}
+{"Time":"2026-10-18T09:12:47.609593678Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal","Output":"=== RUN   TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal\n"}
+{"Time":"2026-10-18T09:12:47.611284133Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal","Output":"--- PASS: TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.611331527Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestRejectedCredentialCanRecoverAfterMountedSymlinkRenewal","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.611345125Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation"}
+{"Time":"2026-10-18T09:12:47.611349886Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation\n"}
+{"Time":"2026-10-18T09:12:47.611721415Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed"}
+{"Time":"2026-10-18T09:12:47.611741848Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/confirmed\n"}
+{"Time":"2026-10-18T09:12:47.612082123Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/confirmed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.61209858Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/confirmed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.612282403Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed"}
+{"Time":"2026-10-18T09:12:47.612298129Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed\n"}
+{"Time":"2026-10-18T09:12:47.612598379Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.612617784Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/legacy_completed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.612649777Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP"}
+{"Time":"2026-10-18T09:12:47.612655855Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP\n"}
+{"Time":"2026-10-18T09:12:47.613073669Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.613090802Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_OTP","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.613099747Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device"}
+{"Time":"2026-10-18T09:12:47.613104841Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device\n"}
+{"Time":"2026-10-18T09:12:47.613527535Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.613568951Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/awaiting_device","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.613588194Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending"}
+{"Time":"2026-10-18T09:12:47.613595254Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/backend_pending\n"}
+{"Time":"2026-10-18T09:12:47.614002216Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/backend_pending (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.614035246Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/backend_pending","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.614057925Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state"}
+{"Time":"2026-10-18T09:12:47.614065148Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/missing_state\n"}
+{"Time":"2026-10-18T09:12:47.61438747Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/missing_state (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.614413206Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/missing_state","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.614502295Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state"}
+{"Time":"2026-10-18T09:12:47.614522016Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/unknown_state\n"}
+{"Time":"2026-10-18T09:12:47.614814019Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/unknown_state (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.614840412Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/unknown_state","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.615009954Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment"}
+{"Time":"2026-10-18T09:12:47.615022615Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment","Output":"=== RUN   TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment\n"}
+{"Time":"2026-10-18T09:12:47.615385288Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.615419599Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation/broken_enrollment","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.615533388Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation","Output":"--- PASS: TestEnrollmentStateRequiresPossessionConfirmation (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.6157982Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentStateRequiresPossessionConfirmation","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.615835675Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup"}
+{"Time":"2026-10-18T09:12:47.615840743Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup","Output":"=== RUN   TestEnrollmentConfirmationChangesDecisionOnNextLookup\n"}
+{"Time":"2026-10-18T09:12:47.616724464Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup","Output":"--- PASS: TestEnrollmentConfirmationChangesDecisionOnNextLookup (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.616760362Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentConfirmationChangesDecisionOnNextLookup","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.61677213Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor"}
+{"Time":"2026-10-18T09:12:47.616777612Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor","Output":"=== RUN   TestPendingEnrollmentCannotHideExistingFactor\n"}
+{"Time":"2026-10-18T09:12:47.616921638Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor"}
+{"Time":"2026-10-18T09:12:47.61693658Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor","Output":"=== RUN   TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor\n"}
+{"Time":"2026-10-18T09:12:47.617274832Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor","Output":"--- PASS: TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.617291749Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/existing_verified_factor","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.617315807Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain"}
+{"Time":"2026-10-18T09:12:47.617320694Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain","Output":"=== RUN   TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain\n"}
+{"Time":"2026-10-18T09:12:47.617656713Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain","Output":"--- PASS: TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.617679265Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor/unseen_page_is_uncertain","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.617687137Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor","Output":"--- PASS: TestPendingEnrollmentCannotHideExistingFactor (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.617696686Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPendingEnrollmentCannotHideExistingFactor","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.617703404Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2"}
+{"Time":"2026-10-18T09:12:47.617709031Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2\n"}
+{"Time":"2026-10-18T09:12:47.618136291Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough"}
+{"Time":"2026-10-18T09:12:47.618173163Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/password_passthrough\n"}
+{"Time":"2026-10-18T09:12:47.618699464Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/password_passthrough (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.618724054Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/password_passthrough","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.618750375Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token"}
+{"Time":"2026-10-18T09:12:47.618755876Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/static_password_token\n"}
+{"Time":"2026-10-18T09:12:47.619054292Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/static_password_token (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.61908175Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/static_password_token","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.619250908Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial"}
+{"Time":"2026-10-18T09:12:47.619272423Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/missing_serial\n"}
+{"Time":"2026-10-18T09:12:47.620052965Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/missing_serial (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.620109413Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_serial","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.62012027Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial"}
+{"Time":"2026-10-18T09:12:47.620124706Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/blank_serial\n"}
+{"Time":"2026-10-18T09:12:47.620520753Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/blank_serial (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.620543909Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/blank_serial","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.620620926Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type"}
+{"Time":"2026-10-18T09:12:47.620631683Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/missing_factor_type\n"}
+{"Time":"2026-10-18T09:12:47.62099928Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/missing_factor_type (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.621033113Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/missing_factor_type","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.621238878Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type"}
+{"Time":"2026-10-18T09:12:47.62125785Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type\n"}
+{"Time":"2026-10-18T09:12:47.621550947Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.621578819Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/unknown_factor_type","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.621586745Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed"}
+{"Time":"2026-10-18T09:12:47.621590857Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed\n"}
+{"Time":"2026-10-18T09:12:47.621869842Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.621883349Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/TOTP_confirmed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.621890239Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed"}
+{"Time":"2026-10-18T09:12:47.621894224Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed","Output":"=== RUN   TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed\n"}
+{"Time":"2026-10-18T09:12:47.622295952Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.62231147Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2/HOTP_confirmed","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.622499264Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2","Output":"--- PASS: TestPasswordPassthroughCannotGrantAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.622511762Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestPasswordPassthroughCannotGrantAAL2","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.62251838Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses"}
+{"Time":"2026-10-18T09:12:47.622522312Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses\n"}
+{"Time":"2026-10-18T09:12:47.6227044Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}"}
+{"Time":"2026-10-18T09:12:47.622723922Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{}\n"}
+{"Time":"2026-10-18T09:12:47.622899626Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.623021566Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.623362166Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}"}
+{"Time":"2026-10-18T09:12:47.623379984Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}\n"}
+{"Time":"2026-10-18T09:12:47.623650646Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.623686327Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[{}],\"count\":1}}}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.623696255Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}"}
+{"Time":"2026-10-18T09:12:47.623701251Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}\n"}
+{"Time":"2026-10-18T09:12:47.624151247Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.624178209Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":false,\"value\":{\"tokens\":[],\"count\":0}}}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.624186992Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}"}
+{"Time":"2026-10-18T09:12:47.624191798Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}\n"}
+{"Time":"2026-10-18T09:12:47.624558755Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.624576474Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"count\":0}}}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.624722972Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}"}
+{"Time":"2026-10-18T09:12:47.624742314Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}\n"}
+{"Time":"2026-10-18T09:12:47.625084289Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.625121783Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[]}}}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.625134506Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}"}
+{"Time":"2026-10-18T09:12:47.62513897Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}\n"}
+{"Time":"2026-10-18T09:12:47.625405384Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.625434339Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":null,\"count\":0}}}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.625442923Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}"}
+{"Time":"2026-10-18T09:12:47.625447351Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}\n"}
+{"Time":"2026-10-18T09:12:47.625761557Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.625775696Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":1}}}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.625860746Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}"}
+{"Time":"2026-10-18T09:12:47.62587099Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}","Output":"=== RUN   TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}\n"}
+{"Time":"2026-10-18T09:12:47.626247812Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}} (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.626268912Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses/{\"result\":{\"status\":true,\"value\":{\"tokens\":[],\"count\":-1}}}","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.62628251Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses","Output":"--- PASS: TestEnrollmentLookupRejectsIndeterminateResponses (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.626389004Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupRejectsIndeterminateResponses","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.626427886Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination"}
+{"Time":"2026-10-18T09:12:47.626432665Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination","Output":"=== RUN   TestEnrollmentLookupFiltersBeforePagination\n"}
+{"Time":"2026-10-18T09:12:47.626679179Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination","Output":"--- PASS: TestEnrollmentLookupFiltersBeforePagination (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.62669495Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEnrollmentLookupFiltersBeforePagination","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.626702029Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope"}
+{"Time":"2026-10-18T09:12:47.626725302Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope\n"}
+{"Time":"2026-10-18T09:12:47.626815628Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible"}
+{"Time":"2026-10-18T09:12:47.626825763Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/scope_visible\n"}
+{"Time":"2026-10-18T09:12:47.627255138Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/scope_visible (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.627275291Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/scope_visible","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.627284318Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn"}
+{"Time":"2026-10-18T09:12:47.627288438Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn\n"}
+{"Time":"2026-10-18T09:12:47.627689868Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.62771619Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/permission_withdrawn","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.627724702Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user"}
+{"Time":"2026-10-18T09:12:47.62772876Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user\n"}
+{"Time":"2026-10-18T09:12:47.628104509Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.628123264Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/probe_assigned_to_a_user","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.62813698Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm"}
+{"Time":"2026-10-18T09:12:47.62814147Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm","Output":"=== RUN   TestEmptyFactorListRequiresLiveReaderScope/different_realm\n"}
+{"Time":"2026-10-18T09:12:47.628465902Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope/different_realm (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.628478508Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope/different_realm","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.628486028Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope","Output":"--- PASS: TestEmptyFactorListRequiresLiveReaderScope (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.628526137Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestEmptyFactorListRequiresLiveReaderScope","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.628623884Z","Action":"run","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor"}
+{"Time":"2026-10-18T09:12:47.628634723Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor","Output":"=== RUN   TestNoProbeConfigurationCannotMeanNoFactor\n"}
+{"Time":"2026-10-18T09:12:47.628887107Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor","Output":"--- PASS: TestNoProbeConfigurationCannotMeanNoFactor (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.628899415Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Test":"TestNoProbeConfigurationCannotMeanNoFactor","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.628913248Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:47.729826163Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart","Output":"--- PASS: TestUpstreamKeyRotationIsPickedUpWithoutRestart (0.24s)\n"}
+{"Time":"2026-10-18T09:12:47.729881728Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestUpstreamKeyRotationIsPickedUpWithoutRestart","Elapsed":0.24}
+{"Time":"2026-10-18T09:12:47.729894983Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable"}
+{"Time":"2026-10-18T09:12:47.729902503Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable","Output":"=== RUN   TestFailureReasonsAreDistinguishable\n"}
+{"Time":"2026-10-18T09:12:47.741241333Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch"}
+{"Time":"2026-10-18T09:12:47.741295554Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch","Output":"=== RUN   TestFailureReasonsAreDistinguishable/audience_mismatch\n"}
+{"Time":"2026-10-18T09:12:47.742193753Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch","Output":"--- PASS: TestFailureReasonsAreDistinguishable/audience_mismatch (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.742225232Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/audience_mismatch","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.7422381Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired"}
+{"Time":"2026-10-18T09:12:47.742245079Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired","Output":"=== RUN   TestFailureReasonsAreDistinguishable/expired\n"}
+{"Time":"2026-10-18T09:12:47.743214226Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired","Output":"--- PASS: TestFailureReasonsAreDistinguishable/expired (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.743246968Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/expired","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.743256319Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature"}
+{"Time":"2026-10-18T09:12:47.743261567Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature","Output":"=== RUN   TestFailureReasonsAreDistinguishable/signature\n"}
+{"Time":"2026-10-18T09:12:47.744445261Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature","Output":"--- PASS: TestFailureReasonsAreDistinguishable/signature (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.744528373Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/signature","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.744545253Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable"}
+{"Time":"2026-10-18T09:12:47.744552557Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable","Output":"=== RUN   TestFailureReasonsAreDistinguishable/keys_unavailable\n"}
+{"Time":"2026-10-18T09:12:47.744861831Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable","Output":"--- PASS: TestFailureReasonsAreDistinguishable/keys_unavailable (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.744881957Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/keys_unavailable","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.74489221Z","Action":"run","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch"}
+{"Time":"2026-10-18T09:12:47.744900497Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch","Output":"=== RUN   TestFailureReasonsAreDistinguishable/issuer_mismatch\n"}
+{"Time":"2026-10-18T09:12:47.746184631Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch","Output":"--- PASS: TestFailureReasonsAreDistinguishable/issuer_mismatch (0.00s)\n"}
+{"Time":"2026-10-18T09:12:47.746245435Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable/issuer_mismatch","Elapsed":0}
+{"Time":"2026-10-18T09:12:47.746414289Z","Action":"output","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable","Output":"--- PASS: TestFailureReasonsAreDistinguishable (0.02s)\n"}
+{"Time":"2026-10-18T09:12:47.746584923Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Test":"TestFailureReasonsAreDistinguishable","Elapsed":0.02}
+{"Time":"2026-10-18T09:12:47.746732117Z","Action":"output","Package":"keycape/internal/adapters/authelia","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:48.021692944Z","Action":"output","Package":"keycape/cmd/lldap-export","Output":"ok  \tkeycape/cmd/lldap-export\t1.037s\n"}
+{"Time":"2026-10-18T09:12:48.021747363Z","Action":"pass","Package":"keycape/cmd/lldap-export","Elapsed":1.037}
+{"Time":"2026-10-18T09:12:48.023226732Z","Action":"start","Package":"keycape/internal/adapters/tenantengine"}
+{"Time":"2026-10-18T09:12:48.047668186Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess"}
+{"Time":"2026-10-18T09:12:48.047741957Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess","Output":"=== RUN   TestRolesReturnsRolesOnSuccess\n"}
+{"Time":"2026-10-18T09:12:48.052991739Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess","Output":"--- PASS: TestRolesReturnsRolesOnSuccess (0.01s)\n"}
+{"Time":"2026-10-18T09:12:48.053115104Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesReturnsRolesOnSuccess","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:48.05313533Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200"}
+{"Time":"2026-10-18T09:12:48.053139811Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200","Output":"=== RUN   TestRolesFailsOpenOnNon200\n"}
+{"Time":"2026-10-18T09:12:48.055816829Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200","Output":"--- PASS: TestRolesFailsOpenOnNon200 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:48.055894341Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNon200","Elapsed":0}
+{"Time":"2026-10-18T09:12:48.056129047Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody"}
+{"Time":"2026-10-18T09:12:48.05615196Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody","Output":"=== RUN   TestRolesFailsOpenOnMalformedBody\n"}
+{"Time":"2026-10-18T09:12:48.060014679Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody","Output":"--- PASS: TestRolesFailsOpenOnMalformedBody (0.00s)\n"}
+{"Time":"2026-10-18T09:12:48.060060856Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnMalformedBody","Elapsed":0}
+{"Time":"2026-10-18T09:12:48.060067384Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure"}
+{"Time":"2026-10-18T09:12:48.060071902Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure","Output":"=== RUN   TestRolesFailsOpenOnConnectionFailure\n"}
+{"Time":"2026-10-18T09:12:48.061155775Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure","Output":"--- PASS: TestRolesFailsOpenOnConnectionFailure (0.00s)\n"}
+{"Time":"2026-10-18T09:12:48.061178445Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnConnectionFailure","Elapsed":0}
+{"Time":"2026-10-18T09:12:48.061254866Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout"}
+{"Time":"2026-10-18T09:12:48.061267562Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout","Output":"=== RUN   TestRolesFailsOpenOnTimeout\n"}
+{"Time":"2026-10-18T09:12:48.163782437Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout","Output":"--- PASS: TestRolesFailsOpenOnTimeout (0.10s)\n"}
+{"Time":"2026-10-18T09:12:48.163827154Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnTimeout","Elapsed":0.1}
+{"Time":"2026-10-18T09:12:48.163837857Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient"}
+{"Time":"2026-10-18T09:12:48.163841699Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient","Output":"=== RUN   TestRolesFailsOpenOnNilClient\n"}
+{"Time":"2026-10-18T09:12:48.164112342Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient","Output":"--- PASS: TestRolesFailsOpenOnNilClient (0.00s)\n"}
+{"Time":"2026-10-18T09:12:48.164125931Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnNilClient","Elapsed":0}
+{"Time":"2026-10-18T09:12:48.164192542Z","Action":"run","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL"}
+{"Time":"2026-10-18T09:12:48.164201334Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL","Output":"=== RUN   TestRolesFailsOpenOnEmptyBaseURL\n"}
+{"Time":"2026-10-18T09:12:48.164350172Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL","Output":"--- PASS: TestRolesFailsOpenOnEmptyBaseURL (0.00s)\n"}
+{"Time":"2026-10-18T09:12:48.164361913Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Test":"TestRolesFailsOpenOnEmptyBaseURL","Elapsed":0}
+{"Time":"2026-10-18T09:12:48.164448Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:48.365048988Z","Action":"output","Package":"keycape/internal/adapters/lldap","Output":"ok  \tkeycape/internal/adapters/lldap\t1.032s\n"}
+{"Time":"2026-10-18T09:12:48.36510403Z","Action":"pass","Package":"keycape/internal/adapters/lldap","Elapsed":1.032}
+{"Time":"2026-10-18T09:12:48.633698274Z","Action":"output","Package":"keycape/internal/adapters/privacyidea","Output":"ok  \tkeycape/internal/adapters/privacyidea\t1.057s\n"}
+{"Time":"2026-10-18T09:12:48.633800881Z","Action":"pass","Package":"keycape/internal/adapters/privacyidea","Elapsed":1.057}
+{"Time":"2026-10-18T09:12:48.752838597Z","Action":"output","Package":"keycape/internal/adapters/authelia","Output":"ok  \tkeycape/internal/adapters/authelia\t1.722s\n"}
+{"Time":"2026-10-18T09:12:48.752884964Z","Action":"pass","Package":"keycape/internal/adapters/authelia","Elapsed":1.722}
+{"Time":"2026-10-18T09:12:48.972927685Z","Action":"start","Package":"keycape/internal/authclient"}
+{"Time":"2026-10-18T09:12:48.992150981Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation"}
+{"Time":"2026-10-18T09:12:48.992203597Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation","Output":"=== RUN   TestServiceExchangeAndClaimValidation\n"}
+{"Time":"2026-10-18T09:12:49.169510619Z","Action":"output","Package":"keycape/internal/adapters/tenantengine","Output":"ok  \tkeycape/internal/adapters/tenantengine\t1.146s\n"}
+{"Time":"2026-10-18T09:12:49.169590737Z","Action":"pass","Package":"keycape/internal/adapters/tenantengine","Elapsed":1.146}
+{"Time":"2026-10-18T09:12:49.298839854Z","Action":"start","Package":"keycape/internal/config"}
+{"Time":"2026-10-18T09:12:49.315819319Z","Action":"run","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS"}
+{"Time":"2026-10-18T09:12:49.315875009Z","Action":"output","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS","Output":"=== RUN   TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS\n"}
+{"Time":"2026-10-18T09:12:49.315929915Z","Action":"output","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS","Output":"--- PASS: TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.315983288Z","Action":"pass","Package":"keycape/internal/config","Test":"TestAccountRecoveryDestinationsAreOwnerConfiguredHTTPS","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.316024398Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML"}
+{"Time":"2026-10-18T09:12:49.316037798Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML","Output":"=== RUN   TestLoad_ValidYAML\n"}
+{"Time":"2026-10-18T09:12:49.317440485Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML","Output":"--- PASS: TestLoad_ValidYAML (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.317499629Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_ValidYAML","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.317526347Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs"}
+{"Time":"2026-10-18T09:12:49.317539864Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs","Output":"=== RUN   TestLoad_AutheliaSplitURLs\n"}
+{"Time":"2026-10-18T09:12:49.319228257Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs","Output":"--- PASS: TestLoad_AutheliaSplitURLs (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.319284615Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_AutheliaSplitURLs","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.31930228Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL"}
+{"Time":"2026-10-18T09:12:49.319307916Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL","Output":"=== RUN   TestLoad_ClientMFAAndRegistrationURL\n"}
+{"Time":"2026-10-18T09:12:49.321457783Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL","Output":"--- PASS: TestLoad_ClientMFAAndRegistrationURL (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.321522825Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_ClientMFAAndRegistrationURL","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.321543943Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL"}
+{"Time":"2026-10-18T09:12:49.321549678Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL","Output":"=== RUN   TestValidate_InvalidRegistrationURL\n"}
+{"Time":"2026-10-18T09:12:49.322220688Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL","Output":"--- PASS: TestValidate_InvalidRegistrationURL (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.32225324Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_InvalidRegistrationURL","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.322335432Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll"}
+{"Time":"2026-10-18T09:12:49.322345532Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll","Output":"=== RUN   TestLoad_PrivacyIDEARequireForAll\n"}
+{"Time":"2026-10-18T09:12:49.323999663Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll","Output":"--- PASS: TestLoad_PrivacyIDEARequireForAll (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.324165346Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_PrivacyIDEARequireForAll","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.324187681Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits"}
+{"Time":"2026-10-18T09:12:49.324193957Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits","Output":"=== RUN   TestLoad_LLDAPOrganisationalUnits\n"}
+{"Time":"2026-10-18T09:12:49.325663147Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits","Output":"--- PASS: TestLoad_LLDAPOrganisationalUnits (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.32571422Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_LLDAPOrganisationalUnits","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.325729892Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound"}
+{"Time":"2026-10-18T09:12:49.325735384Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound","Output":"=== RUN   TestLoad_FileNotFound\n"}
+{"Time":"2026-10-18T09:12:49.326208627Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound","Output":"--- PASS: TestLoad_FileNotFound (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.326235453Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_FileNotFound","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.326268944Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML"}
+{"Time":"2026-10-18T09:12:49.326277699Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML","Output":"=== RUN   TestLoad_InvalidYAML\n"}
+{"Time":"2026-10-18T09:12:49.326911792Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML","Output":"--- PASS: TestLoad_InvalidYAML (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.326948979Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_InvalidYAML","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.326958601Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig"}
+{"Time":"2026-10-18T09:12:49.326963921Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig","Output":"=== RUN   TestValidate_ValidConfig\n"}
+{"Time":"2026-10-18T09:12:49.327524695Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig","Output":"--- PASS: TestValidate_ValidConfig (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.327565723Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ValidConfig","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.327722939Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer"}
+{"Time":"2026-10-18T09:12:49.327736176Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer","Output":"=== RUN   TestValidate_MissingIssuer\n"}
+{"Time":"2026-10-18T09:12:49.328146236Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer","Output":"--- PASS: TestValidate_MissingIssuer (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.328166281Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_MissingIssuer","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.328278573Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL"}
+{"Time":"2026-10-18T09:12:49.328294506Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL","Output":"=== RUN   TestValidate_InvalidIssuerURL\n"}
+{"Time":"2026-10-18T09:12:49.328718317Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL","Output":"--- PASS: TestValidate_InvalidIssuerURL (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.328738299Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_InvalidIssuerURL","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.328818336Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_PortZero"}
+{"Time":"2026-10-18T09:12:49.328837074Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortZero","Output":"=== RUN   TestValidate_PortZero\n"}
+{"Time":"2026-10-18T09:12:49.329356323Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortZero","Output":"--- PASS: TestValidate_PortZero (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.32938681Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_PortZero","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.329396306Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh"}
+{"Time":"2026-10-18T09:12:49.329400995Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh","Output":"=== RUN   TestValidate_PortTooHigh\n"}
+{"Time":"2026-10-18T09:12:49.329924311Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh","Output":"--- PASS: TestValidate_PortTooHigh (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.329957242Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_PortTooHigh","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.329965339Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_NoClients"}
+{"Time":"2026-10-18T09:12:49.329970181Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_NoClients","Output":"=== RUN   TestValidate_NoClients\n"}
+{"Time":"2026-10-18T09:12:49.330450647Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_NoClients","Output":"--- PASS: TestValidate_NoClients (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.330482776Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_NoClients","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.330502073Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI"}
+{"Time":"2026-10-18T09:12:49.33050815Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI","Output":"=== RUN   TestValidate_ClientMissingRedirectURI\n"}
+{"Time":"2026-10-18T09:12:49.331340659Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI","Output":"--- PASS: TestValidate_ClientMissingRedirectURI (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.331378793Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ClientMissingRedirectURI","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.331395231Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM"}
+{"Time":"2026-10-18T09:12:49.331435601Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM","Output":"=== RUN   TestValidate_MissingPrivateKeyPEM\n"}
+{"Time":"2026-10-18T09:12:49.331460074Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM","Output":"--- PASS: TestValidate_MissingPrivateKeyPEM (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.331507902Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_MissingPrivateKeyPEM","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.331522437Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime"}
+{"Time":"2026-10-18T09:12:49.331527658Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime","Output":"=== RUN   TestValidate_ClientCredentialsTokenLifetime\n"}
+{"Time":"2026-10-18T09:12:49.33210625Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime","Output":"--- PASS: TestValidate_ClientCredentialsTokenLifetime (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.332162959Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ClientCredentialsTokenLifetime","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.332174799Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime"}
+{"Time":"2026-10-18T09:12:49.332180651Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime","Output":"=== RUN   TestValidate_PublicClientRejectsTokenLifetime\n"}
+{"Time":"2026-10-18T09:12:49.332634029Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime","Output":"--- PASS: TestValidate_PublicClientRejectsTokenLifetime (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.332666509Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_PublicClientRejectsTokenLifetime","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.332676915Z","Action":"run","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts"}
+{"Time":"2026-10-18T09:12:49.332681298Z","Action":"output","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts","Output":"=== RUN   TestServiceClientExampleContracts\n"}
+{"Time":"2026-10-18T09:12:49.340611304Z","Action":"output","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts","Output":"--- PASS: TestServiceClientExampleContracts (0.01s)\n"}
+{"Time":"2026-10-18T09:12:49.340665624Z","Action":"pass","Package":"keycape/internal/config","Test":"TestServiceClientExampleContracts","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:49.340679429Z","Action":"run","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback"}
+{"Time":"2026-10-18T09:12:49.340683541Z","Action":"output","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback","Output":"=== RUN   TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback\n"}
+{"Time":"2026-10-18T09:12:49.345354031Z","Action":"output","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback","Output":"--- PASS: TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.345408487Z","Action":"pass","Package":"keycape/internal/config","Test":"TestDevConfigOpenBaoAdminAdmitsOperatorTunnelCallback","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.34541873Z","Action":"run","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar"}
+{"Time":"2026-10-18T09:12:49.345423158Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar","Output":"=== RUN   TestLoad_FromEnvVar\n"}
+{"Time":"2026-10-18T09:12:49.347017786Z","Action":"output","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar","Output":"--- PASS: TestLoad_FromEnvVar (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.347066299Z","Action":"pass","Package":"keycape/internal/config","Test":"TestLoad_FromEnvVar","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.347104784Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidateConfigAudience"}
+{"Time":"2026-10-18T09:12:49.347118148Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidateConfigAudience","Output":"=== RUN   TestValidateConfigAudience\n"}
+{"Time":"2026-10-18T09:12:49.347510279Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidateConfigAudience","Output":"--- PASS: TestValidateConfigAudience (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.34755844Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidateConfigAudience","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.347574707Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine"}
+{"Time":"2026-10-18T09:12:49.347579892Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine","Output":"=== RUN   TestValidate_TenantEngine\n"}
+{"Time":"2026-10-18T09:12:49.347585077Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid"}
+{"Time":"2026-10-18T09:12:49.347589171Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid","Output":"=== RUN   TestValidate_TenantEngine/absent_is_valid\n"}
+{"Time":"2026-10-18T09:12:49.348217574Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid","Output":"--- PASS: TestValidate_TenantEngine/absent_is_valid (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.348251515Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/absent_is_valid","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.348263769Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url"}
+{"Time":"2026-10-18T09:12:49.34826835Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url","Output":"=== RUN   TestValidate_TenantEngine/http_url\n"}
+{"Time":"2026-10-18T09:12:49.348738735Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url","Output":"--- PASS: TestValidate_TenantEngine/http_url (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.348783731Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/http_url","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.348793776Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url"}
+{"Time":"2026-10-18T09:12:49.348798104Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url","Output":"=== RUN   TestValidate_TenantEngine/not_a_url\n"}
+{"Time":"2026-10-18T09:12:49.349467437Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url","Output":"--- PASS: TestValidate_TenantEngine/not_a_url (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.349511937Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/not_a_url","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.349528727Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout"}
+{"Time":"2026-10-18T09:12:49.3495354Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout","Output":"=== RUN   TestValidate_TenantEngine/zero_timeout\n"}
+{"Time":"2026-10-18T09:12:49.350009662Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout","Output":"--- PASS: TestValidate_TenantEngine/zero_timeout (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.350034712Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/zero_timeout","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.350051105Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long"}
+{"Time":"2026-10-18T09:12:49.350055839Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long","Output":"=== RUN   TestValidate_TenantEngine/timeout_far_too_long\n"}
+{"Time":"2026-10-18T09:12:49.350508171Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long","Output":"--- PASS: TestValidate_TenantEngine/timeout_far_too_long (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.350532806Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_far_too_long","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.350552581Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout"}
+{"Time":"2026-10-18T09:12:49.35055764Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout","Output":"=== RUN   TestValidate_TenantEngine/https_url_and_timeout\n"}
+{"Time":"2026-10-18T09:12:49.351061001Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout","Output":"--- PASS: TestValidate_TenantEngine/https_url_and_timeout (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.351094869Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/https_url_and_timeout","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.351114879Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme"}
+{"Time":"2026-10-18T09:12:49.35112303Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme","Output":"=== RUN   TestValidate_TenantEngine/wrong_scheme\n"}
+{"Time":"2026-10-18T09:12:49.35170623Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme","Output":"--- PASS: TestValidate_TenantEngine/wrong_scheme (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.35175027Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/wrong_scheme","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.351763562Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout"}
+{"Time":"2026-10-18T09:12:49.351767917Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout","Output":"=== RUN   TestValidate_TenantEngine/unparseable_timeout\n"}
+{"Time":"2026-10-18T09:12:49.352225118Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout","Output":"--- PASS: TestValidate_TenantEngine/unparseable_timeout (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.352248626Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/unparseable_timeout","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.352265507Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url"}
+{"Time":"2026-10-18T09:12:49.352270421Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url","Output":"=== RUN   TestValidate_TenantEngine/timeout_without_url\n"}
+{"Time":"2026-10-18T09:12:49.352828192Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url","Output":"--- PASS: TestValidate_TenantEngine/timeout_without_url (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.352867922Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine/timeout_without_url","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.352881078Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine","Output":"--- PASS: TestValidate_TenantEngine (0.01s)\n"}
+{"Time":"2026-10-18T09:12:49.353021585Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_TenantEngine","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:49.353037338Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients"}
+{"Time":"2026-10-18T09:12:49.353043876Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients\n"}
+{"Time":"2026-10-18T09:12:49.353234618Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject"}
+{"Time":"2026-10-18T09:12:49.353250758Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject\n"}
+{"Time":"2026-10-18T09:12:49.353717103Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.353744813Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/serviceSubject","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.353893553Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles"}
+{"Time":"2026-10-18T09:12:49.353913364Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles\n"}
+{"Time":"2026-10-18T09:12:49.354516149Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.354556853Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/roles","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.354577962Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client"}
+{"Time":"2026-10-18T09:12:49.354586889Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client\n"}
+{"Time":"2026-10-18T09:12:49.355263408Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.355309604Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/implicit_authorization_code_client","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.35533074Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client"}
+{"Time":"2026-10-18T09:12:49.355350731Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client\n"}
+{"Time":"2026-10-18T09:12:49.356093844Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.356141708Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/tenant_is_allowed_on_a_browser_client","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.356158435Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected"}
+{"Time":"2026-10-18T09:12:49.356178327Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected","Output":"=== RUN   TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected\n"}
+{"Time":"2026-10-18T09:12:49.356726378Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.356760455Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients/service_clients_unaffected","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.356829761Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients","Output":"--- PASS: TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.356948428Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_ServiceIdentityFieldsRejectedOnBrowserClients","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.356966715Z","Action":"run","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID"}
+{"Time":"2026-10-18T09:12:49.356970998Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID","Output":"=== RUN   TestValidate_DuplicateClientID\n"}
+{"Time":"2026-10-18T09:12:49.357425152Z","Action":"output","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID","Output":"--- PASS: TestValidate_DuplicateClientID (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.357493485Z","Action":"pass","Package":"keycape/internal/config","Test":"TestValidate_DuplicateClientID","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.357589672Z","Action":"run","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration"}
+{"Time":"2026-10-18T09:12:49.357598031Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration","Output":"=== RUN   TestOptionalMFALoadAndRegistration\n"}
+{"Time":"2026-10-18T09:12:49.358481748Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration","Output":"--- PASS: TestOptionalMFALoadAndRegistration (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.358525987Z","Action":"pass","Package":"keycape/internal/config","Test":"TestOptionalMFALoadAndRegistration","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.35853789Z","Action":"run","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation"}
+{"Time":"2026-10-18T09:12:49.358542452Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation","Output":"=== RUN   TestOptionalMFAValidation\n"}
+{"Time":"2026-10-18T09:12:49.359291137Z","Action":"output","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation","Output":"--- PASS: TestOptionalMFAValidation (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.359321768Z","Action":"pass","Package":"keycape/internal/config","Test":"TestOptionalMFAValidation","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.359328324Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS"}
+{"Time":"2026-10-18T09:12:49.35933249Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS\n"}
+{"Time":"2026-10-18T09:12:49.359550139Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy"}
+{"Time":"2026-10-18T09:12:49.359567741Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy\n"}
+{"Time":"2026-10-18T09:12:49.359607579Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.359832532Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/legacy","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.359851189Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default"}
+{"Time":"2026-10-18T09:12:49.359855319Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default\n"}
+{"Time":"2026-10-18T09:12:49.359863867Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.360023382Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-default","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.360038432Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded"}
+{"Time":"2026-10-18T09:12:49.360051904Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded\n"}
+{"Time":"2026-10-18T09:12:49.360211644Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.360226875Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/enabled-bounded","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.360246117Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http"}
+{"Time":"2026-10-18T09:12:49.360252754Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http\n"}
+{"Time":"2026-10-18T09:12:49.360485903Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.360518158Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/http","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.360534776Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url"}
+{"Time":"2026-10-18T09:12:49.360539979Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url\n"}
+{"Time":"2026-10-18T09:12:49.36075056Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.360773843Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/userinfo-url","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.360792058Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query"}
+{"Time":"2026-10-18T09:12:49.360801264Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query\n"}
+{"Time":"2026-10-18T09:12:49.36100124Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.36102069Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/query","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.361143487Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large"}
+{"Time":"2026-10-18T09:12:49.361157815Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large\n"}
+{"Time":"2026-10-18T09:12:49.361366276Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.361386529Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/too-large","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.36139624Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative"}
+{"Time":"2026-10-18T09:12:49.361401407Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative\n"}
+{"Time":"2026-10-18T09:12:49.361621473Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.361649598Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/negative","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.361665748Z","Action":"run","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity"}
+{"Time":"2026-10-18T09:12:49.361680401Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity","Output":"=== RUN   TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity\n"}
+{"Time":"2026-10-18T09:12:49.361869745Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.361884795Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS/disabled-capacity","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.361974074Z","Action":"output","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS","Output":"--- PASS: TestTokenStatusConfigIsExplicitBoundedAndHTTPS (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.36200825Z","Action":"pass","Package":"keycape/internal/config","Test":"TestTokenStatusConfigIsExplicitBoundedAndHTTPS","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.362135023Z","Action":"output","Package":"keycape/internal/config","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:49.481436276Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation","Output":"--- PASS: TestServiceExchangeAndClaimValidation (0.49s)\n"}
+{"Time":"2026-10-18T09:12:49.481541697Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestServiceExchangeAndClaimValidation","Elapsed":0.49}
+{"Time":"2026-10-18T09:12:49.482322004Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState"}
+{"Time":"2026-10-18T09:12:49.482369327Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState","Output":"=== RUN   TestBrowserLoginPKCEAndState\n"}
+{"Time":"2026-10-18T09:12:49.522626137Z","Action":"start","Package":"keycape/internal/domain"}
+{"Time":"2026-10-18T09:12:49.543401455Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient"}
+{"Time":"2026-10-18T09:12:49.543511934Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient","Output":"=== RUN   TestDecideAssurance_ClientOverrideIsPerClient\n"}
+{"Time":"2026-10-18T09:12:49.543566399Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient","Output":"--- PASS: TestDecideAssurance_ClientOverrideIsPerClient (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.543656526Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ClientOverrideIsPerClient","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.543671819Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1"}
+{"Time":"2026-10-18T09:12:49.543676977Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1","Output":"=== RUN   TestDecideAssurance_ACRRaisesClientAAL1\n"}
+{"Time":"2026-10-18T09:12:49.543889072Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1","Output":"--- PASS: TestDecideAssurance_ACRRaisesClientAAL1 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.543904672Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_ACRRaisesClientAAL1","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.543922219Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2"}
+{"Time":"2026-10-18T09:12:49.543926674Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2","Output":"=== RUN   TestDecideAssurance_AAL1SessionCannotSatisfyAAL2\n"}
+{"Time":"2026-10-18T09:12:49.544127776Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2","Output":"--- PASS: TestDecideAssurance_AAL1SessionCannotSatisfyAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.5441416Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL1SessionCannotSatisfyAAL2","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.544219644Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance"}
+{"Time":"2026-10-18T09:12:49.544229599Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance","Output":"=== RUN   TestDecideAssurance_AAL2SessionSatisfiesHighAssurance\n"}
+{"Time":"2026-10-18T09:12:49.544443768Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance","Output":"--- PASS: TestDecideAssurance_AAL2SessionSatisfiesHighAssurance (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.544466582Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_AAL2SessionSatisfiesHighAssurance","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.544496916Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession"}
+{"Time":"2026-10-18T09:12:49.544502028Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession","Output":"=== RUN   TestDecideAssurance_MaxAgeInvalidatesSession\n"}
+{"Time":"2026-10-18T09:12:49.544745569Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession","Output":"--- PASS: TestDecideAssurance_MaxAgeInvalidatesSession (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.544772098Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_MaxAgeInvalidatesSession","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.544779573Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession"}
+{"Time":"2026-10-18T09:12:49.544803712Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession","Output":"=== RUN   TestDecideAssurance_PromptLoginIgnoresSession\n"}
+{"Time":"2026-10-18T09:12:49.544929608Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession","Output":"--- PASS: TestDecideAssurance_PromptLoginIgnoresSession (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.544948968Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_PromptLoginIgnoresSession","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.544957544Z","Action":"run","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored"}
+{"Time":"2026-10-18T09:12:49.544962684Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored","Output":"=== RUN   TestDecideAssurance_SessionUserMismatchIgnored\n"}
+{"Time":"2026-10-18T09:12:49.545166323Z","Action":"output","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored","Output":"--- PASS: TestDecideAssurance_SessionUserMismatchIgnored (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.545183312Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestDecideAssurance_SessionUserMismatchIgnored","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.545191644Z","Action":"run","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2"}
+{"Time":"2026-10-18T09:12:49.545197144Z","Action":"output","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2","Output":"=== RUN   TestACRRequiresAAL2\n"}
+{"Time":"2026-10-18T09:12:49.545336821Z","Action":"output","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2","Output":"--- PASS: TestACRRequiresAAL2 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.545362754Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestACRRequiresAAL2","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.545380591Z","Action":"run","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient"}
+{"Time":"2026-10-18T09:12:49.545385478Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient","Output":"=== RUN   TestCanonicalModelMatchesRuntimeClient\n"}
+{"Time":"2026-10-18T09:12:49.557611257Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient","Output":"--- PASS: TestCanonicalModelMatchesRuntimeClient (0.01s)\n"}
+{"Time":"2026-10-18T09:12:49.557659138Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeClient","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:49.55766912Z","Action":"run","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities"}
+{"Time":"2026-10-18T09:12:49.557677416Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities","Output":"=== RUN   TestCanonicalModelMatchesRuntimeDirectoryEntities\n"}
+{"Time":"2026-10-18T09:12:49.565798874Z","Action":"output","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities","Output":"--- PASS: TestCanonicalModelMatchesRuntimeDirectoryEntities (0.01s)\n"}
+{"Time":"2026-10-18T09:12:49.565868668Z","Action":"pass","Package":"keycape/internal/domain","Test":"TestCanonicalModelMatchesRuntimeDirectoryEntities","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:49.565884908Z","Action":"output","Package":"keycape/internal/domain","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:49.60999874Z","Action":"start","Package":"keycape/internal/errors"}
+{"Time":"2026-10-18T09:12:49.628000105Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants"}
+{"Time":"2026-10-18T09:12:49.628049006Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants","Output":"=== RUN   TestErrorTypeConstants\n"}
+{"Time":"2026-10-18T09:12:49.628091928Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported"}
+{"Time":"2026-10-18T09:12:49.628113118Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported","Output":"=== RUN   TestErrorTypeConstants/FeatureNotSupported\n"}
+{"Time":"2026-10-18T09:12:49.628409209Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported","Output":"--- PASS: TestErrorTypeConstants/FeatureNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.62856757Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/FeatureNotSupported","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.628583215Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly"}
+{"Time":"2026-10-18T09:12:49.628588075Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly","Output":"=== RUN   TestErrorTypeConstants/KeycloakModeOnly\n"}
+{"Time":"2026-10-18T09:12:49.628930548Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly","Output":"--- PASS: TestErrorTypeConstants/KeycloakModeOnly (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.628966824Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/KeycloakModeOnly","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.628987817Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety"}
+{"Time":"2026-10-18T09:12:49.629000233Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety","Output":"=== RUN   TestErrorTypeConstants/RejectedForSafety\n"}
+{"Time":"2026-10-18T09:12:49.629231173Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety","Output":"--- PASS: TestErrorTypeConstants/RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.629262661Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.629279262Z","Action":"run","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage"}
+{"Time":"2026-10-18T09:12:49.629288649Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage","Output":"=== RUN   TestErrorTypeConstants/InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:12:49.629605543Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage","Output":"--- PASS: TestErrorTypeConstants/InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.62963484Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants/InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.629826331Z","Action":"output","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants","Output":"--- PASS: TestErrorTypeConstants (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.629847828Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestErrorTypeConstants","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.62986928Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers"}
+{"Time":"2026-10-18T09:12:49.629879054Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers","Output":"=== RUN   TestConstructorHelpers\n"}
+{"Time":"2026-10-18T09:12:49.629948523Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported"}
+{"Time":"2026-10-18T09:12:49.629968551Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported","Output":"=== RUN   TestConstructorHelpers/FeatureNotSupported\n"}
+{"Time":"2026-10-18T09:12:49.630292323Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported","Output":"--- PASS: TestConstructorHelpers/FeatureNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.630335191Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/FeatureNotSupported","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.630385507Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly"}
+{"Time":"2026-10-18T09:12:49.630396697Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly","Output":"=== RUN   TestConstructorHelpers/KeycloakModeOnly\n"}
+{"Time":"2026-10-18T09:12:49.630575897Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly","Output":"--- PASS: TestConstructorHelpers/KeycloakModeOnly (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.630619577Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/KeycloakModeOnly","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.630798064Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety"}
+{"Time":"2026-10-18T09:12:49.630817226Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety","Output":"=== RUN   TestConstructorHelpers/RejectedForSafety\n"}
+{"Time":"2026-10-18T09:12:49.631077681Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety","Output":"--- PASS: TestConstructorHelpers/RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.63110072Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.631108385Z","Action":"run","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage"}
+{"Time":"2026-10-18T09:12:49.631124778Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage","Output":"=== RUN   TestConstructorHelpers/InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:12:49.631176618Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage","Output":"--- PASS: TestConstructorHelpers/InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.631316978Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers/InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.631353462Z","Action":"output","Package":"keycape/internal/errors","Test":"TestConstructorHelpers","Output":"--- PASS: TestConstructorHelpers (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.631368503Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestConstructorHelpers","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.631377006Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON"}
+{"Time":"2026-10-18T09:12:49.631382372Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON","Output":"=== RUN   TestProfileErrorJSON\n"}
+{"Time":"2026-10-18T09:12:49.631972815Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON","Output":"--- PASS: TestProfileErrorJSON (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.632012878Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorJSON","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.632027648Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty"}
+{"Time":"2026-10-18T09:12:49.632032112Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty","Output":"=== RUN   TestProfileErrorOmitsFeatureWhenEmpty\n"}
+{"Time":"2026-10-18T09:12:49.632276407Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty","Output":"--- PASS: TestProfileErrorOmitsFeatureWhenEmpty (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.632394362Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorOmitsFeatureWhenEmpty","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.632452685Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite"}
+{"Time":"2026-10-18T09:12:49.632491523Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite","Output":"=== RUN   TestProfileErrorWrite\n"}
+{"Time":"2026-10-18T09:12:49.632784646Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite","Output":"--- PASS: TestProfileErrorWrite (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.632812879Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorWrite","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.632852195Z","Action":"run","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError"}
+{"Time":"2026-10-18T09:12:49.63285939Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError","Output":"=== RUN   TestProfileErrorGoError\n"}
+{"Time":"2026-10-18T09:12:49.633110981Z","Action":"output","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError","Output":"--- PASS: TestProfileErrorGoError (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.633132595Z","Action":"pass","Package":"keycape/internal/errors","Test":"TestProfileErrorGoError","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.633145968Z","Action":"output","Package":"keycape/internal/errors","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:49.677617993Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState","Output":"--- PASS: TestBrowserLoginPKCEAndState (0.20s)\n"}
+{"Time":"2026-10-18T09:12:49.677668445Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestBrowserLoginPKCEAndState","Elapsed":0.2}
+{"Time":"2026-10-18T09:12:49.67767812Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks"}
+{"Time":"2026-10-18T09:12:49.677684035Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks","Output":"=== RUN   TestLoginRejectsUnsafeCallbacks\n"}
+{"Time":"2026-10-18T09:12:49.8019614Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks","Output":"--- PASS: TestLoginRejectsUnsafeCallbacks (0.12s)\n"}
+{"Time":"2026-10-18T09:12:49.802011473Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestLoginRejectsUnsafeCallbacks","Elapsed":0.12}
+{"Time":"2026-10-18T09:12:49.802022997Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOutputProtection"}
+{"Time":"2026-10-18T09:12:49.802032898Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOutputProtection","Output":"=== RUN   TestOutputProtection\n"}
+{"Time":"2026-10-18T09:12:49.802694909Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOutputProtection","Output":"--- PASS: TestOutputProtection (0.00s)\n"}
+{"Time":"2026-10-18T09:12:49.802728786Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOutputProtection","Elapsed":0}
+{"Time":"2026-10-18T09:12:49.802740175Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries"}
+{"Time":"2026-10-18T09:12:49.802766641Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries","Output":"=== RUN   TestDiscoveryAndRedirectBoundaries\n"}
+{"Time":"2026-10-18T09:12:49.815720992Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries","Output":"--- PASS: TestDiscoveryAndRedirectBoundaries (0.01s)\n"}
+{"Time":"2026-10-18T09:12:49.81576854Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestDiscoveryAndRedirectBoundaries","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:49.815778675Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin"}
+{"Time":"2026-10-18T09:12:49.815791308Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin","Output":"=== RUN   TestNonceMismatchAndCancelledLogin\n"}
+{"Time":"2026-10-18T09:12:49.884002455Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin","Output":"--- PASS: TestNonceMismatchAndCancelledLogin (0.07s)\n"}
+{"Time":"2026-10-18T09:12:49.884127434Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestNonceMismatchAndCancelledLogin","Elapsed":0.07}
+{"Time":"2026-10-18T09:12:49.884266083Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet"}
+{"Time":"2026-10-18T09:12:49.884275272Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet","Output":"=== RUN   TestVerifyRejectsForeignSignatureAndUnusableKeySet\n"}
+{"Time":"2026-10-18T09:12:50.160091412Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet","Output":"--- PASS: TestVerifyRejectsForeignSignatureAndUnusableKeySet (0.28s)\n"}
+{"Time":"2026-10-18T09:12:50.160140313Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyRejectsForeignSignatureAndUnusableKeySet","Elapsed":0.28}
+{"Time":"2026-10-18T09:12:50.160262576Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation"}
+{"Time":"2026-10-18T09:12:50.160284497Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"=== RUN   TestOnlineCLIUsesActualProducerAndPrivateObservation\n"}
+{"Time":"2026-10-18T09:12:50.354957256Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Output":"--- PASS: TestOnlineCLIUsesActualProducerAndPrivateObservation (0.19s)\n"}
+{"Time":"2026-10-18T09:12:50.355014858Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIUsesActualProducerAndPrivateObservation","Elapsed":0.19}
+{"Time":"2026-10-18T09:12:50.355185579Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput"}
+{"Time":"2026-10-18T09:12:50.355204876Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput\n"}
+{"Time":"2026-10-18T09:12:50.355498388Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash"}
+{"Time":"2026-10-18T09:12:50.355534123Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash\n"}
+{"Time":"2026-10-18T09:12:50.366770432Z","Action":"output","Package":"keycape/internal/config","Output":"ok  \tkeycape/internal/config\t1.068s\n"}
+{"Time":"2026-10-18T09:12:50.366832281Z","Action":"pass","Package":"keycape/internal/config","Elapsed":1.068}
+{"Time":"2026-10-18T09:12:50.36890982Z","Action":"start","Package":"keycape/internal/jose"}
+{"Time":"2026-10-18T09:12:50.400111574Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash (0.04s)\n"}
+{"Time":"2026-10-18T09:12:50.400159348Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/wrong-hash","Elapsed":0.04}
+{"Time":"2026-10-18T09:12:50.400169213Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag"}
+{"Time":"2026-10-18T09:12:50.400175236Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag\n"}
+{"Time":"2026-10-18T09:12:50.418486897Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag (0.02s)\n"}
+{"Time":"2026-10-18T09:12:50.418570271Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-flag","Elapsed":0.02}
+{"Time":"2026-10-18T09:12:50.418585059Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced"}
+{"Time":"2026-10-18T09:12:50.418593201Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced\n"}
+{"Time":"2026-10-18T09:12:50.422429815Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims"}
+{"Time":"2026-10-18T09:12:50.422478878Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims","Output":"=== RUN   TestVerifyAcceptsGenuineTokenAndReturnsClaims\n"}
+{"Time":"2026-10-18T09:12:50.425796815Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims","Output":"--- PASS: TestVerifyAcceptsGenuineTokenAndReturnsClaims (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.425853831Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyAcceptsGenuineTokenAndReturnsClaims","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.425865697Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections"}
+{"Time":"2026-10-18T09:12:50.425873515Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections","Output":"=== RUN   TestVerifyRejections\n"}
+{"Time":"2026-10-18T09:12:50.541210996Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced (0.12s)\n"}
+{"Time":"2026-10-18T09:12:50.541259121Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/token-replaced","Elapsed":0.12}
+{"Time":"2026-10-18T09:12:50.541269473Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission"}
+{"Time":"2026-10-18T09:12:50.541275659Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission\n"}
+{"Time":"2026-10-18T09:12:50.549739334Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments"}
+{"Time":"2026-10-18T09:12:50.549804934Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments","Output":"=== RUN   TestVerifyRejections/two_segments\n"}
+{"Time":"2026-10-18T09:12:50.549830669Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments","Output":"--- PASS: TestVerifyRejections/two_segments (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.550051564Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/two_segments","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.550073684Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json"}
+{"Time":"2026-10-18T09:12:50.550081457Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json","Output":"=== RUN   TestVerifyRejections/payload_not_json\n"}
+{"Time":"2026-10-18T09:12:50.550496824Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json","Output":"--- PASS: TestVerifyRejections/payload_not_json (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.550522793Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/payload_not_json","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.550539854Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty"}
+{"Time":"2026-10-18T09:12:50.550570395Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty","Output":"=== RUN   TestVerifyRejections/empty\n"}
+{"Time":"2026-10-18T09:12:50.550734329Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty","Output":"--- PASS: TestVerifyRejections/empty (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.550755231Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/empty","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.550771029Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id"}
+{"Time":"2026-10-18T09:12:50.550776214Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id","Output":"=== RUN   TestVerifyRejections/missing_key_id\n"}
+{"Time":"2026-10-18T09:12:50.551094884Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id","Output":"--- PASS: TestVerifyRejections/missing_key_id (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.551116182Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/missing_key_id","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.551140763Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none"}
+{"Time":"2026-10-18T09:12:50.551153072Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none","Output":"=== RUN   TestVerifyRejections/alg_none\n"}
+{"Time":"2026-10-18T09:12:50.551402922Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none","Output":"--- PASS: TestVerifyRejections/alg_none (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.551426773Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_none","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.551612329Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256"}
+{"Time":"2026-10-18T09:12:50.551637037Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256","Output":"=== RUN   TestVerifyRejections/alg_HS256\n"}
+{"Time":"2026-10-18T09:12:50.551878915Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256","Output":"--- PASS: TestVerifyRejections/alg_HS256 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.551917906Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/alg_HS256","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.551995193Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload"}
+{"Time":"2026-10-18T09:12:50.552008845Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload","Output":"=== RUN   TestVerifyRejections/tampered_payload\n"}
+{"Time":"2026-10-18T09:12:50.552491475Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload","Output":"--- PASS: TestVerifyRejections/tampered_payload (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.5525096Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/tampered_payload","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.552660954Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key"}
+{"Time":"2026-10-18T09:12:50.552678502Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key","Output":"=== RUN   TestVerifyRejections/wrong_signing_key\n"}
+{"Time":"2026-10-18T09:12:50.553067425Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key","Output":"--- PASS: TestVerifyRejections/wrong_signing_key (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.553092042Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/wrong_signing_key","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.553116966Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id"}
+{"Time":"2026-10-18T09:12:50.553125126Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id","Output":"=== RUN   TestVerifyRejections/unknown_key_id\n"}
+{"Time":"2026-10-18T09:12:50.553438954Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id","Output":"--- PASS: TestVerifyRejections/unknown_key_id (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.553463408Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/unknown_key_id","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.553485852Z","Action":"run","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension"}
+{"Time":"2026-10-18T09:12:50.553497034Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension","Output":"=== RUN   TestVerifyRejections/critical_extension\n"}
+{"Time":"2026-10-18T09:12:50.553752546Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension","Output":"--- PASS: TestVerifyRejections/critical_extension (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.553768516Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections/critical_extension","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.553802033Z","Action":"output","Package":"keycape/internal/jose","Test":"TestVerifyRejections","Output":"--- PASS: TestVerifyRejections (0.13s)\n"}
+{"Time":"2026-10-18T09:12:50.553989677Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestVerifyRejections","Elapsed":0.13}
+{"Time":"2026-10-18T09:12:50.554019867Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets"}
+{"Time":"2026-10-18T09:12:50.554038073Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets\n"}
+{"Time":"2026-10-18T09:12:50.568872065Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent"}
+{"Time":"2026-10-18T09:12:50.568933834Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/even_exponent\n"}
+{"Time":"2026-10-18T09:12:50.568957296Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/even_exponent (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.569038921Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/even_exponent","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.569079661Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json"}
+{"Time":"2026-10-18T09:12:50.569100148Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/not_json\n"}
+{"Time":"2026-10-18T09:12:50.569324046Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/not_json (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.569347815Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/not_json","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.569356743Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus"}
+{"Time":"2026-10-18T09:12:50.56936732Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/undersized_modulus\n"}
+{"Time":"2026-10-18T09:12:50.56950572Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/undersized_modulus (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.569522059Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/undersized_modulus","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.569576911Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set"}
+{"Time":"2026-10-18T09:12:50.56958646Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/empty_set\n"}
+{"Time":"2026-10-18T09:12:50.569756481Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/empty_set (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.569772856Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/empty_set","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.569898549Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key"}
+{"Time":"2026-10-18T09:12:50.569932877Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key\n"}
+{"Time":"2026-10-18T09:12:50.569995718Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.570017143Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/no_rsa_signing_key","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.570031688Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id"}
+{"Time":"2026-10-18T09:12:50.570040525Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/missing_key_id\n"}
+{"Time":"2026-10-18T09:12:50.57023234Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/missing_key_id (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.57024922Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/missing_key_id","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.570256091Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64"}
+{"Time":"2026-10-18T09:12:50.570261285Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64","Output":"=== RUN   TestParseJWKSRejectsUnusableKeySets/bad_base64\n"}
+{"Time":"2026-10-18T09:12:50.570504692Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets/bad_base64 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.570531947Z","Action":"output","Package":"keycape/internal/domain","Output":"ok  \tkeycape/internal/domain\t1.048s\n"}
+{"Time":"2026-10-18T09:12:50.570532889Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets/bad_base64","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.570548674Z","Action":"pass","Package":"keycape/internal/domain","Elapsed":1.048}
+{"Time":"2026-10-18T09:12:50.570549265Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets","Output":"--- PASS: TestParseJWKSRejectsUnusableKeySets (0.02s)\n"}
+{"Time":"2026-10-18T09:12:50.570563304Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsUnusableKeySets","Elapsed":0.02}
+{"Time":"2026-10-18T09:12:50.570578174Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs"}
+{"Time":"2026-10-18T09:12:50.570586416Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs","Output":"=== RUN   TestParseJWKSRejectsDuplicateKeyIDs\n"}
+{"Time":"2026-10-18T09:12:50.571219475Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs","Output":"--- PASS: TestParseJWKSRejectsDuplicateKeyIDs (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.57125687Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSRejectsDuplicateKeyIDs","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.571306465Z","Action":"run","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys"}
+{"Time":"2026-10-18T09:12:50.571317394Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys","Output":"=== RUN   TestParseJWKSIgnoresIrrelevantKeys\n"}
+{"Time":"2026-10-18T09:12:50.571861305Z","Action":"output","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys","Output":"--- PASS: TestParseJWKSIgnoresIrrelevantKeys (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.571912298Z","Action":"pass","Package":"keycape/internal/jose","Test":"TestParseJWKSIgnoresIrrelevantKeys","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.571997393Z","Action":"output","Package":"keycape/internal/jose","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:50.636877247Z","Action":"output","Package":"keycape/internal/errors","Output":"ok  \tkeycape/internal/errors\t1.027s\n"}
+{"Time":"2026-10-18T09:12:50.636942054Z","Action":"pass","Package":"keycape/internal/errors","Elapsed":1.027}
+{"Time":"2026-10-18T09:12:50.666277443Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission (0.12s)\n"}
+{"Time":"2026-10-18T09:12:50.666358246Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-admission","Elapsed":0.12}
+{"Time":"2026-10-18T09:12:50.666506063Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token"}
+{"Time":"2026-10-18T09:12:50.666521654Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token\n"}
+{"Time":"2026-10-18T09:12:50.788274906Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token (0.12s)\n"}
+{"Time":"2026-10-18T09:12:50.788344023Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/duplicate-token","Elapsed":0.12}
+{"Time":"2026-10-18T09:12:50.788388099Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token"}
+{"Time":"2026-10-18T09:12:50.788395881Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token\n"}
+{"Time":"2026-10-18T09:12:50.917140251Z","Action":"start","Package":"keycape/internal/migration/lldapexport"}
+{"Time":"2026-10-18T09:12:50.927746575Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token (0.14s)\n"}
+{"Time":"2026-10-18T09:12:50.927812473Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/public-token","Elapsed":0.14}
+{"Time":"2026-10-18T09:12:50.927960791Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent"}
+{"Time":"2026-10-18T09:12:50.927986076Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent\n"}
+{"Time":"2026-10-18T09:12:50.934227315Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups"}
+{"Time":"2026-10-18T09:12:50.934273348Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups","Output":"=== RUN   TestExporter_Export_UsersAndGroups\n"}
+{"Time":"2026-10-18T09:12:50.9363436Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups","Output":"--- PASS: TestExporter_Export_UsersAndGroups (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.936395558Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_UsersAndGroups","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.936417911Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile"}
+{"Time":"2026-10-18T09:12:50.936423818Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile","Output":"=== RUN   TestExporter_Export_WritesYAMLFile\n"}
+{"Time":"2026-10-18T09:12:50.938116283Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile","Output":"--- PASS: TestExporter_Export_WritesYAMLFile (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.938159322Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_WritesYAMLFile","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.938165932Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent"}
+{"Time":"2026-10-18T09:12:50.938170558Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent","Output":"=== RUN   TestExporter_Export_EmitsMigrationEvent\n"}
+{"Time":"2026-10-18T09:12:50.939451954Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent","Output":"--- PASS: TestExporter_Export_EmitsMigrationEvent (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.939554877Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_EmitsMigrationEvent","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.939596077Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser"}
+{"Time":"2026-10-18T09:12:50.939603913Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser","Output":"=== RUN   TestExporter_Export_IncompatibilityReport_BadUser\n"}
+{"Time":"2026-10-18T09:12:50.941126529Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser","Output":"--- PASS: TestExporter_Export_IncompatibilityReport_BadUser (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.941164258Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncompatibilityReport_BadUser","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.941171544Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships"}
+{"Time":"2026-10-18T09:12:50.941176305Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships","Output":"=== RUN   TestExporter_Export_BuildsMemberships\n"}
+{"Time":"2026-10-18T09:12:50.942825695Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships","Output":"--- PASS: TestExporter_Export_BuildsMemberships (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.942864857Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_BuildsMemberships","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.94287382Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion"}
+{"Time":"2026-10-18T09:12:50.942892702Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion","Output":"=== RUN   TestExporter_Export_ProfileVersion\n"}
+{"Time":"2026-10-18T09:12:50.944193368Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion","Output":"--- PASS: TestExporter_Export_ProfileVersion (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.944233215Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_ProfileVersion","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.94423996Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers"}
+{"Time":"2026-10-18T09:12:50.944244135Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers","Output":"=== RUN   TestExporter_Export_IncludesGroupWithNoMembers\n"}
+{"Time":"2026-10-18T09:12:50.94580925Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers","Output":"--- PASS: TestExporter_Export_IncludesGroupWithNoMembers (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.945873678Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IncludesGroupWithNoMembers","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.945888638Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal"}
+{"Time":"2026-10-18T09:12:50.945893877Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal","Output":"=== RUN   TestExporter_Export_GroupEnumerationFailureIsFatal\n"}
+{"Time":"2026-10-18T09:12:50.94641978Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal","Output":"--- PASS: TestExporter_Export_GroupEnumerationFailureIsFatal (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.946502594Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_GroupEnumerationFailureIsFatal","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.946520394Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness"}
+{"Time":"2026-10-18T09:12:50.946527094Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness","Output":"=== RUN   TestExporter_Export_FallbackReportsIncompleteness\n"}
+{"Time":"2026-10-18T09:12:50.947909142Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness","Output":"--- PASS: TestExporter_Export_FallbackReportsIncompleteness (0.00s)\n"}
+{"Time":"2026-10-18T09:12:50.9479554Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_FallbackReportsIncompleteness","Elapsed":0}
+{"Time":"2026-10-18T09:12:50.947966221Z","Action":"run","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic"}
+{"Time":"2026-10-18T09:12:50.947971785Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic","Output":"=== RUN   TestExporter_Export_IsDeterministic\n"}
+{"Time":"2026-10-18T09:12:50.953728568Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic","Output":"--- PASS: TestExporter_Export_IsDeterministic (0.01s)\n"}
+{"Time":"2026-10-18T09:12:50.953791815Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Test":"TestExporter_Export_IsDeterministic","Elapsed":0.01}
+{"Time":"2026-10-18T09:12:50.953804529Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:50.993912267Z","Action":"start","Package":"keycape/internal/migration/tokeycloak"}
+{"Time":"2026-10-18T09:12:51.00939574Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail"}
+{"Time":"2026-10-18T09:12:51.009444018Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail","Output":"=== RUN   TestTransformer_UserMapping_UsernameAndEmail\n"}
+{"Time":"2026-10-18T09:12:51.009654903Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail","Output":"--- PASS: TestTransformer_UserMapping_UsernameAndEmail (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.009739409Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_UsernameAndEmail","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.009810654Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit"}
+{"Time":"2026-10-18T09:12:51.009820393Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit","Output":"=== RUN   TestTransformer_UserMapping_DisplayNameSplit\n"}
+{"Time":"2026-10-18T09:12:51.00994236Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit","Output":"--- PASS: TestTransformer_UserMapping_DisplayNameSplit (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.009971008Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSplit","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.009995147Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord"}
+{"Time":"2026-10-18T09:12:51.010009359Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord","Output":"=== RUN   TestTransformer_UserMapping_DisplayNameSingleWord\n"}
+{"Time":"2026-10-18T09:12:51.010207458Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord","Output":"--- PASS: TestTransformer_UserMapping_DisplayNameSingleWord (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.010227864Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_DisplayNameSingleWord","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.010236088Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths"}
+{"Time":"2026-10-18T09:12:51.010241724Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths","Output":"=== RUN   TestTransformer_UserMapping_GroupPaths\n"}
+{"Time":"2026-10-18T09:12:51.010252391Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths","Output":"--- PASS: TestTransformer_UserMapping_GroupPaths (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.01034725Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_UserMapping_GroupPaths","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.01039469Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath"}
+{"Time":"2026-10-18T09:12:51.0104079Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath","Output":"=== RUN   TestTransformer_GroupMapping_NameAndPath\n"}
+{"Time":"2026-10-18T09:12:51.010566949Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath","Output":"--- PASS: TestTransformer_GroupMapping_NameAndPath (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.010597004Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_GroupMapping_NameAndPath","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.010627446Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient"}
+{"Time":"2026-10-18T09:12:51.010634551Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient","Output":"=== RUN   TestTransformer_ClientMapping_PublicClient\n"}
+{"Time":"2026-10-18T09:12:51.010843598Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient","Output":"--- PASS: TestTransformer_ClientMapping_PublicClient (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.010863472Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_PublicClient","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.010880461Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient"}
+{"Time":"2026-10-18T09:12:51.010894131Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient","Output":"=== RUN   TestTransformer_ClientMapping_ConfidentialClient\n"}
+{"Time":"2026-10-18T09:12:51.011133205Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient","Output":"--- PASS: TestTransformer_ClientMapping_ConfidentialClient (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.011154414Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ConfidentialClient","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.011173404Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes"}
+{"Time":"2026-10-18T09:12:51.011186804Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes","Output":"=== RUN   TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes\n"}
+{"Time":"2026-10-18T09:12:51.011417778Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes","Output":"--- PASS: TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.0115119Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_AllowedScopesBecomesDefaultClientScopes","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.011532468Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse"}
+{"Time":"2026-10-18T09:12:51.011543099Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse","Output":"=== RUN   TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse\n"}
+{"Time":"2026-10-18T09:12:51.011660811Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse","Output":"--- PASS: TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.01177102Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ClientMapping_ImplicitFlowAlwaysFalse","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.011794257Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty"}
+{"Time":"2026-10-18T09:12:51.011809947Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty","Output":"=== RUN   TestTransformer_IdentityProviders_AlwaysEmpty\n"}
+{"Time":"2026-10-18T09:12:51.012018615Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty","Output":"--- PASS: TestTransformer_IdentityProviders_AlwaysEmpty (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.012165299Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_IdentityProviders_AlwaysEmpty","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.012182288Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256"}
+{"Time":"2026-10-18T09:12:51.012187824Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256","Output":"=== RUN   TestTransformer_ProfileVersion_RS256\n"}
+{"Time":"2026-10-18T09:12:51.012197923Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256","Output":"--- PASS: TestTransformer_ProfileVersion_RS256 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.012315742Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ProfileVersion_RS256","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.012338979Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata"}
+{"Time":"2026-10-18T09:12:51.012343379Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata","Output":"=== RUN   TestTransformer_RealmMetadata\n"}
+{"Time":"2026-10-18T09:12:51.012561534Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata","Output":"--- PASS: TestTransformer_RealmMetadata (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.012583698Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_RealmMetadata","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.012658352Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent"}
+{"Time":"2026-10-18T09:12:51.012668605Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent","Output":"=== RUN   TestTransformer_EmitsMigrationEvent\n"}
+{"Time":"2026-10-18T09:12:51.012864288Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent","Output":"--- PASS: TestTransformer_EmitsMigrationEvent (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.012936209Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_EmitsMigrationEvent","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.012947192Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport"}
+{"Time":"2026-10-18T09:12:51.01295088Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport","Output":"=== RUN   TestTransformer_ValidationReport_IncompatibleExport\n"}
+{"Time":"2026-10-18T09:12:51.013211587Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport","Output":"--- PASS: TestTransformer_ValidationReport_IncompatibleExport (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.01328405Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_IncompatibleExport","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.013384673Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport"}
+{"Time":"2026-10-18T09:12:51.013393952Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport","Output":"=== RUN   TestTransformer_ValidationReport_CleanExport\n"}
+{"Time":"2026-10-18T09:12:51.013545397Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport","Output":"--- PASS: TestTransformer_ValidationReport_CleanExport (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.013576957Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransformer_ValidationReport_CleanExport","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.013651205Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants"}
+{"Time":"2026-10-18T09:12:51.013690124Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants","Output":"=== RUN   TestMapClient_FlowsFollowDeclaredGrants\n"}
+{"Time":"2026-10-18T09:12:51.013913571Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants","Output":"--- PASS: TestMapClient_FlowsFollowDeclaredGrants (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.013933193Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_FlowsFollowDeclaredGrants","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.013940172Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime"}
+{"Time":"2026-10-18T09:12:51.013944401Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime","Output":"=== RUN   TestMapClient_CarriesProfileClaimsAndLifetime\n"}
+{"Time":"2026-10-18T09:12:51.014216839Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime","Output":"--- PASS: TestMapClient_CarriesProfileClaimsAndLifetime (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.014241925Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestMapClient_CarriesProfileClaimsAndLifetime","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.014323297Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues"}
+{"Time":"2026-10-18T09:12:51.014334803Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues","Output":"=== RUN   TestTransform_NeverEmitsSecretValues\n"}
+{"Time":"2026-10-18T09:12:51.01591101Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues","Output":"--- PASS: TestTransform_NeverEmitsSecretValues (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.015952562Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_NeverEmitsSecretValues","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.015961588Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes"}
+{"Time":"2026-10-18T09:12:51.015971624Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes","Output":"=== RUN   TestTransform_DerivesRolesAndScopes\n"}
+{"Time":"2026-10-18T09:12:51.016172988Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes","Output":"--- PASS: TestTransform_DerivesRolesAndScopes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.016190626Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestTransform_DerivesRolesAndScopes","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.016227795Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit"}
+{"Time":"2026-10-18T09:12:51.016233206Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit","Output":"=== RUN   TestUnpreservedReport_NamesEveryLimit\n"}
+{"Time":"2026-10-18T09:12:51.01645494Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit","Output":"--- PASS: TestUnpreservedReport_NamesEveryLimit (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.016466851Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestUnpreservedReport_NamesEveryLimit","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.016473533Z","Action":"run","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved"}
+{"Time":"2026-10-18T09:12:51.016477465Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved","Output":"=== RUN   TestValidationReportStaysSeparateFromUnpreserved\n"}
+{"Time":"2026-10-18T09:12:51.016669704Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved","Output":"--- PASS: TestValidationReportStaysSeparateFromUnpreserved (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.016681967Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Test":"TestValidationReportStaysSeparateFromUnpreserved","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.016733699Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:51.094079286Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent (0.17s)\n"}
+{"Time":"2026-10-18T09:12:51.094131154Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/shared-output-parent","Elapsed":0.17}
+{"Time":"2026-10-18T09:12:51.094144986Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output"}
+{"Time":"2026-10-18T09:12:51.094151857Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output\n"}
+{"Time":"2026-10-18T09:12:51.261323833Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output (0.17s)\n"}
+{"Time":"2026-10-18T09:12:51.261377062Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/git-output","Elapsed":0.17}
+{"Time":"2026-10-18T09:12:51.261387765Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink"}
+{"Time":"2026-10-18T09:12:51.261394736Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink\n"}
+{"Time":"2026-10-18T09:12:51.300264526Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink (0.04s)\n"}
+{"Time":"2026-10-18T09:12:51.300317484Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/output-symlink","Elapsed":0.04}
+{"Time":"2026-10-18T09:12:51.30033449Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag"}
+{"Time":"2026-10-18T09:12:51.30034514Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag\n"}
+{"Time":"2026-10-18T09:12:51.504533888Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag (0.20s)\n"}
+{"Time":"2026-10-18T09:12:51.504582409Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/unknown-flag","Elapsed":0.2}
+{"Time":"2026-10-18T09:12:51.504706604Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags"}
+{"Time":"2026-10-18T09:12:51.504721266Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"=== RUN   TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags\n"}
+{"Time":"2026-10-18T09:12:51.568389544Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags (0.06s)\n"}
+{"Time":"2026-10-18T09:12:51.568491105Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput/cleanup-identity-flags","Elapsed":0.06}
+{"Time":"2026-10-18T09:12:51.568509744Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Output":"--- PASS: TestOnlineCLIRejectsChangedTokenAndUntrustedInput (1.21s)\n"}
+{"Time":"2026-10-18T09:12:51.568529239Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIRejectsChangedTokenAndUntrustedInput","Elapsed":1.21}
+{"Time":"2026-10-18T09:12:51.568537354Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation"}
+{"Time":"2026-10-18T09:12:51.568543793Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"=== RUN   TestOnlineCLIFailureDoesNotDeleteReplacedObservation\n"}
+{"Time":"2026-10-18T09:12:51.576650594Z","Action":"output","Package":"keycape/internal/jose","Output":"ok  \tkeycape/internal/jose\t1.208s\n"}
+{"Time":"2026-10-18T09:12:51.576719107Z","Action":"pass","Package":"keycape/internal/jose","Elapsed":1.208}
+{"Time":"2026-10-18T09:12:51.723349119Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Output":"--- PASS: TestOnlineCLIFailureDoesNotDeleteReplacedObservation (0.15s)\n"}
+{"Time":"2026-10-18T09:12:51.723405748Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCLIFailureDoesNotDeleteReplacedObservation","Elapsed":0.15}
+{"Time":"2026-10-18T09:12:51.723415297Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer"}
+{"Time":"2026-10-18T09:12:51.723421366Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer","Output":"=== RUN   TestOnlineExportMatchesItsSingleProducer\n"}
+{"Time":"2026-10-18T09:12:51.778193652Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer","Output":"--- PASS: TestOnlineExportMatchesItsSingleProducer (0.05s)\n"}
+{"Time":"2026-10-18T09:12:51.778246674Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineExportMatchesItsSingleProducer","Elapsed":0.05}
+{"Time":"2026-10-18T09:12:51.778401758Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus"}
+{"Time":"2026-10-18T09:12:51.77841734Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus","Output":"=== RUN   TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus\n"}
+{"Time":"2026-10-18T09:12:51.881469769Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus","Output":"--- PASS: TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus (0.10s)\n"}
+{"Time":"2026-10-18T09:12:51.881531221Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus","Elapsed":0.1}
+{"Time":"2026-10-18T09:12:51.881546875Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant"}
+{"Time":"2026-10-18T09:12:51.881554179Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"=== RUN   TestOnlineActualIssuerCurrentRevocationAndFreshGrant\n"}
+{"Time":"2026-10-18T09:12:51.906893496Z","Action":"start","Package":"keycape/internal/migration/toldap"}
+{"Time":"2026-10-18T09:12:51.921365473Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes"}
+{"Time":"2026-10-18T09:12:51.921405545Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes","Output":"=== RUN   TestGenerator_UserLDIF_RequiredAttributes\n"}
+{"Time":"2026-10-18T09:12:51.921637938Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes","Output":"--- PASS: TestGenerator_UserLDIF_RequiredAttributes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.921653709Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_UserLDIF_RequiredAttributes","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.92166554Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs"}
+{"Time":"2026-10-18T09:12:51.921669778Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs","Output":"=== RUN   TestGenerator_GroupLDIF_WithMemberDNs\n"}
+{"Time":"2026-10-18T09:12:51.921939337Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs","Output":"--- PASS: TestGenerator_GroupLDIF_WithMemberDNs (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.921967128Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_GroupLDIF_WithMemberDNs","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.921977272Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName"}
+{"Time":"2026-10-18T09:12:51.921984748Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName","Output":"=== RUN   TestGenerator_Target_OpenLDAP_NoSAMAccountName\n"}
+{"Time":"2026-10-18T09:12:51.922186031Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName","Output":"--- PASS: TestGenerator_Target_OpenLDAP_NoSAMAccountName (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.922206428Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_NoSAMAccountName","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.922215427Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable"}
+{"Time":"2026-10-18T09:12:51.922222388Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable","Output":"=== RUN   TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable\n"}
+{"Time":"2026-10-18T09:12:51.922471282Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable","Output":"--- PASS: TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.922491553Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_HasNsUniqueIdIfAvailable","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.922506305Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent"}
+{"Time":"2026-10-18T09:12:51.922513312Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent","Output":"=== RUN   TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent\n"}
+{"Time":"2026-10-18T09:12:51.922733369Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent","Output":"--- PASS: TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.922749257Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_389DS_NoNsUniqueIdWhenAbsent","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.922776101Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent"}
+{"Time":"2026-10-18T09:12:51.922782522Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent","Output":"=== RUN   TestGenerator_Target_AD_SAMAccountNamePresent\n"}
+{"Time":"2026-10-18T09:12:51.922983336Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent","Output":"--- PASS: TestGenerator_Target_AD_SAMAccountNamePresent (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.922999053Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_SAMAccountNamePresent","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.923008133Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN"}
+{"Time":"2026-10-18T09:12:51.923013499Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN","Output":"=== RUN   TestGenerator_Target_AD_UsesCNInDN\n"}
+{"Time":"2026-10-18T09:12:51.923258461Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN","Output":"--- PASS: TestGenerator_Target_AD_UsesCNInDN (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.923274665Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_AD_UsesCNInDN","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.923283908Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN"}
+{"Time":"2026-10-18T09:12:51.923289354Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN","Output":"=== RUN   TestGenerator_Target_OpenLDAP_UsesUIDInDN\n"}
+{"Time":"2026-10-18T09:12:51.923572279Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN","Output":"--- PASS: TestGenerator_Target_OpenLDAP_UsesUIDInDN (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.923601297Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_Target_OpenLDAP_UsesUIDInDN","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.923609079Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly"}
+{"Time":"2026-10-18T09:12:51.923614399Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly","Output":"=== RUN   TestGenerator_EmptyExport_StructuralEntriesOnly\n"}
+{"Time":"2026-10-18T09:12:51.923641838Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly","Output":"--- PASS: TestGenerator_EmptyExport_StructuralEntriesOnly (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.923775156Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmptyExport_StructuralEntriesOnly","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.923792262Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent"}
+{"Time":"2026-10-18T09:12:51.923797203Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent","Output":"=== RUN   TestGenerator_EmitsMigrationEvent\n"}
+{"Time":"2026-10-18T09:12:51.92401719Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent","Output":"--- PASS: TestGenerator_EmitsMigrationEvent (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.924037254Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_EmitsMigrationEvent","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.92404692Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput"}
+{"Time":"2026-10-18T09:12:51.92405234Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput","Output":"=== RUN   TestGenerator_ValidationRunsOnOutput\n"}
+{"Time":"2026-10-18T09:12:51.924292072Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput","Output":"--- PASS: TestGenerator_ValidationRunsOnOutput (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.924308294Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationRunsOnOutput","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.924345671Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData"}
+{"Time":"2026-10-18T09:12:51.924352082Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData","Output":"=== RUN   TestGenerator_ValidationFailsForInvalidData\n"}
+{"Time":"2026-10-18T09:12:51.924654169Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData","Output":"--- PASS: TestGenerator_ValidationFailsForInvalidData (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.924669985Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestGenerator_ValidationFailsForInvalidData","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.924679246Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout"}
+{"Time":"2026-10-18T09:12:51.924684602Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout","Output":"=== RUN   TestMemberDNsAreRewrittenIntoTheTargetLayout\n"}
+{"Time":"2026-10-18T09:12:51.924924161Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout","Output":"--- PASS: TestMemberDNsAreRewrittenIntoTheTargetLayout (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.924952583Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNsAreRewrittenIntoTheTargetLayout","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.924964161Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute"}
+{"Time":"2026-10-18T09:12:51.924971069Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute","Output":"=== RUN   TestMemberDNRewriteFollowsTargetNamingAttribute\n"}
+{"Time":"2026-10-18T09:12:51.925255394Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute","Output":"--- PASS: TestMemberDNRewriteFollowsTargetNamingAttribute (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.925290849Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestMemberDNRewriteFollowsTargetNamingAttribute","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.925304997Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember"}
+{"Time":"2026-10-18T09:12:51.925312374Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember","Output":"=== RUN   TestEmptyGroupsGetALoadablePlaceholderMember\n"}
+{"Time":"2026-10-18T09:12:51.925564207Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember","Output":"--- PASS: TestEmptyGroupsGetALoadablePlaceholderMember (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.925588337Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestEmptyGroupsGetALoadablePlaceholderMember","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.925598942Z","Action":"run","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers"}
+{"Time":"2026-10-18T09:12:51.925606615Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers","Output":"=== RUN   TestNoPlaceholderWhenEveryGroupHasMembers\n"}
+{"Time":"2026-10-18T09:12:51.925838864Z","Action":"output","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers","Output":"--- PASS: TestNoPlaceholderWhenEveryGroupHasMembers (0.00s)\n"}
+{"Time":"2026-10-18T09:12:51.925879153Z","Action":"pass","Package":"keycape/internal/migration/toldap","Test":"TestNoPlaceholderWhenEveryGroupHasMembers","Elapsed":0}
+{"Time":"2026-10-18T09:12:51.925890938Z","Action":"output","Package":"keycape/internal/migration/toldap","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:51.95872117Z","Action":"output","Package":"keycape/internal/migration/lldapexport","Output":"ok  \tkeycape/internal/migration/lldapexport\t1.042s\n"}
+{"Time":"2026-10-18T09:12:51.958775833Z","Action":"pass","Package":"keycape/internal/migration/lldapexport","Elapsed":1.042}
+{"Time":"2026-10-18T09:12:52.01927759Z","Action":"output","Package":"keycape/internal/migration/tokeycloak","Output":"ok  \tkeycape/internal/migration/tokeycloak\t1.025s\n"}
+{"Time":"2026-10-18T09:12:52.019329294Z","Action":"pass","Package":"keycape/internal/migration/tokeycloak","Elapsed":1.025}
+{"Time":"2026-10-18T09:12:52.052824811Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Output":"--- PASS: TestOnlineActualIssuerCurrentRevocationAndFreshGrant (0.17s)\n"}
+{"Time":"2026-10-18T09:12:52.052931367Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineActualIssuerCurrentRevocationAndFreshGrant","Elapsed":0.17}
+{"Time":"2026-10-18T09:12:52.052944433Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork"}
+{"Time":"2026-10-18T09:12:52.0529508Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork\n"}
+{"Time":"2026-10-18T09:12:52.053099377Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject"}
+{"Time":"2026-10-18T09:12:52.05311476Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/subject\n"}
+{"Time":"2026-10-18T09:12:52.281603104Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/subject (0.23s)\n"}
+{"Time":"2026-10-18T09:12:52.281667794Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/subject","Elapsed":0.23}
+{"Time":"2026-10-18T09:12:52.281902612Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant"}
+{"Time":"2026-10-18T09:12:52.281924073Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant\n"}
+{"Time":"2026-10-18T09:12:52.485765889Z","Action":"start","Package":"keycape/internal/server/errors"}
+{"Time":"2026-10-18T09:12:52.504087297Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect"}
+{"Time":"2026-10-18T09:12:52.50412792Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect","Output":"=== RUN   TestDefaultRegistry_DynamicClientRegistration_PostConnect\n"}
+{"Time":"2026-10-18T09:12:52.505055948Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect","Output":"--- PASS: TestDefaultRegistry_DynamicClientRegistration_PostConnect (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.50520595Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PostConnect","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.50523448Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration"}
+{"Time":"2026-10-18T09:12:52.505257546Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration","Output":"=== RUN   TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration\n"}
+{"Time":"2026-10-18T09:12:52.505676001Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration","Output":"--- PASS: TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.505702332Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_DynamicClientRegistration_PathContainsRegistration","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.505793469Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token"}
+{"Time":"2026-10-18T09:12:52.505804317Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token","Output":"=== RUN   TestDefaultRegistry_ImplicitFlow_Token\n"}
+{"Time":"2026-10-18T09:12:52.506206405Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token","Output":"--- PASS: TestDefaultRegistry_ImplicitFlow_Token (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.506227361Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_Token","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.506233989Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken"}
+{"Time":"2026-10-18T09:12:52.506237803Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken","Output":"=== RUN   TestDefaultRegistry_ImplicitFlow_IDToken\n"}
+{"Time":"2026-10-18T09:12:52.506640456Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken","Output":"--- PASS: TestDefaultRegistry_ImplicitFlow_IDToken (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.506664577Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_ImplicitFlow_IDToken","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.506673225Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI"}
+{"Time":"2026-10-18T09:12:52.506678284Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI","Output":"=== RUN   TestDefaultRegistry_WildcardRedirectURI\n"}
+{"Time":"2026-10-18T09:12:52.507097652Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI","Output":"--- PASS: TestDefaultRegistry_WildcardRedirectURI (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.507128338Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_WildcardRedirectURI","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.50731556Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker"}
+{"Time":"2026-10-18T09:12:52.507334243Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker","Output":"=== RUN   TestDefaultRegistry_IdentityBroker\n"}
+{"Time":"2026-10-18T09:12:52.507640869Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker","Output":"--- PASS: TestDefaultRegistry_IdentityBroker (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.507678796Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_IdentityBroker","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.507697001Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE"}
+{"Time":"2026-10-18T09:12:52.507702006Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE","Output":"=== RUN   TestDefaultRegistry_MissingPKCE\n"}
+{"Time":"2026-10-18T09:12:52.508102588Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE","Output":"--- PASS: TestDefaultRegistry_MissingPKCE (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.508181904Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.508249082Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough"}
+{"Time":"2026-10-18T09:12:52.508261202Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough","Output":"=== RUN   TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough\n"}
+{"Time":"2026-10-18T09:12:52.50849996Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough","Output":"--- PASS: TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.508513766Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_MissingPKCE_WithCodeChallenge_PassesThrough","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.508596189Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod"}
+{"Time":"2026-10-18T09:12:52.508622709Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod","Output":"=== RUN   TestDefaultRegistry_PKCEPlainMethod\n"}
+{"Time":"2026-10-18T09:12:52.508956891Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod","Output":"--- PASS: TestDefaultRegistry_PKCEPlainMethod (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.508973763Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_PKCEPlainMethod","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.508981427Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType"}
+{"Time":"2026-10-18T09:12:52.508985314Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType","Output":"=== RUN   TestDefaultRegistry_UnknownGrantType\n"}
+{"Time":"2026-10-18T09:12:52.509420748Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType","Output":"--- PASS: TestDefaultRegistry_UnknownGrantType (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.509440009Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.509520154Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes"}
+{"Time":"2026-10-18T09:12:52.509529586Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes","Output":"=== RUN   TestDefaultRegistry_UnknownGrantType_AllowedTypes\n"}
+{"Time":"2026-10-18T09:12:52.50999154Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes","Output":"--- PASS: TestDefaultRegistry_UnknownGrantType_AllowedTypes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.510018312Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_UnknownGrantType_AllowedTypes","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.510049539Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough"}
+{"Time":"2026-10-18T09:12:52.510055084Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough","Output":"=== RUN   TestDefaultRegistry_NoMatchPassesThrough\n"}
+{"Time":"2026-10-18T09:12:52.510374087Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough","Output":"--- PASS: TestDefaultRegistry_NoMatchPassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.510426144Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestDefaultRegistry_NoMatchPassesThrough","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.510559771Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature"}
+{"Time":"2026-10-18T09:12:52.510578833Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature","Output":"=== RUN   TestRegistry_CustomFeature\n"}
+{"Time":"2026-10-18T09:12:52.510973013Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature","Output":"--- PASS: TestRegistry_CustomFeature (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.511002499Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.511030426Z","Action":"run","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough"}
+{"Time":"2026-10-18T09:12:52.511036413Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough","Output":"=== RUN   TestRegistry_CustomFeature_NoMatch_PassesThrough\n"}
+{"Time":"2026-10-18T09:12:52.511419046Z","Action":"output","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough","Output":"--- PASS: TestRegistry_CustomFeature_NoMatch_PassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.511600464Z","Action":"pass","Package":"keycape/internal/server/errors","Test":"TestRegistry_CustomFeature_NoMatch_PassesThrough","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.511653107Z","Action":"output","Package":"keycape/internal/server/errors","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:52.656639506Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant (0.37s)\n"}
+{"Time":"2026-10-18T09:12:52.656684944Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tenant","Elapsed":0.37}
+{"Time":"2026-10-18T09:12:52.656692059Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal"}
+{"Time":"2026-10-18T09:12:52.656695431Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/principal\n"}
+{"Time":"2026-10-18T09:12:52.683775194Z","Action":"start","Package":"keycape/internal/server/oidc"}
+{"Time":"2026-10-18T09:12:52.702090897Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials"}
+{"Time":"2026-10-18T09:12:52.702280476Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials","Output":"=== RUN   TestRecoveryStripsCredentials\n"}
+{"Time":"2026-10-18T09:12:52.702660335Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials","Output":"--- PASS: TestRecoveryStripsCredentials (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.702703925Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestRecoveryStripsCredentials","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.702732194Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn"}
+{"Time":"2026-10-18T09:12:52.702742059Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn","Output":"=== RUN   TestSharedLogoutRequiresConfirmationAndFixedReturn\n"}
+{"Time":"2026-10-18T09:12:52.704577434Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn","Output":"--- PASS: TestSharedLogoutRequiresConfirmationAndFixedReturn (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.704669338Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSharedLogoutRequiresConfirmationAndFixedReturn","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.70489011Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime"}
+{"Time":"2026-10-18T09:12:52.704919696Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime","Output":"=== RUN   TestAssuranceReportsAuthenticationTimeNotMintTime\n"}
+{"Time":"2026-10-18T09:12:52.705272016Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime","Output":"--- PASS: TestAssuranceReportsAuthenticationTimeNotMintTime (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.705322413Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAssuranceReportsAuthenticationTimeNotMintTime","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.705333081Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset"}
+{"Time":"2026-10-18T09:12:52.705337878Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset","Output":"=== RUN   TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset\n"}
+{"Time":"2026-10-18T09:12:52.705619028Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset","Output":"--- PASS: TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.705651787Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAssuranceFallsBackToMintTimeWhenAuthTimeIsUnset","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.705739074Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape"}
+{"Time":"2026-10-18T09:12:52.705750869Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape","Output":"=== RUN   TestAssuranceCarriesTheDocumentedShape\n"}
+{"Time":"2026-10-18T09:12:52.706020511Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape","Output":"--- PASS: TestAssuranceCarriesTheDocumentedShape (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.706051485Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAssuranceCarriesTheDocumentedShape","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.7060963Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares"}
+{"Time":"2026-10-18T09:12:52.706103136Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares","Output":"=== RUN   TestHumanTenantBindsTheZoneAClientDeclares\n"}
+{"Time":"2026-10-18T09:12:52.706368723Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares","Output":"--- PASS: TestHumanTenantBindsTheZoneAClientDeclares (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.706408345Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantBindsTheZoneAClientDeclares","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.706503916Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared"}
+{"Time":"2026-10-18T09:12:52.706520147Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared\n"}
+{"Time":"2026-10-18T09:12:52.706745813Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all"}
+{"Time":"2026-10-18T09:12:52.706760538Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all\n"}
+{"Time":"2026-10-18T09:12:52.706995879Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.707020334Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/no_client_at_all","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.707209768Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing"}
+{"Time":"2026-10-18T09:12:52.707231004Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing\n"}
+{"Time":"2026-10-18T09:12:52.707699279Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.70774037Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/client_declares_nothing","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.707747981Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins"}
+{"Time":"2026-10-18T09:12:52.707752904Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins","Output":"=== RUN   TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins\n"}
+{"Time":"2026-10-18T09:12:52.707758252Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.707765844Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared/directory_answer_wins","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.707776178Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared","Output":"--- PASS: TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.707783933Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantKeepsDirectoryAnswerWhenNoClientTenantIsDeclared","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.707925254Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser"}
+{"Time":"2026-10-18T09:12:52.707945083Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser","Output":"=== RUN   TestHumanTenantRefusesToRelabelAPlacedUser\n"}
+{"Time":"2026-10-18T09:12:52.70807152Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser","Output":"--- PASS: TestHumanTenantRefusesToRelabelAPlacedUser (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.708095001Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantRefusesToRelabelAPlacedUser","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.708233369Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory"}
+{"Time":"2026-10-18T09:12:52.70824795Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory","Output":"=== RUN   TestHumanTenantAcceptsAgreementBetweenClientAndDirectory\n"}
+{"Time":"2026-10-18T09:12:52.708484438Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory","Output":"--- PASS: TestHumanTenantAcceptsAgreementBetweenClientAndDirectory (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.708511571Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantAcceptsAgreementBetweenClientAndDirectory","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.708520813Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration"}
+{"Time":"2026-10-18T09:12:52.708525033Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration","Output":"=== RUN   TestPrincipalTypeIsNeverSuppliedByConfiguration\n"}
+{"Time":"2026-10-18T09:12:52.842904265Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration","Output":"--- PASS: TestPrincipalTypeIsNeverSuppliedByConfiguration (0.13s)\n"}
+{"Time":"2026-10-18T09:12:52.842953382Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPrincipalTypeIsNeverSuppliedByConfiguration","Elapsed":0.13}
+{"Time":"2026-10-18T09:12:52.84297193Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones"}
+{"Time":"2026-10-18T09:12:52.842976845Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones","Output":"=== RUN   TestTokenStatusExactExpiryCapacityAndTombstones\n"}
+{"Time":"2026-10-18T09:12:52.843908387Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones","Output":"--- PASS: TestTokenStatusExactExpiryCapacityAndTombstones (0.00s)\n"}
+{"Time":"2026-10-18T09:12:52.84394424Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusExactExpiryCapacityAndTombstones","Elapsed":0}
+{"Time":"2026-10-18T09:12:52.84395552Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke"}
+{"Time":"2026-10-18T09:12:52.843961499Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke","Output":"=== RUN   TestTokenStatusConcurrentIssueReadAndRevoke\n"}
+{"Time":"2026-10-18T09:12:52.861505503Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke","Output":"--- PASS: TestTokenStatusConcurrentIssueReadAndRevoke (0.02s)\n"}
+{"Time":"2026-10-18T09:12:52.861551897Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusConcurrentIssueReadAndRevoke","Elapsed":0.02}
+{"Time":"2026-10-18T09:12:52.861655965Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID"}
+{"Time":"2026-10-18T09:12:52.861666623Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID","Output":"=== RUN   TestServiceAudienceIsStaticAndDefaultsToClientID\n"}
+{"Time":"2026-10-18T09:12:52.861791593Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00"}
+{"Time":"2026-10-18T09:12:52.861801494Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00","Output":"=== RUN   TestServiceAudienceIsStaticAndDefaultsToClientID/#00\n"}
+{"Time":"2026-10-18T09:12:52.870687783Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/principal (0.21s)\n"}
+{"Time":"2026-10-18T09:12:52.870766179Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/principal","Elapsed":0.21}
+{"Time":"2026-10-18T09:12:52.870789525Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience"}
+{"Time":"2026-10-18T09:12:52.870793898Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/audience\n"}
+{"Time":"2026-10-18T09:12:52.929888832Z","Action":"output","Package":"keycape/internal/migration/toldap","Output":"ok  \tkeycape/internal/migration/toldap\t1.023s\n"}
+{"Time":"2026-10-18T09:12:52.930038446Z","Action":"pass","Package":"keycape/internal/migration/toldap","Elapsed":1.023}
+{"Time":"2026-10-18T09:12:52.937188682Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/audience (0.07s)\n"}
+{"Time":"2026-10-18T09:12:52.937259756Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/audience","Elapsed":0.07}
+{"Time":"2026-10-18T09:12:52.937393662Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer"}
+{"Time":"2026-10-18T09:12:52.937410299Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer\n"}
+{"Time":"2026-10-18T09:12:52.985925107Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00","Output":"--- PASS: TestServiceAudienceIsStaticAndDefaultsToClientID/#00 (0.12s)\n"}
+{"Time":"2026-10-18T09:12:52.985986613Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/#00","Elapsed":0.12}
+{"Time":"2026-10-18T09:12:52.986003458Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine"}
+{"Time":"2026-10-18T09:12:52.986010004Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine","Output":"=== RUN   TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine\n"}
+{"Time":"2026-10-18T09:12:53.05902696Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer (0.12s)\n"}
+{"Time":"2026-10-18T09:12:53.059124554Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/issuer","Elapsed":0.12}
+{"Time":"2026-10-18T09:12:53.059141533Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper"}
+{"Time":"2026-10-18T09:12:53.059162507Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper\n"}
+{"Time":"2026-10-18T09:12:53.20254034Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper (0.14s)\n"}
+{"Time":"2026-10-18T09:12:53.202599908Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/tamper","Elapsed":0.14}
+{"Time":"2026-10-18T09:12:53.202612686Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key"}
+{"Time":"2026-10-18T09:12:53.202621378Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/key\n"}
+{"Time":"2026-10-18T09:12:53.270382117Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine","Output":"--- PASS: TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine (0.28s)\n"}
+{"Time":"2026-10-18T09:12:53.270433678Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID/approval-engine","Elapsed":0.28}
+{"Time":"2026-10-18T09:12:53.270452217Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID","Output":"--- PASS: TestServiceAudienceIsStaticAndDefaultsToClientID (0.41s)\n"}
+{"Time":"2026-10-18T09:12:53.2705011Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceAudienceIsStaticAndDefaultsToClientID","Elapsed":0.41}
+{"Time":"2026-10-18T09:12:53.270518575Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience"}
+{"Time":"2026-10-18T09:12:53.270525077Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience","Output":"=== RUN   TestHumanResourceAudiencePreservesIDTokenAudience\n"}
+{"Time":"2026-10-18T09:12:53.362866963Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/key (0.16s)\n"}
+{"Time":"2026-10-18T09:12:53.362946558Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/key","Elapsed":0.16}
+{"Time":"2026-10-18T09:12:53.362966937Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti"}
+{"Time":"2026-10-18T09:12:53.362992321Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti\n"}
+{"Time":"2026-10-18T09:12:57.01712317Z","Action":"start","Package":"keycape/internal/server/policy"}
+{"Time":"2026-10-18T09:12:57.037612298Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback"}
+{"Time":"2026-10-18T09:12:57.037666699Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback","Output":"=== RUN   TestReviewedApplyReplayRestartRollback\n"}
+{"Time":"2026-10-18T09:12:57.040123408Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback","Output":"--- PASS: TestReviewedApplyReplayRestartRollback (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.040166538Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestReviewedApplyReplayRestartRollback","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.040178666Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests"}
+{"Time":"2026-10-18T09:12:57.040183887Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests","Output":"=== RUN   TestStaleExpiredUnsupportedAndAlteredRequests\n"}
+{"Time":"2026-10-18T09:12:57.041303532Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests","Output":"--- PASS: TestStaleExpiredUnsupportedAndAlteredRequests (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.04133236Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestStaleExpiredUnsupportedAndAlteredRequests","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.04134392Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter"}
+{"Time":"2026-10-18T09:12:57.041349285Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter","Output":"=== RUN   TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter\n"}
+{"Time":"2026-10-18T09:12:57.042199991Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter","Output":"--- PASS: TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.042229315Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestWriteFailureDoesNotChangeEffectivePolicyAndSingleWriter","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.042239585Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed"}
+{"Time":"2026-10-18T09:12:57.042245185Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed","Output":"=== RUN   TestCorruptPersistenceFailsClosed\n"}
+{"Time":"2026-10-18T09:12:57.043055547Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed","Output":"--- PASS: TestCorruptPersistenceFailsClosed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.043087089Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestCorruptPersistenceFailsClosed","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.04309993Z","Action":"run","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA"}
+{"Time":"2026-10-18T09:12:57.043105394Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA","Output":"=== RUN   TestHTTPRequiresSignedFreshPlatformMFA\n"}
+{"Time":"2026-10-18T09:12:57.086503447Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti (0.14s)\n"}
+{"Time":"2026-10-18T09:12:57.086565215Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/no-jti","Elapsed":0.14}
+{"Time":"2026-10-18T09:12:57.086578434Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token"}
+{"Time":"2026-10-18T09:12:57.086586288Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token\n"}
+{"Time":"2026-10-18T09:12:57.094819947Z","Action":"output","Package":"keycape/internal/server/errors","Output":"ok  \tkeycape/internal/server/errors\t1.030s\n"}
+{"Time":"2026-10-18T09:12:57.094882346Z","Action":"pass","Package":"keycape/internal/server/errors","Elapsed":1.03}
+{"Time":"2026-10-18T09:12:57.123507687Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience","Output":"--- PASS: TestHumanResourceAudiencePreservesIDTokenAudience (0.27s)\n"}
+{"Time":"2026-10-18T09:12:57.123554008Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanResourceAudiencePreservesIDTokenAudience","Elapsed":0.27}
+{"Time":"2026-10-18T09:12:57.12367437Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication"}
+{"Time":"2026-10-18T09:12:57.123684055Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication","Output":"=== RUN   TestHumanExcessScopeRejectedBeforeAuthentication\n"}
+{"Time":"2026-10-18T09:12:57.124302855Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication","Output":"--- PASS: TestHumanExcessScopeRejectedBeforeAuthentication (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.124340944Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanExcessScopeRejectedBeforeAuthentication","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.124372675Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization"}
+{"Time":"2026-10-18T09:12:57.124378031Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization","Output":"=== RUN   TestTokenRejectsScopeRemovedAfterAuthorization\n"}
+{"Time":"2026-10-18T09:12:57.15753971Z","Action":"output","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA","Output":"--- PASS: TestHTTPRequiresSignedFreshPlatformMFA (0.11s)\n"}
+{"Time":"2026-10-18T09:12:57.157588575Z","Action":"pass","Package":"keycape/internal/server/policy","Test":"TestHTTPRequiresSignedFreshPlatformMFA","Elapsed":0.11}
+{"Time":"2026-10-18T09:12:57.157600054Z","Action":"output","Package":"keycape/internal/server/policy","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:57.262992257Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization","Output":"--- PASS: TestTokenRejectsScopeRemovedAfterAuthorization (0.14s)\n"}
+{"Time":"2026-10-18T09:12:57.263036Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenRejectsScopeRemovedAfterAuthorization","Elapsed":0.14}
+{"Time":"2026-10-18T09:12:57.263045621Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia"}
+{"Time":"2026-10-18T09:12:57.263053719Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia","Output":"=== RUN   TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia\n"}
+{"Time":"2026-10-18T09:12:57.263366599Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia","Output":"--- PASS: TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.26345523Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ValidRequest_RedirectsToAuthelia","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.26356487Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia"}
+{"Time":"2026-10-18T09:12:57.263574645Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia","Output":"=== RUN   TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia\n"}
+{"Time":"2026-10-18T09:12:57.263899311Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia","Output":"--- PASS: TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.263915154Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_BootstrapConsoleRedirectURI_RedirectsToAuthelia","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.264010178Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart"}
+{"Time":"2026-10-18T09:12:57.264020034Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart","Output":"=== RUN   TestAuthorizeHandler_EmitsAuthStart\n"}
+{"Time":"2026-10-18T09:12:57.264299803Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart","Output":"--- PASS: TestAuthorizeHandler_EmitsAuthStart (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.2643136Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_EmitsAuthStart","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.264406694Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage"}
+{"Time":"2026-10-18T09:12:57.264416541Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:12:57.264898814Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.264959626Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingCodeChallenge_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.264979563Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety"}
+{"Time":"2026-10-18T09:12:57.264986831Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety","Output":"=== RUN   TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety\n"}
+{"Time":"2026-10-18T09:12:57.2653601Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety","Output":"--- PASS: TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.265384248Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WildcardRedirectURI_RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.265481589Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage"}
+{"Time":"2026-10-18T09:12:57.265502176Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_UnknownClient_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:12:57.265855459Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_UnknownClient_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.265882565Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownClient_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.265896605Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported"}
+{"Time":"2026-10-18T09:12:57.265903359Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported","Output":"=== RUN   TestAuthorizeHandler_WrongResponseType_FeatureNotSupported\n"}
+{"Time":"2026-10-18T09:12:57.26620641Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported","Output":"--- PASS: TestAuthorizeHandler_WrongResponseType_FeatureNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.266220793Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_WrongResponseType_FeatureNotSupported","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.266327368Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage"}
+{"Time":"2026-10-18T09:12:57.266341146Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:12:57.266840164Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.266891274Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_MissingOpenIDScope_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.266907135Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety"}
+{"Time":"2026-10-18T09:12:57.266913483Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety","Output":"=== RUN   TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety\n"}
+{"Time":"2026-10-18T09:12:57.267347327Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety","Output":"--- PASS: TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.267379672Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_PlainCodeChallengeMethod_RejectedForSafety","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.267385848Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage"}
+{"Time":"2026-10-18T09:12:57.267390564Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage","Output":"=== RUN   TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:12:57.267787134Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage","Output":"--- PASS: TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.267807044Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_UnknownRedirectURI_InvalidProfileUsage","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.26791691Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode"}
+{"Time":"2026-10-18T09:12:57.267931194Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode","Output":"=== RUN   TestAuthorizeCallback_Success_RedirectsWithCode\n"}
+{"Time":"2026-10-18T09:12:57.268065262Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token (0.18s)\n"}
+{"Time":"2026-10-18T09:12:57.268189271Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/ID-token","Elapsed":0.18}
+{"Time":"2026-10-18T09:12:57.268211426Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale"}
+{"Time":"2026-10-18T09:12:57.268222454Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"=== RUN   TestOnlineIdentityMismatchRefusesBeforeNetwork/stale\n"}
+{"Time":"2026-10-18T09:12:57.269018803Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode","Output":"--- PASS: TestAuthorizeCallback_Success_RedirectsWithCode (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.269067803Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_Success_RedirectsWithCode","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.269078759Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure"}
+{"Time":"2026-10-18T09:12:57.269091915Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure","Output":"=== RUN   TestAuthorizeCallback_MFAFailed_AuthFailure\n"}
+{"Time":"2026-10-18T09:12:57.269427344Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure","Output":"--- PASS: TestAuthorizeCallback_MFAFailed_AuthFailure (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.2694483Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFAFailed_AuthFailure","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.26953098Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken"}
+{"Time":"2026-10-18T09:12:57.269541133Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken","Output":"=== RUN   TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken\n"}
+{"Time":"2026-10-18T09:12:57.270359042Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken","Output":"--- PASS: TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.270389214Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.270546732Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode"}
+{"Time":"2026-10-18T09:12:57.27057318Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode","Output":"=== RUN   TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode\n"}
+{"Time":"2026-10-18T09:12:57.270937918Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode","Output":"--- PASS: TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.271047846Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_ValidToken_RedirectsWithCode","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.271068639Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie"}
+{"Time":"2026-10-18T09:12:57.271075817Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie","Output":"=== RUN   TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie\n"}
+{"Time":"2026-10-18T09:12:57.271477752Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie","Output":"--- PASS: TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.271505074Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_FreshEvenWithStalePriorLoginCookie","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.271516138Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse"}
+{"Time":"2026-10-18T09:12:57.271522901Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse","Output":"=== RUN   TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse\n"}
+{"Time":"2026-10-18T09:12:57.271967016Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse","Output":"--- PASS: TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.271992995Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFANotRequired_SessionRecordsMFAVerifiedFalse","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.272001769Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA"}
+{"Time":"2026-10-18T09:12:57.272006088Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA","Output":"=== RUN   TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA\n"}
+{"Time":"2026-10-18T09:12:57.272349663Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA","Output":"--- PASS: TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.272363721Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ClientPolicyCanDisableEnrolledMFA","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.272483858Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1"}
+{"Time":"2026-10-18T09:12:57.272509494Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1","Output":"=== RUN   TestAuthorizeCallback_ACRStepUpOverridesClientAAL1\n"}
+{"Time":"2026-10-18T09:12:57.272939635Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1","Output":"--- PASS: TestAuthorizeCallback_ACRStepUpOverridesClientAAL1 (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.272954125Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ACRStepUpOverridesClientAAL1","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.273077763Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure"}
+{"Time":"2026-10-18T09:12:57.273097277Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure","Output":"=== RUN   TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure\n"}
+{"Time":"2026-10-18T09:12:57.27337533Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure","Output":"--- PASS: TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.273399568Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_MFASubmission_InvalidToken_AuthFailure","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.273415926Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure"}
+{"Time":"2026-10-18T09:12:57.273421174Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure","Output":"=== RUN   TestAuthorizeCallback_AuthProviderFailed_AuthFailure\n"}
+{"Time":"2026-10-18T09:12:57.27375987Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure","Output":"--- PASS: TestAuthorizeCallback_AuthProviderFailed_AuthFailure (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.273786138Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_AuthProviderFailed_AuthFailure","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.273806508Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess"}
+{"Time":"2026-10-18T09:12:57.273813388Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess","Output":"=== RUN   TestAuthorizeCallback_EmitsAuthSuccess\n"}
+{"Time":"2026-10-18T09:12:57.274343623Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess","Output":"--- PASS: TestAuthorizeCallback_EmitsAuthSuccess (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.274389178Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_EmitsAuthSuccess","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.274398411Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback"}
+{"Time":"2026-10-18T09:12:57.274403795Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback","Output":"=== RUN   TestAuthorizeHandler_ServeHTTP_DispatchesToCallback\n"}
+{"Time":"2026-10-18T09:12:57.274719598Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback","Output":"--- PASS: TestAuthorizeHandler_ServeHTTP_DispatchesToCallback (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.274763972Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeHandler_ServeHTTP_DispatchesToCallback","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.27477582Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider"}
+{"Time":"2026-10-18T09:12:57.274803079Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider","Output":"=== RUN   TestFreshLoginRequirementsReachProvider\n"}
+{"Time":"2026-10-18T09:12:57.275490226Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider","Output":"--- PASS: TestFreshLoginRequirementsReachProvider (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.275535331Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestFreshLoginRequirementsReachProvider","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.275551571Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness"}
+{"Time":"2026-10-18T09:12:57.275556837Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness\n"}
+{"Time":"2026-10-18T09:12:57.275708615Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request"}
+{"Time":"2026-10-18T09:12:57.275726704Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request\n"}
+{"Time":"2026-10-18T09:12:57.27611459Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.276132101Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_after_request","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.276229415Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request"}
+{"Time":"2026-10-18T09:12:57.276239388Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request\n"}
+{"Time":"2026-10-18T09:12:57.276537616Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.276555326Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_same_second_as_request","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.276587012Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session"}
+{"Time":"2026-10-18T09:12:57.276592269Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session\n"}
+{"Time":"2026-10-18T09:12:57.276844725Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.276864293Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_reused_session","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.276902661Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time"}
+{"Time":"2026-10-18T09:12:57.276914744Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time\n"}
+{"Time":"2026-10-18T09:12:57.277153242Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.277175262Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/prompt_login_without_auth_time","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.277188941Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login"}
+{"Time":"2026-10-18T09:12:57.277193783Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login\n"}
+{"Time":"2026-10-18T09:12:57.277423209Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.277437402Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_zero_is_prompt_login","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.277458971Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied"}
+{"Time":"2026-10-18T09:12:57.277464508Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/max_age_satisfied\n"}
+{"Time":"2026-10-18T09:12:57.277763538Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/max_age_satisfied (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.27779784Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_satisfied","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.277808372Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded"}
+{"Time":"2026-10-18T09:12:57.277812393Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/max_age_exceeded\n"}
+{"Time":"2026-10-18T09:12:57.278030602Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/max_age_exceeded (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.278057347Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/max_age_exceeded","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.278070756Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested"}
+{"Time":"2026-10-18T09:12:57.278075571Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested","Output":"=== RUN   TestCallbackEnforcesUpstreamFreshness/no_freshness_requested\n"}
+{"Time":"2026-10-18T09:12:57.278448182Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness/no_freshness_requested (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.278484918Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness/no_freshness_requested","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.27856629Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness","Output":"--- PASS: TestCallbackEnforcesUpstreamFreshness (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.278667523Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCallbackEnforcesUpstreamFreshness","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.27868682Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode"}
+{"Time":"2026-10-18T09:12:57.278692555Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode","Output":"=== RUN   TestDiscoveryHandler_ResponseCode\n"}
+{"Time":"2026-10-18T09:12:57.27942154Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode","Output":"--- PASS: TestDiscoveryHandler_ResponseCode (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.279448005Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseCode","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.279453704Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType"}
+{"Time":"2026-10-18T09:12:57.279457699Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType","Output":"=== RUN   TestDiscoveryHandler_ContentType\n"}
+{"Time":"2026-10-18T09:12:57.279766116Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType","Output":"--- PASS: TestDiscoveryHandler_ContentType (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.279780967Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ContentType","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.279863881Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl"}
+{"Time":"2026-10-18T09:12:57.279873673Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl","Output":"=== RUN   TestDiscoveryHandler_CacheControl\n"}
+{"Time":"2026-10-18T09:12:57.280192154Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl","Output":"--- PASS: TestDiscoveryHandler_CacheControl (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.280206365Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CacheControl","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.280233011Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer"}
+{"Time":"2026-10-18T09:12:57.280237574Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer","Output":"=== RUN   TestDiscoveryHandler_Issuer\n"}
+{"Time":"2026-10-18T09:12:57.280841531Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer","Output":"--- PASS: TestDiscoveryHandler_Issuer (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.280865436Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Issuer","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.280872749Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints"}
+{"Time":"2026-10-18T09:12:57.280877059Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints","Output":"=== RUN   TestDiscoveryHandler_Endpoints\n"}
+{"Time":"2026-10-18T09:12:57.281444424Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints","Output":"--- PASS: TestDiscoveryHandler_Endpoints (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.281461719Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Endpoints","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.281473766Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured"}
+{"Time":"2026-10-18T09:12:57.281478167Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured","Output":"=== RUN   TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured\n"}
+{"Time":"2026-10-18T09:12:57.28270426Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured","Output":"--- PASS: TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.282883352Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionAdvertisedWhenConfigured","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.282903415Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty"}
+{"Time":"2026-10-18T09:12:57.28291447Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty","Output":"=== RUN   TestDiscoveryHandler_EndSessionOmittedWhenEmpty\n"}
+{"Time":"2026-10-18T09:12:57.283591777Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty","Output":"--- PASS: TestDiscoveryHandler_EndSessionOmittedWhenEmpty (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.28362377Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_EndSessionOmittedWhenEmpty","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.283630651Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty"}
+{"Time":"2026-10-18T09:12:57.283635349Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty","Output":"=== RUN   TestDiscoveryHandler_UserinfoOmittedWhenEmpty\n"}
+{"Time":"2026-10-18T09:12:57.284216979Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty","Output":"--- PASS: TestDiscoveryHandler_UserinfoOmittedWhenEmpty (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.28423642Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_UserinfoOmittedWhenEmpty","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.284243905Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint"}
+{"Time":"2026-10-18T09:12:57.28424808Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint","Output":"=== RUN   TestDiscoveryHandler_NoRegistrationEndpoint\n"}
+{"Time":"2026-10-18T09:12:57.284804516Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint","Output":"--- PASS: TestDiscoveryHandler_NoRegistrationEndpoint (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.284819115Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_NoRegistrationEndpoint","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.284852668Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes"}
+{"Time":"2026-10-18T09:12:57.284858439Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes","Output":"=== RUN   TestDiscoveryHandler_ResponseTypes\n"}
+{"Time":"2026-10-18T09:12:57.285447545Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes","Output":"--- PASS: TestDiscoveryHandler_ResponseTypes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.285462856Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ResponseTypes","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.285476869Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes"}
+{"Time":"2026-10-18T09:12:57.285481252Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes","Output":"=== RUN   TestDiscoveryHandler_GrantTypes\n"}
+{"Time":"2026-10-18T09:12:57.286058906Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes","Output":"--- PASS: TestDiscoveryHandler_GrantTypes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.286073622Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_GrantTypes","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.28614429Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod"}
+{"Time":"2026-10-18T09:12:57.286157744Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod","Output":"=== RUN   TestDiscoveryHandler_CodeChallengeMethod\n"}
+{"Time":"2026-10-18T09:12:57.286738608Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod","Output":"--- PASS: TestDiscoveryHandler_CodeChallengeMethod (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.286769726Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_CodeChallengeMethod","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.286776742Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg"}
+{"Time":"2026-10-18T09:12:57.286780962Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg","Output":"=== RUN   TestDiscoveryHandler_SigningAlg\n"}
+{"Time":"2026-10-18T09:12:57.287357236Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg","Output":"--- PASS: TestDiscoveryHandler_SigningAlg (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.287376028Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SigningAlg","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.287382917Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes"}
+{"Time":"2026-10-18T09:12:57.287387002Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes","Output":"=== RUN   TestDiscoveryHandler_Scopes\n"}
+{"Time":"2026-10-18T09:12:57.287947235Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes","Output":"--- PASS: TestDiscoveryHandler_Scopes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.287962808Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Scopes","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.288039598Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods"}
+{"Time":"2026-10-18T09:12:57.288049499Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods","Output":"=== RUN   TestDiscoveryHandler_TokenEndpointAuthMethods\n"}
+{"Time":"2026-10-18T09:12:57.288598938Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods","Output":"--- PASS: TestDiscoveryHandler_TokenEndpointAuthMethods (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.288616811Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_TokenEndpointAuthMethods","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.288624178Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims"}
+{"Time":"2026-10-18T09:12:57.28862847Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims","Output":"=== RUN   TestDiscoveryHandler_Claims\n"}
+{"Time":"2026-10-18T09:12:57.289301842Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims","Output":"--- PASS: TestDiscoveryHandler_Claims (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.289329543Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_Claims","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.2893359Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim"}
+{"Time":"2026-10-18T09:12:57.28934021Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim","Output":"=== RUN   TestDiscoveryAdvertisesEveryCoreProfileClaim\n"}
+{"Time":"2026-10-18T09:12:57.289905294Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim","Output":"--- PASS: TestDiscoveryAdvertisesEveryCoreProfileClaim (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.289938234Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryAdvertisesEveryCoreProfileClaim","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.289944357Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes"}
+{"Time":"2026-10-18T09:12:57.289948532Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes","Output":"=== RUN   TestDiscoveryScopesIncludeConfiguredResourceScopes\n"}
+{"Time":"2026-10-18T09:12:57.290623392Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes","Output":"--- PASS: TestDiscoveryScopesIncludeConfiguredResourceScopes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.290653122Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesIncludeConfiguredResourceScopes","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.290661255Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline"}
+{"Time":"2026-10-18T09:12:57.290666089Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline","Output":"=== RUN   TestDiscoveryScopesFallBackToBaseline\n"}
+{"Time":"2026-10-18T09:12:57.291318234Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline","Output":"--- PASS: TestDiscoveryScopesFallBackToBaseline (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.291348478Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryScopesFallBackToBaseline","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.291373239Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes"}
+{"Time":"2026-10-18T09:12:57.291378163Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes","Output":"=== RUN   TestDiscoveryHandler_SubjectTypes\n"}
+{"Time":"2026-10-18T09:12:57.291901281Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes","Output":"--- PASS: TestDiscoveryHandler_SubjectTypes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.29191808Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_SubjectTypes","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.291932336Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported"}
+{"Time":"2026-10-18T09:12:57.2919367Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported","Output":"=== RUN   TestDiscoveryHandler_RequestParameterNotSupported\n"}
+{"Time":"2026-10-18T09:12:57.292517077Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported","Output":"--- PASS: TestDiscoveryHandler_RequestParameterNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.292543381Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_RequestParameterNotSupported","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.292609784Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported"}
+{"Time":"2026-10-18T09:12:57.292621966Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported","Output":"=== RUN   TestDiscoveryHandler_ClaimsParameterNotSupported\n"}
+{"Time":"2026-10-18T09:12:57.293164868Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported","Output":"--- PASS: TestDiscoveryHandler_ClaimsParameterNotSupported (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.293181568Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestDiscoveryHandler_ClaimsParameterNotSupported","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.293217168Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList"}
+{"Time":"2026-10-18T09:12:57.293227321Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList","Output":"=== RUN   TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList\n"}
+{"Time":"2026-10-18T09:12:57.293971253Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList","Output":"--- PASS: TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.293995969Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_EligibleClientRedirectsToAllowList","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.294003887Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected"}
+{"Time":"2026-10-18T09:12:57.294008476Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected","Output":"=== RUN   TestHandoff_PromptCreate_IneligibleClientRejected\n"}
+{"Time":"2026-10-18T09:12:57.294336488Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected","Output":"--- PASS: TestHandoff_PromptCreate_IneligibleClientRejected (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.294361673Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_PromptCreate_IneligibleClientRejected","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.294385479Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken"}
+{"Time":"2026-10-18T09:12:57.294392512Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken","Output":"=== RUN   TestHandoff_ReturnRestartsAuthorizeWithoutToken\n"}
+{"Time":"2026-10-18T09:12:57.295173442Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken","Output":"--- PASS: TestHandoff_ReturnRestartsAuthorizeWithoutToken (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.29520768Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReturnRestartsAuthorizeWithoutToken","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.295214633Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected"}
+{"Time":"2026-10-18T09:12:57.295219529Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected","Output":"=== RUN   TestHandoff_ReplayRejected\n"}
+{"Time":"2026-10-18T09:12:57.296103409Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected","Output":"--- PASS: TestHandoff_ReplayRejected (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.296121786Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_ReplayRejected","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.29619231Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected"}
+{"Time":"2026-10-18T09:12:57.296202075Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected","Output":"=== RUN   TestHandoff_TamperedEnvelopeRejected\n"}
+{"Time":"2026-10-18T09:12:57.296703534Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected","Output":"--- PASS: TestHandoff_TamperedEnvelopeRejected (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.296718403Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_TamperedEnvelopeRejected","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.296787484Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken"}
+{"Time":"2026-10-18T09:12:57.296797367Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken","Output":"=== RUN   TestHandoff_UnknownUserOffersSignupWithoutToken\n"}
+{"Time":"2026-10-18T09:12:57.297418475Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken","Output":"--- PASS: TestHandoff_UnknownUserOffersSignupWithoutToken (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.297437033Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserOffersSignupWithoutToken","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.29746532Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink"}
+{"Time":"2026-10-18T09:12:57.29747018Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink","Output":"=== RUN   TestHandoff_UnknownUserIneligibleHasNoSignupLink\n"}
+{"Time":"2026-10-18T09:12:57.297723493Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink","Output":"--- PASS: TestHandoff_UnknownUserIneligibleHasNoSignupLink (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.29773811Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHandoff_UnknownUserIneligibleHasNoSignupLink","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.297752447Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected"}
+{"Time":"2026-10-18T09:12:57.297756902Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected","Output":"=== RUN   TestAuthorizeCallback_ExpiredStateRejected\n"}
+{"Time":"2026-10-18T09:12:57.297999421Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected","Output":"--- PASS: TestAuthorizeCallback_ExpiredStateRejected (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.298012586Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ExpiredStateRejected","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.298087167Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected"}
+{"Time":"2026-10-18T09:12:57.298097168Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected","Output":"=== RUN   TestAuthorizeCallback_ReplayAfterSuccessRejected\n"}
+{"Time":"2026-10-18T09:12:57.298437614Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected","Output":"--- PASS: TestAuthorizeCallback_ReplayAfterSuccessRejected (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.298462366Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestAuthorizeCallback_ReplayAfterSuccessRejected","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.298551444Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission"}
+{"Time":"2026-10-18T09:12:57.298572698Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission\n"}
+{"Time":"2026-10-18T09:12:57.298615791Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted"}
+{"Time":"2026-10-18T09:12:57.298633988Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted\n"}
+{"Time":"2026-10-18T09:12:57.434741479Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted (0.14s)\n"}
+{"Time":"2026-10-18T09:12:57.434788865Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/omitted","Elapsed":0.14}
+{"Time":"2026-10-18T09:12:57.434814041Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different"}
+{"Time":"2026-10-18T09:12:57.434819875Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different\n"}
+{"Time":"2026-10-18T09:12:57.528500311Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork/stale (0.26s)\n"}
+{"Time":"2026-10-18T09:12:57.528552043Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork/stale","Elapsed":0.26}
+{"Time":"2026-10-18T09:12:57.528566128Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Output":"--- PASS: TestOnlineIdentityMismatchRefusesBeforeNetwork (1.90s)\n"}
+{"Time":"2026-10-18T09:12:57.528582485Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineIdentityMismatchRefusesBeforeNetwork","Elapsed":1.9}
+{"Time":"2026-10-18T09:12:57.528727203Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus"}
+{"Time":"2026-10-18T09:12:57.528747284Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus\n"}
+{"Time":"2026-10-18T09:12:57.528771072Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active"}
+{"Time":"2026-10-18T09:12:57.528780441Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active\n"}
+{"Time":"2026-10-18T09:12:57.628217929Z","Action":"start","Package":"keycape/internal/server/readiness"}
+{"Time":"2026-10-18T09:12:57.628459292Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different (0.19s)\n"}
+{"Time":"2026-10-18T09:12:57.628616862Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/different","Elapsed":0.19}
+{"Time":"2026-10-18T09:12:57.628643671Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix"}
+{"Time":"2026-10-18T09:12:57.628649757Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix\n"}
+{"Time":"2026-10-18T09:12:57.648717014Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses"}
+{"Time":"2026-10-18T09:12:57.648777105Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses","Output":"=== RUN   TestReadyWhenEveryCheckPasses\n"}
+{"Time":"2026-10-18T09:12:57.650061636Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses","Output":"--- PASS: TestReadyWhenEveryCheckPasses (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.650108102Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestReadyWhenEveryCheckPasses","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.650249193Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails"}
+{"Time":"2026-10-18T09:12:57.650263656Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails","Output":"=== RUN   TestNotReadyWhenAnyCheckFails\n"}
+{"Time":"2026-10-18T09:12:57.651070051Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails","Output":"--- PASS: TestNotReadyWhenAnyCheckFails (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.651180323Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestNotReadyWhenAnyCheckFails","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.651298629Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady"}
+{"Time":"2026-10-18T09:12:57.65131376Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady","Output":"=== RUN   TestNilProbeIsNotReady\n"}
+{"Time":"2026-10-18T09:12:57.651846075Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady","Output":"--- PASS: TestNilProbeIsNotReady (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.651880593Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestNilProbeIsNotReady","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.651967943Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed"}
+{"Time":"2026-10-18T09:12:57.651976636Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed","Output":"=== RUN   TestFailureDetailIsNotDisclosed\n"}
+{"Time":"2026-10-18T09:12:57.652425596Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed","Output":"--- PASS: TestFailureDetailIsNotDisclosed (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.65245161Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestFailureDetailIsNotDisclosed","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.652541657Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL"}
+{"Time":"2026-10-18T09:12:57.652550494Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL","Output":"=== RUN   TestResultsAreCachedWithinTheTTL\n"}
+{"Time":"2026-10-18T09:12:57.653574258Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL","Output":"--- PASS: TestResultsAreCachedWithinTheTTL (0.00s)\n"}
+{"Time":"2026-10-18T09:12:57.653604763Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestResultsAreCachedWithinTheTTL","Elapsed":0}
+{"Time":"2026-10-18T09:12:57.653686378Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking"}
+{"Time":"2026-10-18T09:12:57.653694827Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking","Output":"=== RUN   TestSlowProbeTimesOutRatherThanBlocking\n"}
+{"Time":"2026-10-18T09:12:57.704836309Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking","Output":"--- PASS: TestSlowProbeTimesOutRatherThanBlocking (0.05s)\n"}
+{"Time":"2026-10-18T09:12:57.704892866Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestSlowProbeTimesOutRatherThanBlocking","Elapsed":0.05}
+{"Time":"2026-10-18T09:12:57.704905273Z","Action":"run","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently"}
+{"Time":"2026-10-18T09:12:57.704911576Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently","Output":"=== RUN   TestChecksRunConcurrently\n"}
+{"Time":"2026-10-18T09:12:57.796232719Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active (0.27s)\n"}
+{"Time":"2026-10-18T09:12:57.796279041Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-active","Elapsed":0.27}
+{"Time":"2026-10-18T09:12:57.796309591Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type"}
+{"Time":"2026-10-18T09:12:57.796315371Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type\n"}
+{"Time":"2026-10-18T09:12:57.856282278Z","Action":"output","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently","Output":"--- PASS: TestChecksRunConcurrently (0.15s)\n"}
+{"Time":"2026-10-18T09:12:57.856331539Z","Action":"pass","Package":"keycape/internal/server/readiness","Test":"TestChecksRunConcurrently","Elapsed":0.15}
+{"Time":"2026-10-18T09:12:57.85634346Z","Action":"output","Package":"keycape/internal/server/readiness","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:57.960204545Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type (0.16s)\n"}
+{"Time":"2026-10-18T09:12:57.960252129Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-active-type","Elapsed":0.16}
+{"Time":"2026-10-18T09:12:57.960264663Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope"}
+{"Time":"2026-10-18T09:12:57.960269497Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope\n"}
+{"Time":"2026-10-18T09:12:57.971966546Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix (0.34s)\n"}
+{"Time":"2026-10-18T09:12:57.972019558Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/prefix","Elapsed":0.34}
+{"Time":"2026-10-18T09:12:57.972028053Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing"}
+{"Time":"2026-10-18T09:12:57.972032561Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing","Output":"=== RUN   TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing\n"}
+{"Time":"2026-10-18T09:12:57.995607311Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing (0.02s)\n"}
+{"Time":"2026-10-18T09:12:57.995656572Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission/trailing","Elapsed":0.02}
+{"Time":"2026-10-18T09:12:57.995666158Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission","Output":"--- PASS: TestCodeExchangeRejectsRedirectURIMismatchAndOmission (0.70s)\n"}
+{"Time":"2026-10-18T09:12:57.995796132Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsRedirectURIMismatchAndOmission","Elapsed":0.7}
+{"Time":"2026-10-18T09:12:57.9958079Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient"}
+{"Time":"2026-10-18T09:12:57.995812517Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient","Output":"=== RUN   TestCodeExchangeRejectsServiceOnlyClient\n"}
+{"Time":"2026-10-18T09:12:58.04260376Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope (0.08s)\n"}
+{"Time":"2026-10-18T09:12:58.042665583Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/missing-scope","Elapsed":0.08}
+{"Time":"2026-10-18T09:12:58.042675366Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope"}
+{"Time":"2026-10-18T09:12:58.042680668Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope\n"}
+{"Time":"2026-10-18T09:12:58.136220045Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope (0.09s)\n"}
+{"Time":"2026-10-18T09:12:58.136262453Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/null-scope","Elapsed":0.09}
+{"Time":"2026-10-18T09:12:58.136278233Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client"}
+{"Time":"2026-10-18T09:12:58.13628303Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client\n"}
+{"Time":"2026-10-18T09:12:58.161649561Z","Action":"output","Package":"keycape/internal/server/policy","Output":"ok  \tkeycape/internal/server/policy\t1.144s\n"}
+{"Time":"2026-10-18T09:12:58.161694034Z","Action":"pass","Package":"keycape/internal/server/policy","Elapsed":1.145}
+{"Time":"2026-10-18T09:12:58.187518788Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient","Output":"--- PASS: TestCodeExchangeRejectsServiceOnlyClient (0.19s)\n"}
+{"Time":"2026-10-18T09:12:58.18758447Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeRejectsServiceOnlyClient","Elapsed":0.19}
+{"Time":"2026-10-18T09:12:58.187598618Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient"}
+{"Time":"2026-10-18T09:12:58.187607581Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient","Output":"=== RUN   TestCodeExchangeAllowsImplicitAuthorizationCodeClient\n"}
+{"Time":"2026-10-18T09:12:58.289450002Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient","Output":"--- PASS: TestCodeExchangeAllowsImplicitAuthorizationCodeClient (0.10s)\n"}
+{"Time":"2026-10-18T09:12:58.289514439Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestCodeExchangeAllowsImplicitAuthorizationCodeClient","Elapsed":0.1}
+{"Time":"2026-10-18T09:12:58.289532401Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret"}
+{"Time":"2026-10-18T09:12:58.289537451Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret\n"}
+{"Time":"2026-10-18T09:12:58.289688742Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials"}
+{"Time":"2026-10-18T09:12:58.289708066Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/no_credentials\n"}
+{"Time":"2026-10-18T09:12:58.333912694Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/no_credentials (0.04s)\n"}
+{"Time":"2026-10-18T09:12:58.33400632Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/no_credentials","Elapsed":0.04}
+{"Time":"2026-10-18T09:12:58.334028872Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret"}
+{"Time":"2026-10-18T09:12:58.33403715Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/wrong_secret\n"}
+{"Time":"2026-10-18T09:12:58.356352238Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client (0.22s)\n"}
+{"Time":"2026-10-18T09:12:58.356406044Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-client","Elapsed":0.22}
+{"Time":"2026-10-18T09:12:58.356415863Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject"}
+{"Time":"2026-10-18T09:12:58.356421589Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject\n"}
+{"Time":"2026-10-18T09:12:58.381475832Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/wrong_secret (0.05s)\n"}
+{"Time":"2026-10-18T09:12:58.381536636Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/wrong_secret","Elapsed":0.05}
+{"Time":"2026-10-18T09:12:58.381551884Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity"}
+{"Time":"2026-10-18T09:12:58.381557132Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/other_client_identity\n"}
+{"Time":"2026-10-18T09:12:58.434247595Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/other_client_identity (0.05s)\n"}
+{"Time":"2026-10-18T09:12:58.434327948Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/other_client_identity","Elapsed":0.05}
+{"Time":"2026-10-18T09:12:58.43440381Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret"}
+{"Time":"2026-10-18T09:12:58.434455884Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret","Output":"=== RUN   TestConfidentialCodeClientRequiresItsSecret/correct_secret\n"}
+{"Time":"2026-10-18T09:12:58.462918412Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject (0.11s)\n"}
+{"Time":"2026-10-18T09:12:58.462979558Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-subject","Elapsed":0.11}
+{"Time":"2026-10-18T09:12:58.462999766Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer"}
+{"Time":"2026-10-18T09:12:58.463007115Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer\n"}
+{"Time":"2026-10-18T09:12:58.527118537Z","Action":"start","Package":"keycape/internal/server/telemetry"}
+{"Time":"2026-10-18T09:12:58.530157539Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer (0.07s)\n"}
+{"Time":"2026-10-18T09:12:58.530199623Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issuer","Elapsed":0.07}
+{"Time":"2026-10-18T09:12:58.530321215Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience"}
+{"Time":"2026-10-18T09:12:58.530335282Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience\n"}
+{"Time":"2026-10-18T09:12:58.545120316Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic"}
+{"Time":"2026-10-18T09:12:58.545176719Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic","Output":"=== RUN   TestNoopEmitter_DoesNotPanic\n"}
+{"Time":"2026-10-18T09:12:58.545349939Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic","Output":"--- PASS: TestNoopEmitter_DoesNotPanic (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.545467669Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_DoesNotPanic","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.54548637Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface"}
+{"Time":"2026-10-18T09:12:58.545490987Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface","Output":"=== RUN   TestNoopEmitter_ImplementsInterface\n"}
+{"Time":"2026-10-18T09:12:58.5457353Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface","Output":"--- PASS: TestNoopEmitter_ImplementsInterface (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.545868404Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestNoopEmitter_ImplementsInterface","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.545892372Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON"}
+{"Time":"2026-10-18T09:12:58.545897349Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON","Output":"=== RUN   TestLogEmitter_WritesJSON\n"}
+{"Time":"2026-10-18T09:12:58.546524653Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON","Output":"--- PASS: TestLogEmitter_WritesJSON (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.54658304Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_WritesJSON","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.546596972Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields"}
+{"Time":"2026-10-18T09:12:58.546603176Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields","Output":"=== RUN   TestLogEmitter_ContainsEventFields\n"}
+{"Time":"2026-10-18T09:12:58.546991349Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields","Output":"--- PASS: TestLogEmitter_ContainsEventFields (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.547022053Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ContainsEventFields","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.547112965Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue"}
+{"Time":"2026-10-18T09:12:58.54714457Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue","Output":"=== RUN   TestLogEmitter_EventTypeValue\n"}
+{"Time":"2026-10-18T09:12:58.547517388Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue","Output":"--- PASS: TestLogEmitter_EventTypeValue (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.547547741Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_EventTypeValue","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.54764299Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface"}
+{"Time":"2026-10-18T09:12:58.547655866Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface","Output":"=== RUN   TestLogEmitter_ImplementsInterface\n"}
+{"Time":"2026-10-18T09:12:58.547909549Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface","Output":"--- PASS: TestLogEmitter_ImplementsInterface (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.547930315Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestLogEmitter_ImplementsInterface","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.54803029Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut"}
+{"Time":"2026-10-18T09:12:58.548043897Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut","Output":"=== RUN   TestMultiEmitter_FansOut\n"}
+{"Time":"2026-10-18T09:12:58.548316335Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut","Output":"--- PASS: TestMultiEmitter_FansOut (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.548335181Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_FansOut","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.548427517Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop"}
+{"Time":"2026-10-18T09:12:58.548440142Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop","Output":"=== RUN   TestMultiEmitter_EmptyIsNoop\n"}
+{"Time":"2026-10-18T09:12:58.54869792Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop","Output":"--- PASS: TestMultiEmitter_EmptyIsNoop (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.54872316Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_EmptyIsNoop","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.54880904Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface"}
+{"Time":"2026-10-18T09:12:58.548822061Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface","Output":"=== RUN   TestMultiEmitter_ImplementsInterface\n"}
+{"Time":"2026-10-18T09:12:58.549071756Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface","Output":"--- PASS: TestMultiEmitter_ImplementsInterface (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.549102234Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestMultiEmitter_ImplementsInterface","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.549112865Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip"}
+{"Time":"2026-10-18T09:12:58.549119006Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip","Output":"=== RUN   TestWithEmitter_RoundTrip\n"}
+{"Time":"2026-10-18T09:12:58.549355601Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip","Output":"--- PASS: TestWithEmitter_RoundTrip (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.549371417Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestWithEmitter_RoundTrip","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.549404709Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop"}
+{"Time":"2026-10-18T09:12:58.5494113Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop","Output":"=== RUN   TestEmitterFromContext_FallsBackToNoop\n"}
+{"Time":"2026-10-18T09:12:58.549656497Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop","Output":"--- PASS: TestEmitterFromContext_FallsBackToNoop (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.549739258Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestEmitterFromContext_FallsBackToNoop","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.549750646Z","Action":"run","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants"}
+{"Time":"2026-10-18T09:12:58.549756562Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants","Output":"=== RUN   TestEventTypeConstants\n"}
+{"Time":"2026-10-18T09:12:58.549937024Z","Action":"output","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants","Output":"--- PASS: TestEventTypeConstants (0.00s)\n"}
+{"Time":"2026-10-18T09:12:58.550054681Z","Action":"pass","Package":"keycape/internal/server/telemetry","Test":"TestEventTypeConstants","Elapsed":0}
+{"Time":"2026-10-18T09:12:58.550170554Z","Action":"output","Package":"keycape/internal/server/telemetry","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:58.747745447Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret/correct_secret (0.31s)\n"}
+{"Time":"2026-10-18T09:12:58.747794852Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret/correct_secret","Elapsed":0.31}
+{"Time":"2026-10-18T09:12:58.74781084Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret","Output":"--- PASS: TestConfidentialCodeClientRequiresItsSecret (0.46s)\n"}
+{"Time":"2026-10-18T09:12:58.747934394Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConfidentialCodeClientRequiresItsSecret","Elapsed":0.46}
+{"Time":"2026-10-18T09:12:58.747946234Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected"}
+{"Time":"2026-10-18T09:12:58.747950319Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected","Output":"=== RUN   TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected\n"}
+{"Time":"2026-10-18T09:12:58.81689839Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience (0.29s)\n"}
+{"Time":"2026-10-18T09:12:58.816952349Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-audience","Elapsed":0.29}
+{"Time":"2026-10-18T09:12:58.817118618Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti"}
+{"Time":"2026-10-18T09:12:58.817138844Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti\n"}
+{"Time":"2026-10-18T09:12:58.860691933Z","Action":"output","Package":"keycape/internal/server/readiness","Output":"ok  \tkeycape/internal/server/readiness\t1.232s\n"}
+{"Time":"2026-10-18T09:12:58.860738706Z","Action":"pass","Package":"keycape/internal/server/readiness","Elapsed":1.233}
+{"Time":"2026-10-18T09:12:59.132880322Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected","Output":"--- PASS: TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected (0.38s)\n"}
+{"Time":"2026-10-18T09:12:59.132954814Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPublicClientSecretIsIgnoredAndEmptyConfidentialSecretIsRejected","Elapsed":0.38}
+{"Time":"2026-10-18T09:12:59.132972767Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce"}
+{"Time":"2026-10-18T09:12:59.132978727Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce","Output":"=== RUN   TestConcurrentCodeExchangeSucceedsExactlyOnce\n"}
+{"Time":"2026-10-18T09:12:59.229756351Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce","Output":"--- PASS: TestConcurrentCodeExchangeSucceedsExactlyOnce (0.10s)\n"}
+{"Time":"2026-10-18T09:12:59.229824549Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestConcurrentCodeExchangeSucceedsExactlyOnce","Elapsed":0.1}
+{"Time":"2026-10-18T09:12:59.229851961Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode"}
+{"Time":"2026-10-18T09:12:59.22986519Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode","Output":"=== RUN   TestFailedExchangeConsumesTheCode\n"}
+{"Time":"2026-10-18T09:12:59.314202294Z","Action":"start","Package":"keycape/internal/validator"}
+{"Time":"2026-10-18T09:12:59.338058355Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode","Output":"--- PASS: TestFailedExchangeConsumesTheCode (0.11s)\n"}
+{"Time":"2026-10-18T09:12:59.338111917Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestFailedExchangeConsumesTheCode","Elapsed":0.11}
+{"Time":"2026-10-18T09:12:59.33813685Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes"}
+{"Time":"2026-10-18T09:12:59.338143811Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes\n"}
+{"Time":"2026-10-18T09:12:59.338379194Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token"}
+{"Time":"2026-10-18T09:12:59.338410168Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token\n"}
+{"Time":"2026-10-18T09:12:59.342711571Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass"}
+{"Time":"2026-10-18T09:12:59.342767911Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass","Output":"=== RUN   TestValidDNStructure_Pass\n"}
+{"Time":"2026-10-18T09:12:59.342975191Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass","Output":"--- PASS: TestValidDNStructure_Pass (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.342996282Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_Pass","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.343008266Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID"}
+{"Time":"2026-10-18T09:12:59.34302199Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID","Output":"=== RUN   TestValidDNStructure_EmptyID\n"}
+{"Time":"2026-10-18T09:12:59.343259667Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID","Output":"--- PASS: TestValidDNStructure_EmptyID (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.34327533Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_EmptyID","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.343302896Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername"}
+{"Time":"2026-10-18T09:12:59.343318558Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername","Output":"=== RUN   TestValidDNStructure_InvalidUsername\n"}
+{"Time":"2026-10-18T09:12:59.343602764Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername","Output":"--- PASS: TestValidDNStructure_InvalidUsername (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.343619906Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidUsername","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.343629816Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName"}
+{"Time":"2026-10-18T09:12:59.343635749Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName","Output":"=== RUN   TestValidDNStructure_InvalidGroupName\n"}
+{"Time":"2026-10-18T09:12:59.344243344Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName","Output":"--- PASS: TestValidDNStructure_InvalidGroupName (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.344285013Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidDNStructure_InvalidGroupName","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.344542762Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass"}
+{"Time":"2026-10-18T09:12:59.344557794Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass","Output":"=== RUN   TestRequiredAttributesPresent_Pass\n"}
+{"Time":"2026-10-18T09:12:59.345003097Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass","Output":"--- PASS: TestRequiredAttributesPresent_Pass (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.345069401Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_Pass","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.345078644Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername"}
+{"Time":"2026-10-18T09:12:59.345084568Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername","Output":"=== RUN   TestRequiredAttributesPresent_MissingUsername\n"}
+{"Time":"2026-10-18T09:12:59.345523374Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername","Output":"--- PASS: TestRequiredAttributesPresent_MissingUsername (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.345561445Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingUsername","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.345721727Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName"}
+{"Time":"2026-10-18T09:12:59.345739139Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName","Output":"=== RUN   TestRequiredAttributesPresent_MissingDisplayName\n"}
+{"Time":"2026-10-18T09:12:59.34601907Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName","Output":"--- PASS: TestRequiredAttributesPresent_MissingDisplayName (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.346059161Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRequiredAttributesPresent_MissingDisplayName","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.346112489Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes"}
+{"Time":"2026-10-18T09:12:59.346131543Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes\n"}
+{"Time":"2026-10-18T09:12:59.346512894Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid"}
+{"Time":"2026-10-18T09:12:59.346586096Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid\n"}
+{"Time":"2026-10-18T09:12:59.34695264Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.346988763Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/numeric_oid","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.347042487Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes"}
+{"Time":"2026-10-18T09:12:59.347052974Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes\n"}
+{"Time":"2026-10-18T09:12:59.347347938Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.347379146Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/distinct_attributes","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.347535301Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes"}
+{"Time":"2026-10-18T09:12:59.347565689Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/no_attributes\n"}
+{"Time":"2026-10-18T09:12:59.34777103Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/no_attributes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.347785962Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/no_attributes","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.347802788Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor"}
+{"Time":"2026-10-18T09:12:59.347808054Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor\n"}
+{"Time":"2026-10-18T09:12:59.348186407Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.348213089Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/simple_descriptor","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.348224135Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits"}
+{"Time":"2026-10-18T09:12:59.348230375Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits","Output":"=== RUN   TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits\n"}
+{"Time":"2026-10-18T09:12:59.34824693Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.348284523Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes/hyphenated_and_digits","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.348445883Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes","Output":"--- PASS: TestRawAttributes_AcceptsLegitimateAttributes (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.348466433Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_AcceptsLegitimateAttributes","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.348475937Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors"}
+{"Time":"2026-10-18T09:12:59.348482231Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors\n"}
+{"Time":"2026-10-18T09:12:59.348666584Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside"}
+{"Time":"2026-10-18T09:12:59.348681895Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/space_inside\n"}
+{"Time":"2026-10-18T09:12:59.348913813Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/space_inside (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.348938475Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/space_inside","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.348956482Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid"}
+{"Time":"2026-10-18T09:12:59.348963164Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid\n"}
+{"Time":"2026-10-18T09:12:59.349158609Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.349178438Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_zero_oid","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.349188862Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc"}
+{"Time":"2026-10-18T09:12:59.349195463Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc\n"}
+{"Time":"2026-10-18T09:12:59.349609701Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.349632929Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/non_numeric_oid_arc","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.349640197Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank"}
+{"Time":"2026-10-18T09:12:59.349648304Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/blank\n"}
+{"Time":"2026-10-18T09:12:59.349781524Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/blank (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.349825411Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/blank","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.350211936Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit"}
+{"Time":"2026-10-18T09:12:59.350235471Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/leading_digit\n"}
+{"Time":"2026-10-18T09:12:59.350245516Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/leading_digit (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.350251531Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_digit","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.350257816Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen"}
+{"Time":"2026-10-18T09:12:59.350262279Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen\n"}
+{"Time":"2026-10-18T09:12:59.350270945Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.350408338Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/leading_hyphen","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.350460313Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore"}
+{"Time":"2026-10-18T09:12:59.350467816Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/underscore\n"}
+{"Time":"2026-10-18T09:12:59.350660298Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/underscore (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.350676538Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/underscore","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.350787326Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option"}
+{"Time":"2026-10-18T09:12:59.350803873Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/transfer_option\n"}
+{"Time":"2026-10-18T09:12:59.350950807Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/transfer_option (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.351049636Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/transfer_option","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.35106538Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid"}
+{"Time":"2026-10-18T09:12:59.351071457Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid\n"}
+{"Time":"2026-10-18T09:12:59.351317577Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.351345377Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/single_arc_oid","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.351362248Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc"}
+{"Time":"2026-10-18T09:12:59.351382483Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc\n"}
+{"Time":"2026-10-18T09:12:59.351553563Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.351574745Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/empty_oid_arc","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.351774246Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only"}
+{"Time":"2026-10-18T09:12:59.351791794Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only","Output":"=== RUN   TestRawAttributes_RejectsMalformedDescriptors/whitespace_only\n"}
+{"Time":"2026-10-18T09:12:59.351970624Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors/whitespace_only (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.351988938Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors/whitespace_only","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.352148706Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors","Output":"--- PASS: TestRawAttributes_RejectsMalformedDescriptors (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.352165315Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsMalformedDescriptors","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.352185334Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings"}
+{"Time":"2026-10-18T09:12:59.352193503Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings\n"}
+{"Time":"2026-10-18T09:12:59.352421209Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid"}
+{"Time":"2026-10-18T09:12:59.35244056Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/uid\n"}
+{"Time":"2026-10-18T09:12:59.352560902Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/uid (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.352590758Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/uid","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.352631065Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn"}
+{"Time":"2026-10-18T09:12:59.352640479Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/cn\n"}
+{"Time":"2026-10-18T09:12:59.35284472Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/cn (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.352865748Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cn","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.352882836Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail"}
+{"Time":"2026-10-18T09:12:59.35288931Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/mail\n"}
+{"Time":"2026-10-18T09:12:59.353074876Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/mail (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.353090296Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/mail","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.35311531Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID"}
+{"Time":"2026-10-18T09:12:59.353127384Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/UID\n"}
+{"Time":"2026-10-18T09:12:59.353306174Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/UID (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.353331864Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/UID","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.353341422Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail"}
+{"Time":"2026-10-18T09:12:59.353347662Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/Mail\n"}
+{"Time":"2026-10-18T09:12:59.35364675Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/Mail (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.353682269Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/Mail","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.353827249Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN"}
+{"Time":"2026-10-18T09:12:59.353840143Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN","Output":"=== RUN   TestRawAttributes_RejectsCanonicalMappings/cN\n"}
+{"Time":"2026-10-18T09:12:59.354056701Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings/cN (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.35408002Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings/cN","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.35427665Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings","Output":"--- PASS: TestRawAttributes_RejectsCanonicalMappings (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.354290167Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCanonicalMappings","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.354298625Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates"}
+{"Time":"2026-10-18T09:12:59.354303531Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates","Output":"=== RUN   TestRawAttributes_RejectsCaseOnlyDuplicates\n"}
+{"Time":"2026-10-18T09:12:59.354613084Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates","Output":"--- PASS: TestRawAttributes_RejectsCaseOnlyDuplicates (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.354638756Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_RejectsCaseOnlyDuplicates","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.354651912Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute"}
+{"Time":"2026-10-18T09:12:59.354656619Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute","Output":"=== RUN   TestRawAttributes_MessageNamesUserAndAttribute\n"}
+{"Time":"2026-10-18T09:12:59.354890013Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute","Output":"--- PASS: TestRawAttributes_MessageNamesUserAndAttribute (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.354912186Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_MessageNamesUserAndAttribute","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.354929986Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass"}
+{"Time":"2026-10-18T09:12:59.354937732Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass","Output":"=== RUN   TestValidGroupMemberships_Pass\n"}
+{"Time":"2026-10-18T09:12:59.35512804Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass","Output":"--- PASS: TestValidGroupMemberships_Pass (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.355145136Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_Pass","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.355152684Z","Action":"run","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember"}
+{"Time":"2026-10-18T09:12:59.355157273Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember","Output":"=== RUN   TestValidGroupMemberships_BlankMember\n"}
+{"Time":"2026-10-18T09:12:59.35540653Z","Action":"output","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember","Output":"--- PASS: TestValidGroupMemberships_BlankMember (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.355496305Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestValidGroupMemberships_BlankMember","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.355510453Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass"}
+{"Time":"2026-10-18T09:12:59.355515359Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass","Output":"=== RUN   TestReferencedUsersExist_Pass\n"}
+{"Time":"2026-10-18T09:12:59.355760538Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass","Output":"--- PASS: TestReferencedUsersExist_Pass (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.355776625Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_Pass","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.35595797Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser"}
+{"Time":"2026-10-18T09:12:59.35596348Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser","Output":"=== RUN   TestReferencedUsersExist_UnknownUser\n"}
+{"Time":"2026-10-18T09:12:59.355972326Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser","Output":"--- PASS: TestReferencedUsersExist_UnknownUser (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.356090037Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReferencedUsersExist_UnknownUser","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.356119379Z","Action":"run","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass"}
+{"Time":"2026-10-18T09:12:59.356125574Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass","Output":"=== RUN   TestNoCyclicGroups_Pass\n"}
+{"Time":"2026-10-18T09:12:59.356357669Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass","Output":"--- PASS: TestNoCyclicGroups_Pass (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.356379437Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_Pass","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.356395767Z","Action":"run","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers"}
+{"Time":"2026-10-18T09:12:59.356401132Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers","Output":"=== RUN   TestNoCyclicGroups_GroupInMembers\n"}
+{"Time":"2026-10-18T09:12:59.356667953Z","Action":"output","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers","Output":"--- PASS: TestNoCyclicGroups_GroupInMembers (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.35668495Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestNoCyclicGroups_GroupInMembers","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.356693733Z","Action":"run","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass"}
+{"Time":"2026-10-18T09:12:59.356698278Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass","Output":"=== RUN   TestUsernamesUnique_Pass\n"}
+{"Time":"2026-10-18T09:12:59.356942677Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass","Output":"--- PASS: TestUsernamesUnique_Pass (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.356967989Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Pass","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.356976023Z","Action":"run","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate"}
+{"Time":"2026-10-18T09:12:59.356981893Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate","Output":"=== RUN   TestUsernamesUnique_Duplicate\n"}
+{"Time":"2026-10-18T09:12:59.357009486Z","Action":"output","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate","Output":"--- PASS: TestUsernamesUnique_Duplicate (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.357192951Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestUsernamesUnique_Duplicate","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.357209038Z","Action":"run","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass"}
+{"Time":"2026-10-18T09:12:59.357219254Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass","Output":"=== RUN   TestEmailFormatValid_Pass\n"}
+{"Time":"2026-10-18T09:12:59.357401565Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass","Output":"--- PASS: TestEmailFormatValid_Pass (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.357416912Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_Pass","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.357436173Z","Action":"run","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail"}
+{"Time":"2026-10-18T09:12:59.357442431Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail","Output":"=== RUN   TestEmailFormatValid_InvalidEmail\n"}
+{"Time":"2026-10-18T09:12:59.357708584Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail","Output":"--- PASS: TestEmailFormatValid_InvalidEmail (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.357725059Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_InvalidEmail","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.357734924Z","Action":"run","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped"}
+{"Time":"2026-10-18T09:12:59.357758152Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped","Output":"=== RUN   TestEmailFormatValid_EmptyEmailSkipped\n"}
+{"Time":"2026-10-18T09:12:59.357952636Z","Action":"output","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped","Output":"--- PASS: TestEmailFormatValid_EmptyEmailSkipped (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.357968552Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestEmailFormatValid_EmptyEmailSkipped","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.35797848Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood"}
+{"Time":"2026-10-18T09:12:59.357985549Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood","Output":"=== RUN   TestReportPassed_AllGood\n"}
+{"Time":"2026-10-18T09:12:59.358234894Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood","Output":"--- PASS: TestReportPassed_AllGood (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.358263533Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReportPassed_AllGood","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.35827962Z","Action":"run","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails"}
+{"Time":"2026-10-18T09:12:59.358288925Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails","Output":"=== RUN   TestReportFailed_OneRuleFails\n"}
+{"Time":"2026-10-18T09:12:59.358476621Z","Action":"output","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails","Output":"--- PASS: TestReportFailed_OneRuleFails (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.358607299Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestReportFailed_OneRuleFails","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.358625162Z","Action":"run","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport"}
+{"Time":"2026-10-18T09:12:59.358631366Z","Action":"output","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport","Output":"=== RUN   TestModeRecordedInReport\n"}
+{"Time":"2026-10-18T09:12:59.358872586Z","Action":"output","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport","Output":"--- PASS: TestModeRecordedInReport (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.359290222Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestModeRecordedInReport","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.359613302Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations"}
+{"Time":"2026-10-18T09:12:59.359638595Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations","Output":"=== RUN   TestRawAttributes_IgnoresToolingAnnotations\n"}
+{"Time":"2026-10-18T09:12:59.360193219Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations","Output":"--- PASS: TestRawAttributes_IgnoresToolingAnnotations (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.360225798Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_IgnoresToolingAnnotations","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.360236772Z","Action":"run","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule"}
+{"Time":"2026-10-18T09:12:59.360242579Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule","Output":"=== RUN   TestRawAttributes_ExemptionDoesNotWeakenTheRule\n"}
+{"Time":"2026-10-18T09:12:59.360578598Z","Action":"output","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule","Output":"--- PASS: TestRawAttributes_ExemptionDoesNotWeakenTheRule (0.00s)\n"}
+{"Time":"2026-10-18T09:12:59.360604442Z","Action":"pass","Package":"keycape/internal/validator","Test":"TestRawAttributes_ExemptionDoesNotWeakenTheRule","Elapsed":0}
+{"Time":"2026-10-18T09:12:59.360632161Z","Action":"output","Package":"keycape/internal/validator","Output":"PASS\n"}
+{"Time":"2026-10-18T09:12:59.497453867Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti (0.68s)\n"}
+{"Time":"2026-10-18T09:12:59.497506672Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-jti","Elapsed":0.68}
+{"Time":"2026-10-18T09:12:59.497515103Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry"}
+{"Time":"2026-10-18T09:12:59.49751991Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry\n"}
+{"Time":"2026-10-18T09:12:59.554076664Z","Action":"output","Package":"keycape/internal/server/telemetry","Output":"ok  \tkeycape/internal/server/telemetry\t1.027s\n"}
+{"Time":"2026-10-18T09:12:59.554125312Z","Action":"pass","Package":"keycape/internal/server/telemetry","Elapsed":1.027}
+{"Time":"2026-10-18T09:12:59.567234479Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry (0.07s)\n"}
+{"Time":"2026-10-18T09:12:59.567292009Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-expiry","Elapsed":0.07}
+{"Time":"2026-10-18T09:12:59.567323443Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued"}
+{"Time":"2026-10-18T09:12:59.567333083Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued\n"}
+{"Time":"2026-10-18T09:12:59.598586507Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token (0.26s)\n"}
+{"Time":"2026-10-18T09:12:59.598645669Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/accepts_a_well-formed_access_token","Elapsed":0.26}
+{"Time":"2026-10-18T09:12:59.598656363Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer"}
+{"Time":"2026-10-18T09:12:59.598661512Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer\n"}
+{"Time":"2026-10-18T09:12:59.765435178Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer (0.17s)\n"}
+{"Time":"2026-10-18T09:12:59.76551031Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/foreign_issuer","Elapsed":0.17}
+{"Time":"2026-10-18T09:12:59.765522871Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer"}
+{"Time":"2026-10-18T09:12:59.765529949Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer\n"}
+{"Time":"2026-10-18T09:12:59.835962437Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued (0.27s)\n"}
+{"Time":"2026-10-18T09:12:59.836044296Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-issued","Elapsed":0.27}
+{"Time":"2026-10-18T09:12:59.836212116Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope"}
+{"Time":"2026-10-18T09:12:59.836226706Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope\n"}
+{"Time":"2026-10-18T09:12:59.931250744Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope (0.09s)\n"}
+{"Time":"2026-10-18T09:12:59.931487873Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-scope","Elapsed":0.09}
+{"Time":"2026-10-18T09:12:59.931516458Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type"}
+{"Time":"2026-10-18T09:12:59.931525259Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type\n"}
+{"Time":"2026-10-18T09:13:00.008261135Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer (0.24s)\n"}
+{"Time":"2026-10-18T09:13:00.008314995Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/missing_issuer","Elapsed":0.24}
+{"Time":"2026-10-18T09:13:00.00832678Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token"}
+{"Time":"2026-10-18T09:13:00.008341866Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token","Output":"=== RUN   TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token\n"}
+{"Time":"2026-10-18T09:13:00.17317175Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type (0.24s)\n"}
+{"Time":"2026-10-18T09:13:00.17328571Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-token-type","Elapsed":0.24}
+{"Time":"2026-10-18T09:13:00.173304051Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field"}
+{"Time":"2026-10-18T09:13:00.173312563Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field\n"}
+{"Time":"2026-10-18T09:13:00.210610837Z","Action":"start","Package":"keycape/tests/conformance"}
+{"Time":"2026-10-18T09:13:00.243606875Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself"}
+{"Time":"2026-10-18T09:13:00.243659112Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Output":"=== RUN   TestIssuerAdvertisesItself\n"}
+{"Time":"2026-10-18T09:13:00.244573166Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Output":"    external_test.go:101: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T09:13:00.244676359Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Output":"--- SKIP: TestIssuerAdvertisesItself (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.244840832Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestIssuerAdvertisesItself","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.245139713Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface"}
+{"Time":"2026-10-18T09:13:00.245167838Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Output":"=== RUN   TestProfileAuthorizationSurface\n"}
+{"Time":"2026-10-18T09:13:00.246038299Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Output":"    external_test.go:111: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T09:13:00.246102375Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Output":"--- SKIP: TestProfileAuthorizationSurface (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.246318019Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestProfileAuthorizationSurface","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.246527896Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable"}
+{"Time":"2026-10-18T09:13:00.246550511Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Output":"=== RUN   TestPublishedKeysAreUsable\n"}
+{"Time":"2026-10-18T09:13:00.246836008Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Output":"    external_test.go:145: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T09:13:00.246901185Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Output":"--- SKIP: TestPublishedKeysAreUsable (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.247095678Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestPublishedKeysAreUsable","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.24712016Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised"}
+{"Time":"2026-10-18T09:13:00.24712677Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Output":"=== RUN   TestExcludedGrantsAreNotAdvertised\n"}
+{"Time":"2026-10-18T09:13:00.247621786Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Output":"    external_test.go:162: KEYCAPE_TEST_ISSUER is not set; this suite targets a running issuer\n"}
+{"Time":"2026-10-18T09:13:00.247674672Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Output":"--- SKIP: TestExcludedGrantsAreNotAdvertised (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.247923901Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestExcludedGrantsAreNotAdvertised","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.247964722Z","Action":"run","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys"}
+{"Time":"2026-10-18T09:13:00.247973839Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Output":"=== RUN   TestServiceTokenVerifiesAgainstPublishedKeys\n"}
+{"Time":"2026-10-18T09:13:00.248282714Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Output":"    external_test.go:177: KEYCAPE_TEST_CLIENT_ID/SECRET not set; skipping token exchange\n"}
+{"Time":"2026-10-18T09:13:00.248329974Z","Action":"output","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Output":"--- SKIP: TestServiceTokenVerifiesAgainstPublishedKeys (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.248551285Z","Action":"skip","Package":"keycape/tests/conformance","Test":"TestServiceTokenVerifiesAgainstPublishedKeys","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.248607589Z","Action":"output","Package":"keycape/tests/conformance","Output":"PASS\n"}
+{"Time":"2026-10-18T09:13:00.284014412Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field (0.11s)\n"}
+{"Time":"2026-10-18T09:13:00.284066622Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unknown-field","Elapsed":0.11}
+{"Time":"2026-10-18T09:13:00.284076604Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active"}
+{"Time":"2026-10-18T09:13:00.284082763Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active\n"}
+{"Time":"2026-10-18T09:13:00.365496422Z","Action":"output","Package":"keycape/internal/validator","Output":"ok  \tkeycape/internal/validator\t1.051s\n"}
+{"Time":"2026-10-18T09:13:00.365587794Z","Action":"pass","Package":"keycape/internal/validator","Elapsed":1.051}
+{"Time":"2026-10-18T09:13:00.444963682Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token (0.44s)\n"}
+{"Time":"2026-10-18T09:13:00.445016848Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes/id_token_presented_as_access_token","Elapsed":0.44}
+{"Time":"2026-10-18T09:13:00.445318765Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes","Output":"--- PASS: TestUserinfoRejectsUnverifiedTokenShapes (1.11s)\n"}
+{"Time":"2026-10-18T09:13:00.44534588Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsUnverifiedTokenShapes","Elapsed":1.11}
+{"Time":"2026-10-18T09:13:00.445445835Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms"}
+{"Time":"2026-10-18T09:13:00.445459Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms","Output":"=== RUN   TestUserinfoRejectsNonRS256Algorithms\n"}
+{"Time":"2026-10-18T09:13:00.595771085Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms","Output":"--- PASS: TestUserinfoRejectsNonRS256Algorithms (0.15s)\n"}
+{"Time":"2026-10-18T09:13:00.595822312Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoRejectsNonRS256Algorithms","Elapsed":0.15}
+{"Time":"2026-10-18T09:13:00.595831744Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode"}
+{"Time":"2026-10-18T09:13:00.595836613Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode","Output":"=== RUN   TestJWKSHandler_ResponseCode\n"}
+{"Time":"2026-10-18T09:13:00.707800961Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active (0.42s)\n"}
+{"Time":"2026-10-18T09:13:00.707865885Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/duplicate-active","Elapsed":0.42}
+{"Time":"2026-10-18T09:13:00.707884596Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json"}
+{"Time":"2026-10-18T09:13:00.707897599Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json\n"}
+{"Time":"2026-10-18T09:13:00.780981589Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode","Output":"--- PASS: TestJWKSHandler_ResponseCode (0.18s)\n"}
+{"Time":"2026-10-18T09:13:00.781050003Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ResponseCode","Elapsed":0.18}
+{"Time":"2026-10-18T09:13:00.781063637Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType"}
+{"Time":"2026-10-18T09:13:00.781070121Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType","Output":"=== RUN   TestJWKSHandler_ContentType\n"}
+{"Time":"2026-10-18T09:13:00.796877072Z","Action":"start","Package":"keycape/tests/migration"}
+{"Time":"2026-10-18T09:13:00.824777254Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients"}
+{"Time":"2026-10-18T09:13:00.824829013Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients","Output":"=== RUN   TestScenarioBRealmPreservesClients\n"}
+{"Time":"2026-10-18T09:13:00.825125714Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients","Output":"--- PASS: TestScenarioBRealmPreservesClients (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.825148365Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBRealmPreservesClients","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.825159068Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow"}
+{"Time":"2026-10-18T09:13:00.825165597Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow","Output":"=== RUN   TestScenarioBNoImplicitFlow\n"}
+{"Time":"2026-10-18T09:13:00.825474423Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow","Output":"--- PASS: TestScenarioBNoImplicitFlow (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.825581085Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBNoImplicitFlow","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.825600427Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers"}
+{"Time":"2026-10-18T09:13:00.825608687Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers","Output":"=== RUN   TestScenarioBNoIdentityBrokers\n"}
+{"Time":"2026-10-18T09:13:00.82586395Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers","Output":"--- PASS: TestScenarioBNoIdentityBrokers (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.825879324Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBNoIdentityBrokers","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.825951381Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved"}
+{"Time":"2026-10-18T09:13:00.825959803Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved","Output":"=== RUN   TestScenarioBUsersPreserved\n"}
+{"Time":"2026-10-18T09:13:00.826178796Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved","Output":"--- PASS: TestScenarioBUsersPreserved (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.826274812Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBUsersPreserved","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.826373767Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved"}
+{"Time":"2026-10-18T09:13:00.826383668Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved","Output":"=== RUN   TestScenarioBGroupsPreserved\n"}
+{"Time":"2026-10-18T09:13:00.826665187Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved","Output":"--- PASS: TestScenarioBGroupsPreserved (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.826701003Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBGroupsPreserved","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.826728776Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved"}
+{"Time":"2026-10-18T09:13:00.826733213Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved","Output":"=== RUN   TestScenarioBSigningAlgorithmPreserved\n"}
+{"Time":"2026-10-18T09:13:00.826988734Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved","Output":"--- PASS: TestScenarioBSigningAlgorithmPreserved (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.827007427Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBSigningAlgorithmPreserved","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.827113353Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport"}
+{"Time":"2026-10-18T09:13:00.827122036Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport","Output":"=== RUN   TestScenarioBValidationReport\n"}
+{"Time":"2026-10-18T09:13:00.827351877Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport","Output":"--- PASS: TestScenarioBValidationReport (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.827430886Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBValidationReport","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.827507082Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping"}
+{"Time":"2026-10-18T09:13:00.827515495Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping","Output":"=== RUN   TestScenarioBPublicClientMapping\n"}
+{"Time":"2026-10-18T09:13:00.827773397Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping","Output":"--- PASS: TestScenarioBPublicClientMapping (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.827790692Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioBPublicClientMapping","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.82787853Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip"}
+{"Time":"2026-10-18T09:13:00.827887294Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip","Output":"=== RUN   TestScenarioCLDIFRoundTrip\n"}
+{"Time":"2026-10-18T09:13:00.828196442Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip","Output":"--- PASS: TestScenarioCLDIFRoundTrip (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.828268489Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCLDIFRoundTrip","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.828338409Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences"}
+{"Time":"2026-10-18T09:13:00.828346777Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences","Output":"=== RUN   TestScenarioCTargetDifferences\n"}
+{"Time":"2026-10-18T09:13:00.82875093Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences","Output":"--- PASS: TestScenarioCTargetDifferences (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.828790922Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCTargetDifferences","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.828953743Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated"}
+{"Time":"2026-10-18T09:13:00.828984267Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated","Output":"=== RUN   TestScenarioCMFANotMigrated\n"}
+{"Time":"2026-10-18T09:13:00.829397823Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated","Output":"--- PASS: TestScenarioCMFANotMigrated (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.829438157Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCMFANotMigrated","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.829450032Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries"}
+{"Time":"2026-10-18T09:13:00.829473504Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries","Output":"=== RUN   TestScenarioCStructuralEntries\n"}
+{"Time":"2026-10-18T09:13:00.829909286Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries","Output":"--- PASS: TestScenarioCStructuralEntries (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.83013384Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCStructuralEntries","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.830168006Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation"}
+{"Time":"2026-10-18T09:13:00.830176509Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation","Output":"=== RUN   TestScenarioCUserPreservation\n"}
+{"Time":"2026-10-18T09:13:00.830525838Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation","Output":"--- PASS: TestScenarioCUserPreservation (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.83058885Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCUserPreservation","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.830609157Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved"}
+{"Time":"2026-10-18T09:13:00.830614648Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved","Output":"=== RUN   TestScenarioCGroupMembersPreserved\n"}
+{"Time":"2026-10-18T09:13:00.830995688Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved","Output":"--- PASS: TestScenarioCGroupMembersPreserved (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.831040774Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCGroupMembersPreserved","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.831053795Z","Action":"run","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality"}
+{"Time":"2026-10-18T09:13:00.831059143Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality","Output":"=== RUN   TestScenarioCOrthogonality\n"}
+{"Time":"2026-10-18T09:13:00.831476722Z","Action":"output","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality","Output":"--- PASS: TestScenarioCOrthogonality (0.00s)\n"}
+{"Time":"2026-10-18T09:13:00.831511195Z","Action":"pass","Package":"keycape/tests/migration","Test":"TestScenarioCOrthogonality","Elapsed":0}
+{"Time":"2026-10-18T09:13:00.831643596Z","Action":"output","Package":"keycape/tests/migration","Output":"PASS\n"}
+{"Time":"2026-10-18T09:13:00.925987991Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType","Output":"--- PASS: TestJWKSHandler_ContentType (0.14s)\n"}
+{"Time":"2026-10-18T09:13:00.926041896Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_ContentType","Elapsed":0.14}
+{"Time":"2026-10-18T09:13:00.926050066Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid"}
+{"Time":"2026-10-18T09:13:00.926054863Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid","Output":"=== RUN   TestJWKSHandler_StructureValid\n"}
+{"Time":"2026-10-18T09:13:00.948199718Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json (0.24s)\n"}
+{"Time":"2026-10-18T09:13:00.948242298Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/trailing-json","Elapsed":0.24}
+{"Time":"2026-10-18T09:13:00.948249259Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect"}
+{"Time":"2026-10-18T09:13:00.948253137Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect\n"}
+{"Time":"2026-10-18T09:13:01.003556609Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid","Output":"--- PASS: TestJWKSHandler_StructureValid (0.08s)\n"}
+{"Time":"2026-10-18T09:13:01.003602155Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_StructureValid","Elapsed":0.08}
+{"Time":"2026-10-18T09:13:01.003612444Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields"}
+{"Time":"2026-10-18T09:13:01.003616673Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields","Output":"=== RUN   TestJWKSHandler_CorrectAlgorithmFields\n"}
+{"Time":"2026-10-18T09:13:01.03491298Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields","Output":"--- PASS: TestJWKSHandler_CorrectAlgorithmFields (0.03s)\n"}
+{"Time":"2026-10-18T09:13:01.034978671Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_CorrectAlgorithmFields","Elapsed":0.03}
+{"Time":"2026-10-18T09:13:01.034992981Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys"}
+{"Time":"2026-10-18T09:13:01.035003009Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys","Output":"=== RUN   TestJWKSHandler_MultipleKeys\n"}
+{"Time":"2026-10-18T09:13:01.183172155Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect (0.23s)\n"}
+{"Time":"2026-10-18T09:13:01.183250795Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/redirect","Elapsed":0.23}
+{"Time":"2026-10-18T09:13:01.1832669Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable"}
+{"Time":"2026-10-18T09:13:01.183282743Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable\n"}
+{"Time":"2026-10-18T09:13:01.254476115Z","Action":"output","Package":"keycape/tests/conformance","Output":"ok  \tkeycape/tests/conformance\t1.044s\n"}
+{"Time":"2026-10-18T09:13:01.254527225Z","Action":"pass","Package":"keycape/tests/conformance","Elapsed":1.044}
+{"Time":"2026-10-18T09:13:01.583658973Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable (0.40s)\n"}
+{"Time":"2026-10-18T09:13:01.583708108Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/unavailable","Elapsed":0.4}
+{"Time":"2026-10-18T09:13:01.583721968Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize"}
+{"Time":"2026-10-18T09:13:01.583728379Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize\n"}
+{"Time":"2026-10-18T09:13:01.642827435Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys","Output":"--- PASS: TestJWKSHandler_MultipleKeys (0.61s)\n"}
+{"Time":"2026-10-18T09:13:01.642905569Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_MultipleKeys","Elapsed":0.61}
+{"Time":"2026-10-18T09:13:01.642921647Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid"}
+{"Time":"2026-10-18T09:13:01.642970124Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid","Output":"=== RUN   TestLoadPublicKeyFromPEM_Valid\n"}
+{"Time":"2026-10-18T09:13:01.649147378Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize (0.07s)\n"}
+{"Time":"2026-10-18T09:13:01.649192699Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/oversize","Elapsed":0.07}
+{"Time":"2026-10-18T09:13:01.649203953Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached"}
+{"Time":"2026-10-18T09:13:01.649209237Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached\n"}
+{"Time":"2026-10-18T09:13:01.774736728Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached (0.13s)\n"}
+{"Time":"2026-10-18T09:13:01.77482452Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/cached","Elapsed":0.13}
+{"Time":"2026-10-18T09:13:01.775015632Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type"}
+{"Time":"2026-10-18T09:13:01.775040916Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"=== RUN   TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type\n"}
+{"Time":"2026-10-18T09:13:01.836907206Z","Action":"output","Package":"keycape/tests/migration","Output":"ok  \tkeycape/tests/migration\t1.040s\n"}
+{"Time":"2026-10-18T09:13:01.836965088Z","Action":"pass","Package":"keycape/tests/migration","Elapsed":1.04}
+{"Time":"2026-10-18T09:13:01.911295004Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid","Output":"--- PASS: TestLoadPublicKeyFromPEM_Valid (0.27s)\n"}
+{"Time":"2026-10-18T09:13:01.911361758Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_Valid","Elapsed":0.27}
+{"Time":"2026-10-18T09:13:01.911535376Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM"}
+{"Time":"2026-10-18T09:13:01.91155002Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM","Output":"=== RUN   TestLoadPublicKeyFromPEM_InvalidPEM\n"}
+{"Time":"2026-10-18T09:13:01.911763432Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM","Output":"--- PASS: TestLoadPublicKeyFromPEM_InvalidPEM (0.00s)\n"}
+{"Time":"2026-10-18T09:13:01.911890656Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_InvalidPEM","Elapsed":0}
+{"Time":"2026-10-18T09:13:01.911917843Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected"}
+{"Time":"2026-10-18T09:13:01.911927564Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected","Output":"=== RUN   TestLoadPublicKeyFromPEM_PrivateKeyRejected\n"}
+{"Time":"2026-10-18T09:13:02.037810175Z","Action":"start","Package":"keycape/tests/negative"}
+{"Time":"2026-10-18T09:13:02.075214977Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration"}
+{"Time":"2026-10-18T09:13:02.075274806Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration","Output":"=== RUN   TestNegative_DynamicClientRegistration\n"}
+{"Time":"2026-10-18T09:13:02.080356838Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected","Output":"--- PASS: TestLoadPublicKeyFromPEM_PrivateKeyRejected (0.17s)\n"}
+{"Time":"2026-10-18T09:13:02.08042802Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLoadPublicKeyFromPEM_PrivateKeyRejected","Elapsed":0.17}
+{"Time":"2026-10-18T09:13:02.080445856Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding"}
+{"Time":"2026-10-18T09:13:02.080455541Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding","Output":"=== RUN   TestJWKSHandler_NEncoding\n"}
+{"Time":"2026-10-18T09:13:02.083683479Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration","Output":"--- PASS: TestNegative_DynamicClientRegistration (0.01s)\n"}
+{"Time":"2026-10-18T09:13:02.083754435Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_DynamicClientRegistration","Elapsed":0.01}
+{"Time":"2026-10-18T09:13:02.083768962Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow"}
+{"Time":"2026-10-18T09:13:02.08377531Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow","Output":"=== RUN   TestNegative_ImplicitFlow\n"}
+{"Time":"2026-10-18T09:13:02.089433638Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow","Output":"--- PASS: TestNegative_ImplicitFlow (0.01s)\n"}
+{"Time":"2026-10-18T09:13:02.089496749Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_ImplicitFlow","Elapsed":0.01}
+{"Time":"2026-10-18T09:13:02.089726013Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI"}
+{"Time":"2026-10-18T09:13:02.089748556Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI","Output":"=== RUN   TestNegative_WildcardRedirectURI\n"}
+{"Time":"2026-10-18T09:13:02.09573176Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI","Output":"--- PASS: TestNegative_WildcardRedirectURI (0.01s)\n"}
+{"Time":"2026-10-18T09:13:02.09579433Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_WildcardRedirectURI","Elapsed":0.01}
+{"Time":"2026-10-18T09:13:02.095811824Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker"}
+{"Time":"2026-10-18T09:13:02.09582067Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker","Output":"=== RUN   TestNegative_IdentityBroker\n"}
+{"Time":"2026-10-18T09:13:02.0993439Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type (0.32s)\n"}
+{"Time":"2026-10-18T09:13:02.0994217Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus/wrong-content-type","Elapsed":0.32}
+{"Time":"2026-10-18T09:13:02.099448346Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Output":"--- PASS: TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus (4.57s)\n"}
+{"Time":"2026-10-18T09:13:02.099508041Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus","Elapsed":4.57}
+{"Time":"2026-10-18T09:13:02.099864536Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope"}
+{"Time":"2026-10-18T09:13:02.099909073Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"=== RUN   TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope\n"}
+{"Time":"2026-10-18T09:13:02.100065396Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker","Output":"--- PASS: TestNegative_IdentityBroker (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.100169942Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_IdentityBroker","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.100191817Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE"}
+{"Time":"2026-10-18T09:13:02.100199221Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE","Output":"=== RUN   TestNegative_MissingPKCE\n"}
+{"Time":"2026-10-18T09:13:02.10655565Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE","Output":"--- PASS: TestNegative_MissingPKCE (0.01s)\n"}
+{"Time":"2026-10-18T09:13:02.107173084Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_MissingPKCE","Elapsed":0.01}
+{"Time":"2026-10-18T09:13:02.107229343Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod"}
+{"Time":"2026-10-18T09:13:02.107238171Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod","Output":"=== RUN   TestNegative_PKCEPlainMethod\n"}
+{"Time":"2026-10-18T09:13:02.11201523Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod","Output":"--- PASS: TestNegative_PKCEPlainMethod (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.112074428Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_PKCEPlainMethod","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.11208506Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType"}
+{"Time":"2026-10-18T09:13:02.112091949Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType","Output":"=== RUN   TestNegative_UnknownGrantType\n"}
+{"Time":"2026-10-18T09:13:02.116486638Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType","Output":"--- PASS: TestNegative_UnknownGrantType (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.116556016Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_UnknownGrantType","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.116571174Z","Action":"run","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough"}
+{"Time":"2026-10-18T09:13:02.116577991Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough","Output":"=== RUN   TestNegative_ValidRequest_PassesThrough\n"}
+{"Time":"2026-10-18T09:13:02.120905072Z","Action":"output","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough","Output":"--- PASS: TestNegative_ValidRequest_PassesThrough (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.120974126Z","Action":"pass","Package":"keycape/tests/negative","Test":"TestNegative_ValidRequest_PassesThrough","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.121150776Z","Action":"output","Package":"keycape/tests/negative","Output":"PASS\n"}
+{"Time":"2026-10-18T09:13:02.398243572Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding","Output":"--- PASS: TestJWKSHandler_NEncoding (0.32s)\n"}
+{"Time":"2026-10-18T09:13:02.398294962Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestJWKSHandler_NEncoding","Elapsed":0.32}
+{"Time":"2026-10-18T09:13:02.398306278Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession"}
+{"Time":"2026-10-18T09:13:02.398311193Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Output":"=== RUN   TestNativeOptionalEnrollmentAndOldSession\n"}
+{"Time":"2026-10-18T09:13:02.398523143Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Output":"    native_optional_test.go:27: requires disposable installed-provider fixture\n"}
+{"Time":"2026-10-18T09:13:02.398548599Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Output":"--- SKIP: TestNativeOptionalEnrollmentAndOldSession (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.39857364Z","Action":"skip","Package":"keycape/internal/server/oidc","Test":"TestNativeOptionalEnrollmentAndOldSession","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.398583261Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment"}
+{"Time":"2026-10-18T09:13:02.398588563Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment","Output":"=== RUN   TestOptionalMFAFollowsEnrollment\n"}
+{"Time":"2026-10-18T09:13:02.398678961Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement"}
+{"Time":"2026-10-18T09:13:02.398702758Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement\n"}
+{"Time":"2026-10-18T09:13:02.399011968Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.399026883Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/unenrolled_despite_global_requirement","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.399034809Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled"}
+{"Time":"2026-10-18T09:13:02.399039849Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/enrolled\n"}
+{"Time":"2026-10-18T09:13:02.399394958Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/enrolled (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.39941145Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/enrolled","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.3994276Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable"}
+{"Time":"2026-10-18T09:13:02.399432172Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/lookup_unavailable\n"}
+{"Time":"2026-10-18T09:13:02.399743436Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/lookup_unavailable (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.399769667Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/lookup_unavailable","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.399791877Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up"}
+{"Time":"2026-10-18T09:13:02.399798586Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up","Output":"=== RUN   TestOptionalMFAFollowsEnrollment/explicit_step_up\n"}
+{"Time":"2026-10-18T09:13:02.400082332Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up","Output":"--- PASS: TestOptionalMFAFollowsEnrollment/explicit_step_up (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.400116525Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment/explicit_step_up","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.400135614Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment","Output":"--- PASS: TestOptionalMFAFollowsEnrollment (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.400179799Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestOptionalMFAFollowsEnrollment","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.40027017Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule"}
+{"Time":"2026-10-18T09:13:02.40028595Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule","Output":"=== RUN   TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule\n"}
+{"Time":"2026-10-18T09:13:02.400591644Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule","Output":"--- PASS: TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.400622438Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_CoulombSocialPasswordOnlyWhenNoStrongerRule","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.400640797Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA"}
+{"Time":"2026-10-18T09:13:02.400646847Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA","Output":"=== RUN   TestPolicy_ProfileActionStepUpForcesMFA\n"}
+{"Time":"2026-10-18T09:13:02.400970152Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA","Output":"--- PASS: TestPolicy_ProfileActionStepUpForcesMFA (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.401008737Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ProfileActionStepUpForcesMFA","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.401019269Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA"}
+{"Time":"2026-10-18T09:13:02.401024364Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA","Output":"=== RUN   TestPolicy_OpenBaoKeepsMandatoryMFA\n"}
+{"Time":"2026-10-18T09:13:02.401378678Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA","Output":"--- PASS: TestPolicy_OpenBaoKeepsMandatoryMFA (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.401407921Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_OpenBaoKeepsMandatoryMFA","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.4014217Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance"}
+{"Time":"2026-10-18T09:13:02.401427579Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance","Output":"=== RUN   TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance\n"}
+{"Time":"2026-10-18T09:13:02.402115084Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance","Output":"--- PASS: TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.402160188Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_LowAssuranceClientDoesNotSuppressHighAssurance","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.402174038Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass"}
+{"Time":"2026-10-18T09:13:02.402181045Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass","Output":"=== RUN   TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass\n"}
+{"Time":"2026-10-18T09:13:02.402695911Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass","Output":"--- PASS: TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.402753883Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_NoFactorEnrollmentHandoffDoesNotBypass","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.402802657Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced"}
+{"Time":"2026-10-18T09:13:02.402815291Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced","Output":"=== RUN   TestPolicy_ExactRedirectStillEnforced\n"}
+{"Time":"2026-10-18T09:13:02.403015636Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced","Output":"--- PASS: TestPolicy_ExactRedirectStillEnforced (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.403033084Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestPolicy_ExactRedirectStillEnforced","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.403044302Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain"}
+{"Time":"2026-10-18T09:13:02.403060587Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain","Output":"=== RUN   TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain\n"}
+{"Time":"2026-10-18T09:13:02.403452089Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain","Output":"--- PASS: TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.403471422Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLogout_ClearsSessionSoHighAssuranceRequiresMFAAgain","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.403487662Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect"}
+{"Time":"2026-10-18T09:13:02.403500286Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect","Output":"=== RUN   TestLogout_RejectsUnregisteredPostLogoutRedirect\n"}
+{"Time":"2026-10-18T09:13:02.403683679Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect","Output":"--- PASS: TestLogout_RejectsUnregisteredPostLogoutRedirect (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.403709089Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestLogout_RejectsUnregisteredPostLogoutRedirect","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.403726123Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp"}
+{"Time":"2026-10-18T09:13:02.403742958Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp","Output":"=== RUN   TestRuntimePolicyEnrollmentOldSessionAndStepUp\n"}
+{"Time":"2026-10-18T09:13:02.4058322Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp","Output":"--- PASS: TestRuntimePolicyEnrollmentOldSessionAndStepUp (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.405890586Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestRuntimePolicyEnrollmentOldSessionAndStepUp","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.405901759Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged"}
+{"Time":"2026-10-18T09:13:02.405909405Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged","Output":"=== RUN   TestSignInDiagnosis_FlagOff_RedirectUnchanged\n"}
+{"Time":"2026-10-18T09:13:02.406195469Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged","Output":"--- PASS: TestSignInDiagnosis_FlagOff_RedirectUnchanged (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.40621316Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOff_RedirectUnchanged","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.406223395Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue"}
+{"Time":"2026-10-18T09:13:02.40622996Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue","Output":"=== RUN   TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue\n"}
+{"Time":"2026-10-18T09:13:02.407147311Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue","Output":"--- PASS: TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.407183615Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_FlagOn_ShowsFieldsAndContinue","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.407201902Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP"}
+{"Time":"2026-10-18T09:13:02.407214977Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP","Output":"=== RUN   TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP\n"}
+{"Time":"2026-10-18T09:13:02.407762964Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP","Output":"--- PASS: TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.407795065Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AAL2WhenThisRequestVerifiedOTP","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.407895454Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest"}
+{"Time":"2026-10-18T09:13:02.407908638Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest","Output":"=== RUN   TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest\n"}
+{"Time":"2026-10-18T09:13:02.408545544Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest","Output":"--- PASS: TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.408578962Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_ReusedAAL2SessionIsAAL1ForThisRequest","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.408593876Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets"}
+{"Time":"2026-10-18T09:13:02.408599124Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets","Output":"=== RUN   TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets\n"}
+{"Time":"2026-10-18T09:13:02.408972321Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets","Output":"--- PASS: TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets (0.00s)\n"}
+{"Time":"2026-10-18T09:13:02.40900215Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestSignInDiagnosis_AuthLogLineHasFieldsAndNoSecrets","Elapsed":0}
+{"Time":"2026-10-18T09:13:02.409023332Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration"}
+{"Time":"2026-10-18T09:13:02.409037182Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration","Output":"=== RUN   TestRegistrationBoundTenantRequiresStaticRegistration\n"}
+{"Time":"2026-10-18T09:13:02.806953115Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Output":"--- PASS: TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope (0.71s)\n"}
+{"Time":"2026-10-18T09:13:02.807028003Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope","Elapsed":0.71}
+{"Time":"2026-10-18T09:13:02.807050465Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles"}
+{"Time":"2026-10-18T09:13:02.807056696Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles\n"}
+{"Time":"2026-10-18T09:13:02.807250585Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret"}
+{"Time":"2026-10-18T09:13:02.807263164Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret\n"}
+{"Time":"2026-10-18T09:13:02.818204195Z","Action":"start","Package":"keycape/tests/profile"}
+{"Time":"2026-10-18T09:13:02.839478479Z","Action":"run","Package":"keycape/tests/profile","Test":"TestDiscovery"}
+{"Time":"2026-10-18T09:13:02.839533584Z","Action":"output","Package":"keycape/tests/profile","Test":"TestDiscovery","Output":"=== RUN   TestDiscovery\n"}
+{"Time":"2026-10-18T09:13:02.892188369Z","Action":"output","Package":"keycape/tests/profile","Test":"TestDiscovery","Output":"--- PASS: TestDiscovery (0.05s)\n"}
+{"Time":"2026-10-18T09:13:02.892242328Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestDiscovery","Elapsed":0.05}
+{"Time":"2026-10-18T09:13:02.892414557Z","Action":"run","Package":"keycape/tests/profile","Test":"TestJWKS"}
+{"Time":"2026-10-18T09:13:02.892428832Z","Action":"output","Package":"keycape/tests/profile","Test":"TestJWKS","Output":"=== RUN   TestJWKS\n"}
+{"Time":"2026-10-18T09:13:02.907733793Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration","Output":"--- PASS: TestRegistrationBoundTenantRequiresStaticRegistration (0.50s)\n"}
+{"Time":"2026-10-18T09:13:02.907801909Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestRegistrationBoundTenantRequiresStaticRegistration","Elapsed":0.5}
+{"Time":"2026-10-18T09:13:02.907822829Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance"}
+{"Time":"2026-10-18T09:13:02.907836003Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance\n"}
+{"Time":"2026-10-18T09:13:02.907869097Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied"}
+{"Time":"2026-10-18T09:13:02.907877871Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/human,_registration-supplied\n"}
+{"Time":"2026-10-18T09:13:03.12692419Z","Action":"output","Package":"keycape/tests/negative","Output":"ok  \tkeycape/tests/negative\t1.089s\n"}
+{"Time":"2026-10-18T09:13:03.126983614Z","Action":"pass","Package":"keycape/tests/negative","Elapsed":1.089}
+{"Time":"2026-10-18T09:13:03.133549713Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret (0.33s)\n"}
+{"Time":"2026-10-18T09:13:03.133609362Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret","Elapsed":0.33}
+{"Time":"2026-10-18T09:13:03.133640435Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys"}
+{"Time":"2026-10-18T09:13:03.133650436Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/keys\n"}
+{"Time":"2026-10-18T09:13:03.28554408Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/keys (0.15s)\n"}
+{"Time":"2026-10-18T09:13:03.28561069Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/keys","Elapsed":0.15}
+{"Time":"2026-10-18T09:13:03.285641358Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca"}
+{"Time":"2026-10-18T09:13:03.285647742Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/ca\n"}
+{"Time":"2026-10-18T09:13:03.344909815Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/human,_registration-supplied (0.44s)\n"}
+{"Time":"2026-10-18T09:13:03.344971511Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_registration-supplied","Elapsed":0.44}
+{"Time":"2026-10-18T09:13:03.344983756Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted"}
+{"Time":"2026-10-18T09:13:03.344989807Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/human,_directory-asserted\n"}
+{"Time":"2026-10-18T09:13:03.399227756Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/human,_directory-asserted (0.05s)\n"}
+{"Time":"2026-10-18T09:13:03.399278541Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_directory-asserted","Elapsed":0.05}
+{"Time":"2026-10-18T09:13:03.399298875Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted"}
+{"Time":"2026-10-18T09:13:03.399304276Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted\n"}
+{"Time":"2026-10-18T09:13:03.542006992Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/ca (0.26s)\n"}
+{"Time":"2026-10-18T09:13:03.542073693Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/ca","Elapsed":0.26}
+{"Time":"2026-10-18T09:13:03.54210382Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable"}
+{"Time":"2026-10-18T09:13:03.542113928Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable\n"}
+{"Time":"2026-10-18T09:13:03.555549446Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted (0.16s)\n"}
+{"Time":"2026-10-18T09:13:03.555622892Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/human,_nobody_asserted","Elapsed":0.16}
+{"Time":"2026-10-18T09:13:03.555781261Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied"}
+{"Time":"2026-10-18T09:13:03.555804787Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied","Output":"=== RUN   TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied\n"}
+{"Time":"2026-10-18T09:13:03.658715982Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable (0.12s)\n"}
+{"Time":"2026-10-18T09:13:03.65879711Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-world-readable","Elapsed":0.12}
+{"Time":"2026-10-18T09:13:03.658812764Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable"}
+{"Time":"2026-10-18T09:13:03.658829004Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable\n"}
+{"Time":"2026-10-18T09:13:03.663272049Z","Action":"output","Package":"keycape/tests/profile","Test":"TestJWKS","Output":"--- PASS: TestJWKS (0.77s)\n"}
+{"Time":"2026-10-18T09:13:03.663325233Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestJWKS","Elapsed":0.77}
+{"Time":"2026-10-18T09:13:03.663499782Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect"}
+{"Time":"2026-10-18T09:13:03.663568535Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect","Output":"=== RUN   TestAuthorize_Redirect\n"}
+{"Time":"2026-10-18T09:13:03.912660865Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied (0.36s)\n"}
+{"Time":"2026-10-18T09:13:03.912720686Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance/service_is_always_registration-supplied","Elapsed":0.36}
+{"Time":"2026-10-18T09:13:03.912740488Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance","Output":"--- PASS: TestIssuedTokensCarryTenantProvenance (1.00s)\n"}
+{"Time":"2026-10-18T09:13:03.912941281Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestIssuedTokensCarryTenantProvenance","Elapsed":1}
+{"Time":"2026-10-18T09:13:03.913169763Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters"}
+{"Time":"2026-10-18T09:13:03.913197653Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters","Output":"=== RUN   TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters\n"}
+{"Time":"2026-10-18T09:13:03.940155465Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect","Output":"--- PASS: TestAuthorize_Redirect (0.28s)\n"}
+{"Time":"2026-10-18T09:13:03.940441219Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_Redirect","Elapsed":0.28}
+{"Time":"2026-10-18T09:13:03.940479921Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient"}
+{"Time":"2026-10-18T09:13:03.940490805Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient","Output":"=== RUN   TestAuthorize_InvalidClient\n"}
+{"Time":"2026-10-18T09:13:04.121501539Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient","Output":"--- PASS: TestAuthorize_InvalidClient (0.18s)\n"}
+{"Time":"2026-10-18T09:13:04.121561008Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_InvalidClient","Elapsed":0.18}
+{"Time":"2026-10-18T09:13:04.121677367Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI"}
+{"Time":"2026-10-18T09:13:04.12169477Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI","Output":"=== RUN   TestAuthorize_WildcardRedirectURI\n"}
+{"Time":"2026-10-18T09:13:04.154649964Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable (0.50s)\n"}
+{"Time":"2026-10-18T09:13:04.154812084Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/public-writable","Elapsed":0.5}
+{"Time":"2026-10-18T09:13:04.154840813Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo"}
+{"Time":"2026-10-18T09:13:04.15484984Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"=== RUN   TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo\n"}
+{"Time":"2026-10-18T09:13:04.240288951Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo (0.09s)\n"}
+{"Time":"2026-10-18T09:13:04.240337094Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles/secret-fifo","Elapsed":0.09}
+{"Time":"2026-10-18T09:13:04.240350187Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Output":"--- PASS: TestOnlineReloadsCredentialsKeysAndTrustFiles (1.43s)\n"}
+{"Time":"2026-10-18T09:13:04.240575032Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineReloadsCredentialsKeysAndTrustFiles","Elapsed":1.43}
+{"Time":"2026-10-18T09:13:04.240591272Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus"}
+{"Time":"2026-10-18T09:13:04.2406024Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus\n"}
+{"Time":"2026-10-18T09:13:04.240791582Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry"}
+{"Time":"2026-10-18T09:13:04.240807344Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry\n"}
+{"Time":"2026-10-18T09:13:04.295654718Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI","Output":"--- PASS: TestAuthorize_WildcardRedirectURI (0.17s)\n"}
+{"Time":"2026-10-18T09:13:04.295718407Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_WildcardRedirectURI","Elapsed":0.17}
+{"Time":"2026-10-18T09:13:04.295876042Z","Action":"run","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE"}
+{"Time":"2026-10-18T09:13:04.29589496Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE","Output":"=== RUN   TestAuthorize_MissingPKCE\n"}
+{"Time":"2026-10-18T09:13:04.297918823Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters","Output":"--- PASS: TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters (0.38s)\n"}
+{"Time":"2026-10-18T09:13:04.297950167Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters","Elapsed":0.38}
+{"Time":"2026-10-18T09:13:04.298043414Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration"}
+{"Time":"2026-10-18T09:13:04.298056155Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration","Output":"=== RUN   TestServiceTenantsAreDistinctPerRegistration\n"}
+{"Time":"2026-10-18T09:13:04.332195229Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry (0.09s)\n"}
+{"Time":"2026-10-18T09:13:04.332273643Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/expiry","Elapsed":0.09}
+{"Time":"2026-10-18T09:13:04.332289965Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards"}
+{"Time":"2026-10-18T09:13:04.33229569Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards\n"}
+{"Time":"2026-10-18T09:13:04.447805472Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration","Output":"--- PASS: TestServiceTenantsAreDistinctPerRegistration (0.15s)\n"}
+{"Time":"2026-10-18T09:13:04.447855437Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestServiceTenantsAreDistinctPerRegistration","Elapsed":0.15}
+{"Time":"2026-10-18T09:13:04.447864995Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault"}
+{"Time":"2026-10-18T09:13:04.447870369Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault","Output":"=== RUN   TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault\n"}
+{"Time":"2026-10-18T09:13:04.448056014Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory"}
+{"Time":"2026-10-18T09:13:04.448072272Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory","Output":"=== RUN   TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory\n"}
+{"Time":"2026-10-18T09:13:04.465772239Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards (0.13s)\n"}
+{"Time":"2026-10-18T09:13:04.465818065Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/clock-backwards","Elapsed":0.13}
+{"Time":"2026-10-18T09:13:04.465829255Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key"}
+{"Time":"2026-10-18T09:13:04.465834657Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"=== RUN   TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key\n"}
+{"Time":"2026-10-18T09:13:04.502041938Z","Action":"output","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE","Output":"--- PASS: TestAuthorize_MissingPKCE (0.21s)\n"}
+{"Time":"2026-10-18T09:13:04.50209275Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestAuthorize_MissingPKCE","Elapsed":0.21}
+{"Time":"2026-10-18T09:13:04.502275583Z","Action":"run","Package":"keycape/tests/profile","Test":"TestHealthz"}
+{"Time":"2026-10-18T09:13:04.502295511Z","Action":"output","Package":"keycape/tests/profile","Test":"TestHealthz","Output":"=== RUN   TestHealthz\n"}
+{"Time":"2026-10-18T09:13:04.594511831Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key (0.13s)\n"}
+{"Time":"2026-10-18T09:13:04.594555304Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus/withdrawn-key","Elapsed":0.13}
+{"Time":"2026-10-18T09:13:04.594571832Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Output":"--- PASS: TestOnlineRechecksExpiryClockAndKeyAfterStatus (0.35s)\n"}
+{"Time":"2026-10-18T09:13:04.594751483Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineRechecksExpiryClockAndKeyAfterStatus","Elapsed":0.35}
+{"Time":"2026-10-18T09:13:04.594787245Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs"}
+{"Time":"2026-10-18T09:13:04.594792602Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"=== RUN   TestOnlineCancellationAndAmbientProxyDoNotLeakInputs\n"}
+{"Time":"2026-10-18T09:13:04.625727338Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory","Output":"--- PASS: TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory (0.18s)\n"}
+{"Time":"2026-10-18T09:13:04.625784923Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/directory","Elapsed":0.18}
+{"Time":"2026-10-18T09:13:04.625795166Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default"}
+{"Time":"2026-10-18T09:13:04.625801009Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default","Output":"=== RUN   TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default\n"}
+{"Time":"2026-10-18T09:13:04.71045419Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default","Output":"--- PASS: TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default (0.08s)\n"}
+{"Time":"2026-10-18T09:13:04.710518194Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault/default","Elapsed":0.08}
+{"Time":"2026-10-18T09:13:04.710679372Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault","Output":"--- PASS: TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault (0.26s)\n"}
+{"Time":"2026-10-18T09:13:04.710706739Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault","Elapsed":0.26}
+{"Time":"2026-10-18T09:13:04.710814658Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases"}
+{"Time":"2026-10-18T09:13:04.710837454Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases","Output":"=== RUN   TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases\n"}
+{"Time":"2026-10-18T09:13:04.786787751Z","Action":"output","Package":"keycape/tests/profile","Test":"TestHealthz","Output":"--- PASS: TestHealthz (0.28s)\n"}
+{"Time":"2026-10-18T09:13:04.786849077Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestHealthz","Elapsed":0.28}
+{"Time":"2026-10-18T09:13:04.787018069Z","Action":"run","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow"}
+{"Time":"2026-10-18T09:13:04.787083796Z","Action":"output","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow","Output":"=== RUN   TestCompleteTokenFlow\n"}
+{"Time":"2026-10-18T09:13:04.794126002Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases","Output":"--- PASS: TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases (0.08s)\n"}
+{"Time":"2026-10-18T09:13:04.794178924Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases","Elapsed":0.08}
+{"Time":"2026-10-18T09:13:04.794191143Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant"}
+{"Time":"2026-10-18T09:13:04.794195967Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant","Output":"=== RUN   TestUnrelatedServiceClientKeepsCoulombTenant\n"}
+{"Time":"2026-10-18T09:13:04.825189641Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Output":"--- PASS: TestOnlineCancellationAndAmbientProxyDoNotLeakInputs (0.23s)\n"}
+{"Time":"2026-10-18T09:13:04.82525994Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineCancellationAndAmbientProxyDoNotLeakInputs","Elapsed":0.23}
+{"Time":"2026-10-18T09:13:04.825288551Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus"}
+{"Time":"2026-10-18T09:13:04.825302708Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"=== RUN   TestOnlineMalformedAdmissionAndNegativeStatus\n"}
+{"Time":"2026-10-18T09:13:04.968088113Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Output":"--- PASS: TestOnlineMalformedAdmissionAndNegativeStatus (0.14s)\n"}
+{"Time":"2026-10-18T09:13:04.968140765Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineMalformedAdmissionAndNegativeStatus","Elapsed":0.14}
+{"Time":"2026-10-18T09:13:04.968297394Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier"}
+{"Time":"2026-10-18T09:13:04.96831138Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"=== RUN   TestOnlineUsesSharedTypedJOSEVerifier\n"}
+{"Time":"2026-10-18T09:13:05.037604192Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Output":"--- PASS: TestOnlineUsesSharedTypedJOSEVerifier (0.07s)\n"}
+{"Time":"2026-10-18T09:13:05.037653805Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineUsesSharedTypedJOSEVerifier","Elapsed":0.07}
+{"Time":"2026-10-18T09:13:05.037665798Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration"}
+{"Time":"2026-10-18T09:13:05.037670397Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration","Output":"=== RUN   TestVerifyClientPassesOnCorrectRegistration\n"}
+{"Time":"2026-10-18T09:13:05.050317153Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant","Output":"--- PASS: TestUnrelatedServiceClientKeepsCoulombTenant (0.26s)\n"}
+{"Time":"2026-10-18T09:13:05.050400364Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUnrelatedServiceClientKeepsCoulombTenant","Elapsed":0.26}
+{"Time":"2026-10-18T09:13:05.050517137Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile"}
+{"Time":"2026-10-18T09:13:05.050538941Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile","Output":"=== RUN   TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile\n"}
+{"Time":"2026-10-18T09:13:05.052175466Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile","Output":"--- PASS: TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile (0.00s)\n"}
+{"Time":"2026-10-18T09:13:05.052224862Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusDiscoveryOnlyAdvertisesEnabledProfile","Elapsed":0}
+{"Time":"2026-10-18T09:13:05.052399911Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant"}
+{"Time":"2026-10-18T09:13:05.052421436Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant","Output":"=== RUN   TestTokenStatusActualIssueRevokeAndFreshGrant\n"}
+{"Time":"2026-10-18T09:13:05.066342087Z","Action":"output","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow","Output":"--- PASS: TestCompleteTokenFlow (0.28s)\n"}
+{"Time":"2026-10-18T09:13:05.066458049Z","Action":"pass","Package":"keycape/tests/profile","Test":"TestCompleteTokenFlow","Elapsed":0.28}
+{"Time":"2026-10-18T09:13:05.066505435Z","Action":"output","Package":"keycape/tests/profile","Output":"PASS\n"}
+{"Time":"2026-10-18T09:13:05.194798737Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant","Output":"--- PASS: TestTokenStatusActualIssueRevokeAndFreshGrant (0.14s)\n"}
+{"Time":"2026-10-18T09:13:05.194884708Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualIssueRevokeAndFreshGrant","Elapsed":0.14}
+{"Time":"2026-10-18T09:13:05.194902364Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority"}
+{"Time":"2026-10-18T09:13:05.194908072Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority","Output":"=== RUN   TestTokenStatusNoCrossClientOrIDTokenAuthority\n"}
+{"Time":"2026-10-18T09:13:05.282356523Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority","Output":"--- PASS: TestTokenStatusNoCrossClientOrIDTokenAuthority (0.09s)\n"}
+{"Time":"2026-10-18T09:13:05.282467634Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusNoCrossClientOrIDTokenAuthority","Elapsed":0.09}
+{"Time":"2026-10-18T09:13:05.282488815Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken"}
+{"Time":"2026-10-18T09:13:05.282493829Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken","Output":"=== RUN   TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken\n"}
+{"Time":"2026-10-18T09:13:05.29127275Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration","Output":"--- PASS: TestVerifyClientPassesOnCorrectRegistration (0.25s)\n"}
+{"Time":"2026-10-18T09:13:05.291330641Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientPassesOnCorrectRegistration","Elapsed":0.25}
+{"Time":"2026-10-18T09:13:05.291406909Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens"}
+{"Time":"2026-10-18T09:13:05.291419713Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens","Output":"=== RUN   TestVerifyClientNeverPrintsSecretsOrTokens\n"}
+{"Time":"2026-10-18T09:13:05.345677149Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken","Output":"--- PASS: TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken (0.06s)\n"}
+{"Time":"2026-10-18T09:13:05.345728646Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusCapacityFailsIssuanceWithoutEvictingLiveToken","Elapsed":0.06}
+{"Time":"2026-10-18T09:13:05.345738872Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse"}
+{"Time":"2026-10-18T09:13:05.345744805Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse","Output":"=== RUN   TestTokenStatusRestartAndUnavailableStoreRefuse\n"}
+{"Time":"2026-10-18T09:13:05.542895671Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse","Output":"--- PASS: TestTokenStatusRestartAndUnavailableStoreRefuse (0.20s)\n"}
+{"Time":"2026-10-18T09:13:05.542941866Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRestartAndUnavailableStoreRefuse","Elapsed":0.2}
+{"Time":"2026-10-18T09:13:05.542953408Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition"}
+{"Time":"2026-10-18T09:13:05.542957872Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition\n"}
+{"Time":"2026-10-18T09:13:05.543111291Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed"}
+{"Time":"2026-10-18T09:13:05.543123104Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed\n"}
+{"Time":"2026-10-18T09:13:05.591095734Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed (0.05s)\n"}
+{"Time":"2026-10-18T09:13:05.591457205Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/removed","Elapsed":0.05}
+{"Time":"2026-10-18T09:13:05.591562779Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience"}
+{"Time":"2026-10-18T09:13:05.591574943Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience\n"}
+{"Time":"2026-10-18T09:13:05.623474889Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens","Output":"--- PASS: TestVerifyClientNeverPrintsSecretsOrTokens (0.33s)\n"}
+{"Time":"2026-10-18T09:13:05.623518677Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientNeverPrintsSecretsOrTokens","Elapsed":0.33}
+{"Time":"2026-10-18T09:13:05.623529759Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted"}
+{"Time":"2026-10-18T09:13:05.62353525Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted","Output":"=== RUN   TestVerifyClientFailsWhenExcessScopeIsGranted\n"}
+{"Time":"2026-10-18T09:13:05.874600807Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience (0.28s)\n"}
+{"Time":"2026-10-18T09:13:05.874656326Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/audience","Elapsed":0.28}
+{"Time":"2026-10-18T09:13:05.874665542Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret"}
+{"Time":"2026-10-18T09:13:05.87467061Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret\n"}
+{"Time":"2026-10-18T09:13:05.897418218Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted","Output":"--- PASS: TestVerifyClientFailsWhenExcessScopeIsGranted (0.27s)\n"}
+{"Time":"2026-10-18T09:13:05.897473043Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientFailsWhenExcessScopeIsGranted","Elapsed":0.27}
+{"Time":"2026-10-18T09:13:05.897483846Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor"}
+{"Time":"2026-10-18T09:13:05.897488652Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor","Output":"=== RUN   TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor\n"}
+{"Time":"2026-10-18T09:13:05.937240407Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret (0.06s)\n"}
+{"Time":"2026-10-18T09:13:05.937323456Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/secret","Elapsed":0.06}
+{"Time":"2026-10-18T09:13:05.937345963Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes"}
+{"Time":"2026-10-18T09:13:05.937360453Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes\n"}
+{"Time":"2026-10-18T09:13:06.074195908Z","Action":"output","Package":"keycape/tests/profile","Output":"ok  \tkeycape/tests/profile\t3.256s\n"}
+{"Time":"2026-10-18T09:13:06.074245539Z","Action":"pass","Package":"keycape/tests/profile","Elapsed":3.2560000000000002}
+{"Time":"2026-10-18T09:13:06.145516507Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes (0.21s)\n"}
+{"Time":"2026-10-18T09:13:06.145590665Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/scopes","Elapsed":0.21}
+{"Time":"2026-10-18T09:13:06.145611035Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime"}
+{"Time":"2026-10-18T09:13:06.145623379Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime\n"}
+{"Time":"2026-10-18T09:13:06.204438344Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor","Output":"--- PASS: TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor (0.31s)\n"}
+{"Time":"2026-10-18T09:13:06.204485495Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientRejectsUnrotatedAndAcceptedPredecessor","Elapsed":0.31}
+{"Time":"2026-10-18T09:13:06.204494341Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments"}
+{"Time":"2026-10-18T09:13:06.204498921Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments","Output":"=== RUN   TestVerifyClientRequiresCompleteArguments\n"}
+{"Time":"2026-10-18T09:13:06.204746418Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments","Output":"--- PASS: TestVerifyClientRequiresCompleteArguments (0.00s)\n"}
+{"Time":"2026-10-18T09:13:06.204768654Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientRequiresCompleteArguments","Elapsed":0}
+{"Time":"2026-10-18T09:13:06.204796707Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants"}
+{"Time":"2026-10-18T09:13:06.204808123Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants","Output":"=== RUN   TestNoExcessScopeCatchesUnrequestedGrants\n"}
+{"Time":"2026-10-18T09:13:06.205026205Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants","Output":"--- PASS: TestNoExcessScopeCatchesUnrequestedGrants (0.00s)\n"}
+{"Time":"2026-10-18T09:13:06.205280891Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestNoExcessScopeCatchesUnrequestedGrants","Elapsed":0}
+{"Time":"2026-10-18T09:13:06.205304083Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing"}
+{"Time":"2026-10-18T09:13:06.205310494Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing","Output":"=== RUN   TestHasAllRolesNamesWhatIsMissing\n"}
+{"Time":"2026-10-18T09:13:06.205474867Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing","Output":"--- PASS: TestHasAllRolesNamesWhatIsMissing (0.00s)\n"}
+{"Time":"2026-10-18T09:13:06.205496653Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestHasAllRolesNamesWhatIsMissing","Elapsed":0}
+{"Time":"2026-10-18T09:13:06.20552063Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals"}
+{"Time":"2026-10-18T09:13:06.205530747Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals\n"}
+{"Time":"2026-10-18T09:13:06.205686385Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport"}
+{"Time":"2026-10-18T09:13:06.205697819Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport\n"}
+{"Time":"2026-10-18T09:13:06.302215009Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport (0.10s)\n"}
+{"Time":"2026-10-18T09:13:06.302274847Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/transport","Elapsed":0.1}
+{"Time":"2026-10-18T09:13:06.302286074Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server"}
+{"Time":"2026-10-18T09:13:06.302300357Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server\n"}
+{"Time":"2026-10-18T09:13:06.354158535Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime (0.21s)\n"}
+{"Time":"2026-10-18T09:13:06.354213071Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/lifetime","Elapsed":0.21}
+{"Time":"2026-10-18T09:13:06.354347122Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended"}
+{"Time":"2026-10-18T09:13:06.35436044Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended\n"}
+{"Time":"2026-10-18T09:13:06.431062628Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server (0.13s)\n"}
+{"Time":"2026-10-18T09:13:06.431121357Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/server","Elapsed":0.13}
+{"Time":"2026-10-18T09:13:06.431147877Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token"}
+{"Time":"2026-10-18T09:13:06.431156759Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token\n"}
+{"Time":"2026-10-18T09:13:06.523026539Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token (0.09s)\n"}
+{"Time":"2026-10-18T09:13:06.523099885Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/invalid_token","Elapsed":0.09}
+{"Time":"2026-10-18T09:13:06.523120598Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal"}
+{"Time":"2026-10-18T09:13:06.523128461Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal\n"}
+{"Time":"2026-10-18T09:13:06.676634354Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended (0.32s)\n"}
+{"Time":"2026-10-18T09:13:06.676694445Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/suspended","Elapsed":0.32}
+{"Time":"2026-10-18T09:13:06.676706321Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled"}
+{"Time":"2026-10-18T09:13:06.676712561Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled\n"}
+{"Time":"2026-10-18T09:13:06.726737958Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal (0.20s)\n"}
+{"Time":"2026-10-18T09:13:06.726786327Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/unrelated_refusal","Elapsed":0.2}
+{"Time":"2026-10-18T09:13:06.72680299Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal"}
+{"Time":"2026-10-18T09:13:06.726808238Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal\n"}
+{"Time":"2026-10-18T09:13:06.87579423Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled (0.20s)\n"}
+{"Time":"2026-10-18T09:13:06.875843329Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/disabled","Elapsed":0.2}
+{"Time":"2026-10-18T09:13:06.875852698Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed"}
+{"Time":"2026-10-18T09:13:06.875857251Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed","Output":"=== RUN   TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed\n"}
+{"Time":"2026-10-18T09:13:06.987523005Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal (0.26s)\n"}
+{"Time":"2026-10-18T09:13:06.9876193Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/scope/malformed_refusal","Elapsed":0.26}
+{"Time":"2026-10-18T09:13:06.987636234Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport"}
+{"Time":"2026-10-18T09:13:06.987664774Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport\n"}
+{"Time":"2026-10-18T09:13:07.095480298Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed (0.22s)\n"}
+{"Time":"2026-10-18T09:13:07.095537134Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition/user-removed","Elapsed":0.22}
+{"Time":"2026-10-18T09:13:07.095554213Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition","Output":"--- PASS: TestTokenStatusRegistrationDriftAndDirectoryDisposition (1.55s)\n"}
+{"Time":"2026-10-18T09:13:07.095693223Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRegistrationDriftAndDirectoryDisposition","Elapsed":1.55}
+{"Time":"2026-10-18T09:13:07.09571105Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect"}
+{"Time":"2026-10-18T09:13:07.095720274Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect","Output":"=== RUN   TestTokenStatusPublicClientMayRevokeButNotIntrospect\n"}
+{"Time":"2026-10-18T09:13:07.143133125Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect","Output":"--- PASS: TestTokenStatusPublicClientMayRevokeButNotIntrospect (0.05s)\n"}
+{"Time":"2026-10-18T09:13:07.143231233Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusPublicClientMayRevokeButNotIntrospect","Elapsed":0.05}
+{"Time":"2026-10-18T09:13:07.143259556Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct"}
+{"Time":"2026-10-18T09:13:07.143267058Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct","Output":"=== RUN   TestTokenStatusServiceGrantIsCurrentAndDistinct\n"}
+{"Time":"2026-10-18T09:13:07.269076551Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct","Output":"--- PASS: TestTokenStatusServiceGrantIsCurrentAndDistinct (0.13s)\n"}
+{"Time":"2026-10-18T09:13:07.269130844Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusServiceGrantIsCurrentAndDistinct","Elapsed":0.13}
+{"Time":"2026-10-18T09:13:07.269264565Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests"}
+{"Time":"2026-10-18T09:13:07.269279047Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests\n"}
+{"Time":"2026-10-18T09:13:07.269287749Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get"}
+{"Time":"2026-10-18T09:13:07.269292311Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get\n"}
+{"Time":"2026-10-18T09:13:07.416118158Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport (0.43s)\n"}
+{"Time":"2026-10-18T09:13:07.41617374Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/transport","Elapsed":0.43}
+{"Time":"2026-10-18T09:13:07.416205148Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server"}
+{"Time":"2026-10-18T09:13:07.416212055Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server\n"}
+{"Time":"2026-10-18T09:13:07.551302703Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get (0.28s)\n"}
+{"Time":"2026-10-18T09:13:07.55135035Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/get","Elapsed":0.28}
+{"Time":"2026-10-18T09:13:07.551361568Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query"}
+{"Time":"2026-10-18T09:13:07.551366789Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query\n"}
+{"Time":"2026-10-18T09:13:07.61632974Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server (0.20s)\n"}
+{"Time":"2026-10-18T09:13:07.616383879Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/server","Elapsed":0.2}
+{"Time":"2026-10-18T09:13:07.6164014Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token"}
+{"Time":"2026-10-18T09:13:07.61640846Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token\n"}
+{"Time":"2026-10-18T09:13:07.653390645Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query (0.10s)\n"}
+{"Time":"2026-10-18T09:13:07.653441899Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/query","Elapsed":0.1}
+{"Time":"2026-10-18T09:13:07.653450934Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json"}
+{"Time":"2026-10-18T09:13:07.653456137Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json\n"}
+{"Time":"2026-10-18T09:13:07.662270946Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token (0.05s)\n"}
+{"Time":"2026-10-18T09:13:07.662343354Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/invalid_token","Elapsed":0.05}
+{"Time":"2026-10-18T09:13:07.662355365Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal"}
+{"Time":"2026-10-18T09:13:07.662360659Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal\n"}
+{"Time":"2026-10-18T09:13:07.760238858Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal (0.10s)\n"}
+{"Time":"2026-10-18T09:13:07.760304693Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/unrelated_refusal","Elapsed":0.1}
+{"Time":"2026-10-18T09:13:07.76032545Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal"}
+{"Time":"2026-10-18T09:13:07.760333963Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal","Output":"=== RUN   TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal\n"}
+{"Time":"2026-10-18T09:13:07.807889719Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json (0.15s)\n"}
+{"Time":"2026-10-18T09:13:07.807950937Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/json","Elapsed":0.15}
+{"Time":"2026-10-18T09:13:07.807962028Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token"}
+{"Time":"2026-10-18T09:13:07.807966798Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token\n"}
+{"Time":"2026-10-18T09:13:08.007972114Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal (0.25s)\n"}
+{"Time":"2026-10-18T09:13:08.008040212Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals/predecessor/malformed_refusal","Elapsed":0.25}
+{"Time":"2026-10-18T09:13:08.008069166Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals","Output":"--- PASS: TestVerifyClientDoesNotConfuseFailuresWithRefusals (1.80s)\n"}
+{"Time":"2026-10-18T09:13:08.008236241Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestVerifyClientDoesNotConfuseFailuresWithRefusals","Elapsed":1.8}
+{"Time":"2026-10-18T09:13:08.008255826Z","Action":"output","Package":"keycape/internal/authclient","Output":"PASS\n"}
+{"Time":"2026-10-18T09:13:08.013620891Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token (0.21s)\n"}
+{"Time":"2026-10-18T09:13:08.013672948Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-token","Elapsed":0.21}
+{"Time":"2026-10-18T09:13:08.013685635Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize"}
+{"Time":"2026-10-18T09:13:08.013691108Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize\n"}
+{"Time":"2026-10-18T09:13:08.237993938Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize (0.22s)\n"}
+{"Time":"2026-10-18T09:13:08.238066302Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/oversize","Elapsed":0.22}
+{"Time":"2026-10-18T09:13:08.238077059Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret"}
+{"Time":"2026-10-18T09:13:08.238083732Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret\n"}
+{"Time":"2026-10-18T09:13:08.280912211Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret (0.04s)\n"}
+{"Time":"2026-10-18T09:13:08.28096434Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/wrong-secret","Elapsed":0.04}
+{"Time":"2026-10-18T09:13:08.280977559Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth"}
+{"Time":"2026-10-18T09:13:08.280987243Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth\n"}
+{"Time":"2026-10-18T09:13:08.354027618Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth (0.07s)\n"}
+{"Time":"2026-10-18T09:13:08.354103849Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/missing-auth","Elapsed":0.07}
+{"Time":"2026-10-18T09:13:08.354132497Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth"}
+{"Time":"2026-10-18T09:13:08.354152921Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth\n"}
+{"Time":"2026-10-18T09:13:08.551650266Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth (0.20s)\n"}
+{"Time":"2026-10-18T09:13:08.551708725Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/duplicate-auth","Elapsed":0.2}
+{"Time":"2026-10-18T09:13:08.551720294Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret"}
+{"Time":"2026-10-18T09:13:08.551726227Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret\n"}
+{"Time":"2026-10-18T09:13:08.652578114Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret (0.10s)\n"}
+{"Time":"2026-10-18T09:13:08.652629683Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/body-secret","Elapsed":0.1}
+{"Time":"2026-10-18T09:13:08.652640892Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client"}
+{"Time":"2026-10-18T09:13:08.65266064Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client","Output":"=== RUN   TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client\n"}
+{"Time":"2026-10-18T09:13:08.914194064Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client (0.26s)\n"}
+{"Time":"2026-10-18T09:13:08.914251954Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests/mismatched-client","Elapsed":0.26}
+{"Time":"2026-10-18T09:13:08.914384988Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests","Output":"--- PASS: TestTokenStatusRejectsMalformedOrUnauthenticatedRequests (1.64s)\n"}
+{"Time":"2026-10-18T09:13:08.914446053Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRejectsMalformedOrUnauthenticatedRequests","Elapsed":1.64}
+{"Time":"2026-10-18T09:13:08.914467523Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses"}
+{"Time":"2026-10-18T09:13:08.914480427Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses","Output":"=== RUN   TestTokenStatusRevocationDuringDirectoryLookupRefuses\n"}
+{"Time":"2026-10-18T09:13:08.958238676Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses","Output":"--- PASS: TestTokenStatusRevocationDuringDirectoryLookupRefuses (0.04s)\n"}
+{"Time":"2026-10-18T09:13:08.958281147Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringDirectoryLookupRefuses","Elapsed":0.04}
+{"Time":"2026-10-18T09:13:08.958291175Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding"}
+{"Time":"2026-10-18T09:13:08.958294808Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding","Output":"=== RUN   TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding\n"}
+{"Time":"2026-10-18T09:13:09.016520429Z","Action":"output","Package":"keycape/internal/authclient","Output":"ok  \tkeycape/internal/authclient\t16.465s\n"}
+{"Time":"2026-10-18T09:13:09.016566922Z","Action":"pass","Package":"keycape/internal/authclient","Elapsed":16.465}
+{"Time":"2026-10-18T09:13:09.062475088Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding","Output":"--- PASS: TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding (0.10s)\n"}
+{"Time":"2026-10-18T09:13:09.062538371Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusActualHTTPSFlowAndAuthenticationEncoding","Elapsed":0.1}
+{"Time":"2026-10-18T09:13:09.062591294Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses"}
+{"Time":"2026-10-18T09:13:09.062600744Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses","Output":"=== RUN   TestTokenStatusRevocationDuringUserInfoLookupRefuses\n"}
+{"Time":"2026-10-18T09:13:09.106752139Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses","Output":"--- PASS: TestTokenStatusRevocationDuringUserInfoLookupRefuses (0.04s)\n"}
+{"Time":"2026-10-18T09:13:09.106801545Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusRevocationDuringUserInfoLookupRefuses","Elapsed":0.04}
+{"Time":"2026-10-18T09:13:09.106830193Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim"}
+{"Time":"2026-10-18T09:13:09.106836009Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim","Output":"=== RUN   TestTokenStatusLegacyGrantHasNoStatusClaim\n"}
+{"Time":"2026-10-18T09:13:09.192501159Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim","Output":"--- PASS: TestTokenStatusLegacyGrantHasNoStatusClaim (0.09s)\n"}
+{"Time":"2026-10-18T09:13:09.192549636Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenStatusLegacyGrantHasNoStatusClaim","Elapsed":0.09}
+{"Time":"2026-10-18T09:13:09.192561133Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT"}
+{"Time":"2026-10-18T09:13:09.192566183Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT","Output":"=== RUN   TestTokenHandler_ValidExchange_ReturnsJWT\n"}
+{"Time":"2026-10-18T09:13:09.25373412Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT","Output":"--- PASS: TestTokenHandler_ValidExchange_ReturnsJWT (0.06s)\n"}
+{"Time":"2026-10-18T09:13:09.253782588Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ValidExchange_ReturnsJWT","Elapsed":0.06}
+{"Time":"2026-10-18T09:13:09.253792705Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode"}
+{"Time":"2026-10-18T09:13:09.253797259Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode","Output":"=== RUN   TestTokenHandler_SuspendedUserCannotExchangeCode\n"}
+{"Time":"2026-10-18T09:13:09.44678478Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode","Output":"--- PASS: TestTokenHandler_SuspendedUserCannotExchangeCode (0.19s)\n"}
+{"Time":"2026-10-18T09:13:09.446835168Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_SuspendedUserCannotExchangeCode","Elapsed":0.19}
+{"Time":"2026-10-18T09:13:09.44685203Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported"}
+{"Time":"2026-10-18T09:13:09.446857792Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported","Output":"=== RUN   TestTokenHandler_WrongGrantType_FeatureNotSupported\n"}
+{"Time":"2026-10-18T09:13:09.509295491Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported","Output":"--- PASS: TestTokenHandler_WrongGrantType_FeatureNotSupported (0.06s)\n"}
+{"Time":"2026-10-18T09:13:09.509348891Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_WrongGrantType_FeatureNotSupported","Elapsed":0.06}
+{"Time":"2026-10-18T09:13:09.509505282Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken"}
+{"Time":"2026-10-18T09:13:09.509523768Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken","Output":"=== RUN   TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken\n"}
+{"Time":"2026-10-18T09:13:09.682464288Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken","Output":"--- PASS: TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken (0.17s)\n"}
+{"Time":"2026-10-18T09:13:09.682592829Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_ReturnsScopedServiceToken","Elapsed":0.17}
+{"Time":"2026-10-18T09:13:09.682654426Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime"}
+{"Time":"2026-10-18T09:13:09.682730766Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime","Output":"=== RUN   TestTokenHandler_ClientCredentials_UsesPerClientLifetime\n"}
+{"Time":"2026-10-18T09:13:09.853436433Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime","Output":"--- PASS: TestTokenHandler_ClientCredentials_UsesPerClientLifetime (0.17s)\n"}
+{"Time":"2026-10-18T09:13:09.853510898Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_UsesPerClientLifetime","Elapsed":0.17}
+{"Time":"2026-10-18T09:13:09.853529113Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret"}
+{"Time":"2026-10-18T09:13:09.853540005Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret","Output":"=== RUN   TestTokenHandler_ClientCredentials_RejectsWrongSecret\n"}
+{"Time":"2026-10-18T09:13:09.983409995Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret","Output":"--- PASS: TestTokenHandler_ClientCredentials_RejectsWrongSecret (0.13s)\n"}
+{"Time":"2026-10-18T09:13:09.983481394Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsWrongSecret","Elapsed":0.13}
+{"Time":"2026-10-18T09:13:09.983492927Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope"}
+{"Time":"2026-10-18T09:13:09.98349951Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope","Output":"=== RUN   TestTokenHandler_ClientCredentials_RejectsExcessScope\n"}
+{"Time":"2026-10-18T09:13:10.019218762Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope","Output":"--- PASS: TestTokenHandler_ClientCredentials_RejectsExcessScope (0.04s)\n"}
+{"Time":"2026-10-18T09:13:10.019272496Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ClientCredentials_RejectsExcessScope","Elapsed":0.04}
+{"Time":"2026-10-18T09:13:10.019283948Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage"}
+{"Time":"2026-10-18T09:13:10.019289863Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage","Output":"=== RUN   TestTokenHandler_PKCEMismatch_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:13:10.120066017Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage","Output":"--- PASS: TestTokenHandler_PKCEMismatch_InvalidProfileUsage (0.10s)\n"}
+{"Time":"2026-10-18T09:13:10.12011398Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_PKCEMismatch_InvalidProfileUsage","Elapsed":0.1}
+{"Time":"2026-10-18T09:13:10.120124278Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage"}
+{"Time":"2026-10-18T09:13:10.12012875Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage","Output":"=== RUN   TestTokenHandler_CodeNotFound_InvalidProfileUsage\n"}
+{"Time":"2026-10-18T09:13:10.447758691Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage","Output":"--- PASS: TestTokenHandler_CodeNotFound_InvalidProfileUsage (0.33s)\n"}
+{"Time":"2026-10-18T09:13:10.447811153Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeNotFound_InvalidProfileUsage","Elapsed":0.33}
+{"Time":"2026-10-18T09:13:10.447828574Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer"}
+{"Time":"2026-10-18T09:13:10.447848692Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer","Output":"=== RUN   TestTokenHandler_JWTClaims_CorrectSubAndIssuer\n"}
+{"Time":"2026-10-18T09:13:10.54264301Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer","Output":"--- PASS: TestTokenHandler_JWTClaims_CorrectSubAndIssuer (0.09s)\n"}
+{"Time":"2026-10-18T09:13:10.542690197Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_JWTClaims_CorrectSubAndIssuer","Elapsed":0.09}
+{"Time":"2026-10-18T09:13:10.542700252Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope"}
+{"Time":"2026-10-18T09:13:10.542704859Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope","Output":"=== RUN   TestTokenHandler_ScopeFiltering_ProfileScope\n"}
+{"Time":"2026-10-18T09:13:10.765345727Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope","Output":"--- PASS: TestTokenHandler_ScopeFiltering_ProfileScope (0.22s)\n"}
+{"Time":"2026-10-18T09:13:10.765396035Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_ProfileScope","Elapsed":0.22}
+{"Time":"2026-10-18T09:13:10.765408938Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes"}
+{"Time":"2026-10-18T09:13:10.76541544Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes","Output":"=== RUN   TestTokenHandler_ScopeFiltering_AllScopes\n"}
+{"Time":"2026-10-18T09:13:11.166977398Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes","Output":"--- PASS: TestTokenHandler_ScopeFiltering_AllScopes (0.40s)\n"}
+{"Time":"2026-10-18T09:13:11.167026678Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_ScopeFiltering_AllScopes","Elapsed":0.4}
+{"Time":"2026-10-18T09:13:11.167036714Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry"}
+{"Time":"2026-10-18T09:13:11.167042052Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry","Output":"=== RUN   TestTokenHandler_TokenIssuedTelemetry\n"}
+{"Time":"2026-10-18T09:13:11.580539742Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry","Output":"--- PASS: TestTokenHandler_TokenIssuedTelemetry (0.41s)\n"}
+{"Time":"2026-10-18T09:13:11.580587669Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TokenIssuedTelemetry","Elapsed":0.41}
+{"Time":"2026-10-18T09:13:11.580601294Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse"}
+{"Time":"2026-10-18T09:13:11.58060656Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse","Output":"=== RUN   TestTokenHandler_CodeDeletedAfterUse\n"}
+{"Time":"2026-10-18T09:13:11.972519686Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse","Output":"--- PASS: TestTokenHandler_CodeDeletedAfterUse (0.39s)\n"}
+{"Time":"2026-10-18T09:13:11.972626035Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_CodeDeletedAfterUse","Elapsed":0.39}
+{"Time":"2026-10-18T09:13:11.972643871Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable"}
+{"Time":"2026-10-18T09:13:11.97264921Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable","Output":"=== RUN   TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable\n"}
+{"Time":"2026-10-18T09:13:12.077225309Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable","Output":"--- PASS: TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable (0.10s)\n"}
+{"Time":"2026-10-18T09:13:12.077275184Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_PresentWhenTenantEngineReachable","Elapsed":0.1}
+{"Time":"2026-10-18T09:13:12.07728311Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable"}
+{"Time":"2026-10-18T09:13:12.077288105Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable","Output":"=== RUN   TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable\n"}
+{"Time":"2026-10-18T09:13:12.264995426Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable","Output":"--- PASS: TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable (0.19s)\n"}
+{"Time":"2026-10-18T09:13:12.26504531Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedButIssuanceSucceedsWhenUnreachable","Elapsed":0.19}
+{"Time":"2026-10-18T09:13:12.265055202Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured"}
+{"Time":"2026-10-18T09:13:12.265060513Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured","Output":"=== RUN   TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured\n"}
+{"Time":"2026-10-18T09:13:12.412783544Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured","Output":"--- PASS: TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured (0.15s)\n"}
+{"Time":"2026-10-18T09:13:12.412832417Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestTokenHandler_TenantRoles_OmittedWhenTenantEngineNotConfigured","Elapsed":0.15}
+{"Time":"2026-10-18T09:13:12.412842165Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims"}
+{"Time":"2026-10-18T09:13:12.412847485Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims","Output":"=== RUN   TestUserinfoHandler_ValidToken_ReturnsClaims\n"}
+{"Time":"2026-10-18T09:13:12.575724881Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims","Output":"--- PASS: TestUserinfoHandler_ValidToken_ReturnsClaims (0.16s)\n"}
+{"Time":"2026-10-18T09:13:12.575815784Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ValidToken_ReturnsClaims","Elapsed":0.16}
+{"Time":"2026-10-18T09:13:12.575829138Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername"}
+{"Time":"2026-10-18T09:13:12.575835036Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername","Output":"=== RUN   TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername\n"}
+{"Time":"2026-10-18T09:13:12.668298745Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername","Output":"--- PASS: TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername (0.09s)\n"}
+{"Time":"2026-10-18T09:13:12.668350711Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_CanonicalSubjectResolvesViaPreferredUsername","Elapsed":0.09}
+{"Time":"2026-10-18T09:13:12.66836302Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken"}
+{"Time":"2026-10-18T09:13:12.668384409Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken","Output":"=== RUN   TestUserinfoHandler_SuspendedUserInvalidatesToken\n"}
+{"Time":"2026-10-18T09:13:12.777349277Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken","Output":"--- PASS: TestUserinfoHandler_SuspendedUserInvalidatesToken (0.11s)\n"}
+{"Time":"2026-10-18T09:13:12.777403362Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_SuspendedUserInvalidatesToken","Elapsed":0.11}
+{"Time":"2026-10-18T09:13:12.777416681Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401"}
+{"Time":"2026-10-18T09:13:12.777423128Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401","Output":"=== RUN   TestUserinfoHandler_MissingAuthorization_Returns401\n"}
+{"Time":"2026-10-18T09:13:12.888466376Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401","Output":"--- PASS: TestUserinfoHandler_MissingAuthorization_Returns401 (0.11s)\n"}
+{"Time":"2026-10-18T09:13:12.888518324Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_MissingAuthorization_Returns401","Elapsed":0.11}
+{"Time":"2026-10-18T09:13:12.888527296Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401"}
+{"Time":"2026-10-18T09:13:12.888532256Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401","Output":"=== RUN   TestUserinfoHandler_ExpiredToken_Returns401\n"}
+{"Time":"2026-10-18T09:13:13.046555389Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401","Output":"--- PASS: TestUserinfoHandler_ExpiredToken_Returns401 (0.16s)\n"}
+{"Time":"2026-10-18T09:13:13.046618284Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_ExpiredToken_Returns401","Elapsed":0.16}
+{"Time":"2026-10-18T09:13:13.046642486Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401"}
+{"Time":"2026-10-18T09:13:13.046649276Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401","Output":"=== RUN   TestUserinfoHandler_InvalidSignature_Returns401\n"}
+{"Time":"2026-10-18T09:13:13.403812529Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401","Output":"--- PASS: TestUserinfoHandler_InvalidSignature_Returns401 (0.36s)\n"}
+{"Time":"2026-10-18T09:13:13.403872187Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_InvalidSignature_Returns401","Elapsed":0.36}
+{"Time":"2026-10-18T09:13:13.403882286Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent"}
+{"Time":"2026-10-18T09:13:13.403887354Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent","Output":"=== RUN   TestUserinfoHandler_WithEmailScope_EmailPresent\n"}
+{"Time":"2026-10-18T09:13:13.487939135Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent","Output":"--- PASS: TestUserinfoHandler_WithEmailScope_EmailPresent (0.08s)\n"}
+{"Time":"2026-10-18T09:13:13.487989163Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithEmailScope_EmailPresent","Elapsed":0.08}
+{"Time":"2026-10-18T09:13:13.48800295Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent"}
+{"Time":"2026-10-18T09:13:13.488009353Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent","Output":"=== RUN   TestUserinfoHandler_WithoutEmailScope_EmailAbsent\n"}
+{"Time":"2026-10-18T09:13:13.815803319Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent","Output":"--- PASS: TestUserinfoHandler_WithoutEmailScope_EmailAbsent (0.33s)\n"}
+{"Time":"2026-10-18T09:13:13.815885304Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithoutEmailScope_EmailAbsent","Elapsed":0.33}
+{"Time":"2026-10-18T09:13:13.815905124Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent"}
+{"Time":"2026-10-18T09:13:13.815913158Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent","Output":"=== RUN   TestUserinfoHandler_WithProfileScope_UsernamePresent\n"}
+{"Time":"2026-10-18T09:13:13.892494164Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent","Output":"--- PASS: TestUserinfoHandler_WithProfileScope_UsernamePresent (0.08s)\n"}
+{"Time":"2026-10-18T09:13:13.892561902Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_WithProfileScope_UsernamePresent","Elapsed":0.08}
+{"Time":"2026-10-18T09:13:13.892576952Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry"}
+{"Time":"2026-10-18T09:13:13.892585247Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry","Output":"=== RUN   TestUserinfoHandler_EmitsTelemetry\n"}
+{"Time":"2026-10-18T09:13:14.02650393Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry","Output":"--- PASS: TestUserinfoHandler_EmitsTelemetry (0.13s)\n"}
+{"Time":"2026-10-18T09:13:14.026569774Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_EmitsTelemetry","Elapsed":0.13}
+{"Time":"2026-10-18T09:13:14.026594995Z","Action":"run","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401"}
+{"Time":"2026-10-18T09:13:14.026604093Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401","Output":"=== RUN   TestUserinfoHandler_UserNotFound_Returns401\n"}
+{"Time":"2026-10-18T09:13:14.10461614Z","Action":"output","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401","Output":"--- PASS: TestUserinfoHandler_UserNotFound_Returns401 (0.08s)\n"}
+{"Time":"2026-10-18T09:13:14.10466459Z","Action":"pass","Package":"keycape/internal/server/oidc","Test":"TestUserinfoHandler_UserNotFound_Returns401","Elapsed":0.08}
+{"Time":"2026-10-18T09:13:14.104675266Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"PASS\n"}
+{"Time":"2026-10-18T09:13:15.116216542Z","Action":"output","Package":"keycape/internal/server/oidc","Output":"ok  \tkeycape/internal/server/oidc\t18.853s\n"}
+{"Time":"2026-10-18T09:13:15.11629565Z","Action":"pass","Package":"keycape/internal/server/oidc","Elapsed":18.854}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/integration-attempt1.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/integration-attempt1.json
new file mode 100644
index 0000000..0c0f72e
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/integration-attempt1.json
@@ -0,0 +1,244 @@
+{
+  "returncode": 0,
+  "seconds": 3.95,
+  "argv": [
+    "bwrap",
+    "--unshare-net",
+    "--unshare-pid",
+    "--die-with-parent",
+    "--new-session",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--symlink",
+    "usr/bin",
+    "/bin",
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+    "--bind",
+    "/tmp/custodian-keycape-current-client-integration-r1",
+    "/work",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod",
+    "/modules",
+    "--ro-bind",
+    "/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64",
+    "/toolchain",
+    "--chdir",
+    "/work/source/src",
+    "--clearenv",
+    "--ro-bind",
+    "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/current_session_owner.py",
+    "/fixture-owner.py",
+    "--ro-bind",
+    "/home/worsch/ops-warden/.venv/lib/python3.12/site-packages",
+    "/python-site",
+    "--bind",
+    "/tmp/custodian-keycape-token-status-r1/gocache",
+    "/work/gocache",
+    "--setenv",
+    "PATH",
+    "/toolchain/bin:/usr/bin:/bin",
+    "--setenv",
+    "HOME",
+    "/work/home",
+    "--setenv",
+    "GOTOOLCHAIN",
+    "local",
+    "--setenv",
+    "GOPROXY",
+    "off",
+    "--setenv",
+    "GOSUMDB",
+    "off",
+    "--setenv",
+    "GOMODCACHE",
+    "/modules",
+    "--setenv",
+    "GOCACHE",
+    "/work/gocache",
+    "--setenv",
+    "GOMAXPROCS",
+    "4",
+    "--setenv",
+    "CGO_ENABLED",
+    "1",
+    "--setenv",
+    "PYTHONPATH",
+    "/work/warden-source/src:/python-site",
+    "--setenv",
+    "PYTHONDONTWRITEBYTECODE",
+    "1",
+    "--setenv",
+    "KEYCAPE_FIXTURE_BINARY",
+    "/work/keycape-candidate",
+    "--setenv",
+    "KEYCAPE_PUBLIC_CONSUMER",
+    "/work/tokenstatus-consumer",
+    "--setenv",
+    "KEYCAPE_OWNER_FIXTURE",
+    "/fixture-owner.py",
+    "--setenv",
+    "KEYCAPE_OWNER_REPORT",
+    "/work/owner-boundary-result.json",
+    "--",
+    "go",
+    "test",
+    "-p",
+    "4",
+    "-race",
+    "-json",
+    "-count=1",
+    "-tags",
+    "current_owner_fixture",
+    "-run",
+    "^TestOnlineActualOwnerBoundaryAcrossProcesses$",
+    "./internal/authclient"
+  ],
+  "source_sha256_at_start": {
+    "src/go.mod": "sha256:ab299ad4f94feb78e217e2228a4aa161b166460aa28df0c5009451ac1a337456",
+    "src/Makefile": "sha256:6cdd3aa6e1cccaf4e028278acafe3e6a8d28170de89ff3462984d4f6eb56bd96",
+    "src/go.sum": "sha256:b10ad54277fb2bd927d3af727fc4dbb9ebe91a038a75be0469d0253ca699226d",
+    "src/tests/negative/negative_test.go": "sha256:757485bf1967ed95e872d4a1987b7fd985fbffccd05cf41270b9f4061431de3f",
+    "src/tests/conformance/external_test.go": "sha256:b26bd465e31086f957c9e374b6bee1f0f077b7481eda9daa29cf63816bb87fdb",
+    "src/tests/migration/scenario_c_test.go": "sha256:9722146ac224768aff85476acbd83f3d478c1e060e5a3c6f99b1786858879b80",
+    "src/tests/migration/fixtures_test.go": "sha256:3fbcb8f531fa206225f719a67b744b2ecb908095fbae0538432796697971e6de",
+    "src/tests/migration/scenario_b_test.go": "sha256:40ae7239d116f3e284c767570d39e1f32d44fc29b6fa37ea8835987027942ac0",
+    "src/tests/profile/profile_test.go": "sha256:e5ab4568b15f681a13c9295b17907ca3872ee33b702bb56aea749f17758d29e6",
+    "src/internal/domain/assurance_test.go": "sha256:87680e7afd47294dadc13092ca2bb7c47b9625c80e48a701765c00df3293d755",
+    "src/internal/domain/conformance_test.go": "sha256:6420ec21d4e7a97f60902e1f0debbaf20df91aeac6ab110629b82a67f4c5c9a1",
+    "src/internal/domain/repository.go": "sha256:28f6d8f7f3d822e73f164af5e877f252db7dc6faa97f0ebf75d76aad64078011",
+    "src/internal/domain/auth.go": "sha256:ae800c5b1f58408147dd28a5c87ab2603b1537500a289397e711a4cb0e132cee",
+    "src/internal/domain/model.go": "sha256:ce4309fc7426c66e4ebc18022d2f704c10ebbec243cc98e657d1de765ad09029",
+    "src/internal/domain/assurance.go": "sha256:d3a29ece7c4fa4d9daa8b5fda89cbe0dd1ffef2ee2ecae0051ee68010edb8fd7",
+    "src/internal/domain/mfa.go": "sha256:1b7875b08a0f280a20a14a4fa4fdb4fc84c3942795b1d1417943d32634121b87",
+    "src/internal/authclient/cli.go": "sha256:009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c",
+    "src/internal/authclient/client.go": "sha256:61fb150349c5d3714450a90834c59af9a579a8a649c4149297a402cfcf6e39c5",
+    "src/internal/authclient/online_cli.go": "sha256:6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2",
+    "src/internal/authclient/verify.go": "sha256:804735be927ba7d0228ac378056730040d3ccf2ed020b4da0714085bae972f25",
+    "src/internal/authclient/online.go": "sha256:182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a",
+    "src/internal/authclient/online_export_test.go": "sha256:5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba",
+    "src/internal/authclient/client_test.go": "sha256:23642488fcff45e369d22ba0000c47e0e450c5f92560e643ab96303e2a2f43aa",
+    "src/internal/authclient/online_cli_test.go": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f",
+    "src/internal/authclient/online_test.go": "sha256:6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a",
+    "src/internal/authclient/current_owner_fixture_test.go": "sha256:e41d0b56e8e9cc4cc7604ae6a84eec145870005697c3e97f2d86d92bdf8eb87d",
+    "src/internal/authclient/online_human_test.go": "sha256:e501c30b6d710a6dea89559ccf8b98de68502c2ee58d1778a56e97f1b7f3b6e0",
+    "src/internal/authclient/verify_test.go": "sha256:7febc6698c87eac5fd8d2520c4f77c68e82f18a2aafa448cfa4990b96fdc46fc",
+    "src/internal/validator/report.go": "sha256:6bc4d31f932ea9a32020cf33203978906730dfe3601350ded0206ff6c8c297a8",
+    "src/internal/validator/validator_test.go": "sha256:8216027a464eab4167d8e87b4d27d130854d7b9cd4cc8a1b6f1a47ff1f9a2276",
+    "src/internal/validator/validator.go": "sha256:3d0a8bf8ebbe54e21e162c8f7df6e4a4d69ab997a01969b74dcbd53decdf559f",
+    "src/internal/config/account_test.go": "sha256:c6b75097d14dd42415c836407fa2a509857cdd2b771fb7e53d4507cbad2f4b1d",
+    "src/internal/config/validate.go": "sha256:2b1766979b817802f43bdd0f999ac61452d86cdfafc1539a5d6be896b900a405",
+    "src/internal/config/optional_mfa_test.go": "sha256:03a00bc309943adbed68bdb9bf47facb6b3b50ef380fd49143b5ed54d684f63e",
+    "src/internal/config/config_test.go": "sha256:af8602010985a0a5a6b4b2bf779f824e7eb5141e6bc2e8d8fcf600b964955100",
+    "src/internal/config/token_status_test.go": "sha256:b2b2ec13215c9661d79142ea698cb8b080f6e017de050bedebf3eb8d16df2ad5",
+    "src/internal/config/config.go": "sha256:19cd234757f8908880d28b8b40939367dfab1322e0401e4e563d56cd3af06683",
+    "src/internal/errors/taxonomy.go": "sha256:7d60f30a4ff0c9a21a3942451eb0292320a6346d3d81508e414a7dfbdc3c666c",
+    "src/internal/errors/taxonomy_test.go": "sha256:6c0bdf1f8e90ea343d88f57f80f6c916c92428a9ac2191a518ee7b70df0eed45",
+    "src/internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "src/internal/jose/jose_test.go": "sha256:cbbcbac620b27c8e93d9dc3fefc3ca4fcd20ab58c6bc8f79eb041b980aaa9a43",
+    "src/internal/server/policy/policy_test.go": "sha256:25644557ca532b608dff4e02b202c5c3b7c423fb31e98ad0609febf3660183a2",
+    "src/internal/server/policy/policy.go": "sha256:015d0b42419c501a46171d09a8f7d588dd517d4c98ad14344ff52113294e0fe7",
+    "src/internal/server/errors/enforcement.go": "sha256:f644546b1423992518fc4078ab561ab68fea1fcff00b734795af6652ae3dd4e2",
+    "src/internal/server/errors/enforcement_test.go": "sha256:b4ea0c9a3aaebd66b0b0fcc73f544c76d5a377ac0c9561ccc2638a236844374c",
+    "src/internal/server/telemetry/emitter.go": "sha256:e92f008b6a487a47b8ee2b98011a3a5b821838a61be9c4db4d56cda600e6fda0",
+    "src/internal/server/telemetry/emitter_test.go": "sha256:29fae2460deb7219eb8edc725b3701a02d2b341fee62bffb2661a520f5a7381a",
+    "src/internal/server/telemetry/events.go": "sha256:3f9df9822649ae2701c3bbf475c8e6d600bc60b7ccdea4d0e54193162d5b0167",
+    "src/internal/server/readiness/readiness_test.go": "sha256:10163e0b1d2f41f336d61782c3bfffdd1116a8459247cc933ffb40be645184c6",
+    "src/internal/server/readiness/readiness.go": "sha256:ffe22b99633b1aa50fc299371398ec0f3fc090c9c8a5f4957c6bfa76b001d073",
+    "src/internal/server/oidc/discovery_test.go": "sha256:2d0dc24d59497aa5a9aa581f8fd3d9cca300d7e0cb4962907630570d60e7e7f0",
+    "src/internal/server/oidc/tenant_precondition_test.go": "sha256:2f2c0d90d26da4e3a6c9145aec8c9d7121c791b6b993c2fe8893a763a30fa72f",
+    "src/internal/server/oidc/userinfo.go": "sha256:f9c986f7a2c79f27a9970a296e6b493014fed77af2f22ba96c4a457d049c916f",
+    "src/internal/server/oidc/account.go": "sha256:b0e36d8cb5f9b1bf4cee573e46b204800c0e3162a912a122b271def4712ab72a",
+    "src/internal/server/oidc/policy_runtime_test.go": "sha256:856146013d2aaa60836e669c297024923ed8e2856d31a89744a99baadae4a74a",
+    "src/internal/server/oidc/handoff_test.go": "sha256:23268b7f9f103f8a8798a168004580bc8fdb3a175161220dac26480a89f28e02",
+    "src/internal/server/oidc/human_tenant_test.go": "sha256:459664f90d76224958b3dd807d95d7bfcf0fce5f113498bd9886a41be19903a5",
+    "src/internal/server/oidc/discovery.go": "sha256:00e4c831a2b4d29aecf3597a09c943315b87c5834dbcd4912ba5d8d31ab28cd5",
+    "src/internal/server/oidc/jwks.go": "sha256:426d6596979ed6d097d6aaae66b6475d1c97687888c6ab1050c05cb14653ec60",
+    "src/internal/server/oidc/login_session.go": "sha256:efb0fcd066d81d753b7043c9c3d9e74e35cd510ca4304d21a51ba29dec833e1f",
+    "src/internal/server/oidc/hardening_test.go": "sha256:b41d6a987d5507d5160d970d0f2110ce681851fca1f4f7a3a9573163e8cd6f3e",
+    "src/internal/server/oidc/jwks_test.go": "sha256:9100e83e58ce2cc2f6d2f47804ee0ce035ca424b209597a12c4ef1a8896163aa",
+    "src/internal/server/oidc/account_test.go": "sha256:db1f7b8a2989b1d0deffee205ec9f4f35c7472135dcb8a10b5498893d881d763",
+    "src/internal/server/oidc/token_status_discovery_test.go": "sha256:27adb5797afba46ca2b1f16018721f055f82760498088b58b993730be1fa2031",
+    "src/internal/server/oidc/principal_type_guard_test.go": "sha256:b3fa097691f07594616e09e8775512d586a019ccdf8302bf594c1ac94f5f3f40",
+    "src/internal/server/oidc/token_status_http.go": "sha256:a7202d3176454f8ab42c090426e2debcb5cc2c1fc089e79746bb78e5c455af97",
+    "src/internal/server/oidc/native_optional_test.go": "sha256:329907bf7089d8f3ea05baad919d05677b8c3aaa201e6f233795ae9f69c003b5",
+    "src/internal/server/oidc/authorize_test.go": "sha256:61042d55e20a11fb6e1e9e6c054e50c0f629b702ed6d8da281d52529e5c29b0d",
+    "src/internal/server/oidc/session.go": "sha256:48473ebe123285ed21e7738834d9d9168dfc855d911cb9e7ce7e87b069a23a3c",
+    "src/internal/server/oidc/logout.go": "sha256:d4de80f8056e7a65c7a41f244dd38e447a4e04df729760a8a59cb6bb4e063893",
+    "src/internal/server/oidc/optional_mfa_test.go": "sha256:d758848d845c181cf1b18710e6ca24977f6b7576320dcad1f7293a5433c3b529",
+    "src/internal/server/oidc/token.go": "sha256:304fa78d79a5436b9174d88991c19c0834356cb5425c6ed369accb85467a402f",
+    "src/internal/server/oidc/token_status.go": "sha256:d9c22a71bb2efad7ea240f2689a98f14768ce3c1519d1d8b4e78ee7af2dc70b3",
+    "src/internal/server/oidc/userinfo_test.go": "sha256:e88c42c7cdf50d5953c9f594f0b99b4f87f5e223ba1cb44b70d696972016da80",
+    "src/internal/server/oidc/signin_diagnosis_test.go": "sha256:97e80be67c480dfe8eef0683f25868a91a0fdc96472b5296b734b56274270b3e",
+    "src/internal/server/oidc/policy_isolation_test.go": "sha256:35cb9870f5942c61c0e8c6ca875e9080bbd71c46c7b20fb18da01be88e0fa077",
+    "src/internal/server/oidc/token_test.go": "sha256:5721617c6e5eb79a3b5e86efa63e9278a8d81a0d7c01bf7b184255c102848e33",
+    "src/internal/server/oidc/audience_test.go": "sha256:1b751e1aafb5dbdcb751b42b001e32ddfaccfa3d5ba9d5af67b44148d9802ae3",
+    "src/internal/server/oidc/token_status_transport_test.go": "sha256:3a9945f0292125e86d0014b5245a20c0475d6c518eccff0f9b936356d8e0b347",
+    "src/internal/server/oidc/tenant_test.go": "sha256:8a3879789589f0c3d6e473ba56dd7d7c86ec6fbdddaafa4b13354f82d5f88713",
+    "src/internal/server/oidc/assurance_time_test.go": "sha256:911f65e8cea87ef867d6bf98199ed55abd29427b9f8d0838977d228e6186b08a",
+    "src/internal/server/oidc/signin_diagnosis.go": "sha256:b7976a1cfe1d8d1dca890cf0762cc82d08978a2e7537e45988b147ed0222042f",
+    "src/internal/server/oidc/authorize.go": "sha256:04f9bfb6b146ecf869161b7a0eb00b6486f424710c2c867e4f4b70af5f44ff5e",
+    "src/internal/server/oidc/handoff.go": "sha256:a2ffede12c9140a6c7d14632122a39ffbd0e707cd357dcc11d3ad885dc2a7fa4",
+    "src/internal/server/oidc/token_status_internal_test.go": "sha256:3d3ab41987c7586bd53af8b5c36ff6667b5b2a32d59789915eb9a36b7ceeba53",
+    "src/internal/server/oidc/token_status_test.go": "sha256:e2613d44deefcbfbd0ce1db5ce2588849fb4be9b8bed33cb538171cc29f63e90",
+    "src/internal/migration/lldapexport/exporter.go": "sha256:cb041827c9c0edf9da1338e966e7722e3765065582933b8c17b0d9008d44d103",
+    "src/internal/migration/lldapexport/exporter_test.go": "sha256:6f5cf0e43ea8aea9ceeb6d4d3ae0bfd9f3a5d18636dd49bea0c574c5253a44c2",
+    "src/internal/migration/tokeycloak/transformer_test.go": "sha256:5c3f5145a37079262db805f5bedaabe1d42edf2ccec1788c09c02f5b8336639b",
+    "src/internal/migration/tokeycloak/transformer.go": "sha256:856e26fd2075f020ef02373b5b7e9e5a1e98473b5caca95b60b7983287fc10aa",
+    "src/internal/migration/toldap/generator.go": "sha256:e59ba05203145f52818b3f4e34ab62126481faa9dde697f643fc1cda0638bb46",
+    "src/internal/migration/toldap/generator_test.go": "sha256:73b0969ce2e2cb018aa5734714c86152d1695f0099a5caf7dd96b773717fc2cc",
+    "src/internal/adapters/tenantengine/adapter.go": "sha256:a54ef12fafd2efc24c547d562e0a558a7ecef586394e79f7de345dc8cbbbbef3",
+    "src/internal/adapters/tenantengine/adapter_test.go": "sha256:b9c2db04bc187e6e6e56d4a42d4e657b9e56fef06843500fb4640477dee553e0",
+    "src/internal/adapters/lldap/adapter.go": "sha256:e7df7a159e9dd33a97932fd8cbde49a61091b8722796bf54ae4be887b4a3f5ef",
+    "src/internal/adapters/lldap/railiance_admin_test.go": "sha256:63db481bb6e592e91bf4a555e75065fbd3bd8cd408a7967a4b7786e12bef5d5f",
+    "src/internal/adapters/lldap/adapter_test.go": "sha256:650394ccc25d54c73c03746977a1880b1ed905634da8382da0ecf35843454081",
+    "src/internal/adapters/lldap/config_internal_test.go": "sha256:cbc71ce9a795b73c40b2714153eb2ee4d2e4007f7f56a7882eb862c23868cb68",
+    "src/internal/adapters/lldap/config.go": "sha256:33059a27418b00e1987b7ced0b21dd39c1765338bf575fe2333ce3e606e5546b",
+    "src/internal/adapters/privacyidea/credential_file_test.go": "sha256:9db15562c6fdf01e0806bbc478915413b17adb63c7e9ba213acfc4f9b2b2f0b6",
+    "src/internal/adapters/privacyidea/read_scope_test.go": "sha256:4685e1b84dad044db12708ecd231d4f91ec22ac45901ed2b5177e3be17d8cdc3",
+    "src/internal/adapters/privacyidea/adapter.go": "sha256:2559c68b5aa22bc5f61961e47d696b376f8bede533be03715ffc80c0d89ed904",
+    "src/internal/adapters/privacyidea/adapter_test.go": "sha256:6257489b9c51270da2c96f165c0efd1750b273218df51dca907d29c64c98b349",
+    "src/internal/adapters/privacyidea/optional_mfa_test.go": "sha256:e2e415c671d1d0e7f30a0ce22f5ec58914d8e366b12e445e13b1d645a9ca6a65",
+    "src/internal/adapters/privacyidea/enrollment_state_test.go": "sha256:dcf24c486629fa4835cddaa786af31ec78c05907694d4d93bce0f32876806377",
+    "src/internal/adapters/privacyidea/config.go": "sha256:8dd769b18c04c562714794484630acdbda81b34ab1cfaf9cc7445513207e5021",
+    "src/internal/adapters/authelia/verify.go": "sha256:189f9bc18b8d4319d2d88ee76a76e3b86468ebafde85ef460a4bafb7b350b4c4",
+    "src/internal/adapters/authelia/adapter.go": "sha256:2887bd546f43a16338547dab5ce4a90850c670ed6f6c0d610a5d08c72c7f3f45",
+    "src/internal/adapters/authelia/adapter_test.go": "sha256:d450b37e2b2405c189d444e50f0612e64177d6698cb4665a06ad967ae2224f93",
+    "src/internal/adapters/authelia/issuer_probe.go": "sha256:5846e2b514077a572611b898f449c04b096b086aeb724da055b2416994a7a7bb",
+    "src/internal/adapters/authelia/issuer_probe_test.go": "sha256:a85e02399f8a5c81401dbf159e8054420bff56e08c8a98e8026cad8d31fcecec",
+    "src/internal/adapters/authelia/config.go": "sha256:1b85ea3ffd324bced1ba108492ec780af8ba2b015d22cd51b294afaf36f2ec55",
+    "src/internal/adapters/authelia/verify_test.go": "sha256:f1570604d5038e49c14791f4d1aa278ad76a7e90294e82813d2c21e6a80a5511",
+    "src/cmd/keycape-to-keycloak/main.go": "sha256:6141d3f86bbe3df2a814a0c9995e537d32bf7b19f5549e89d40974eb3270faf7",
+    "src/cmd/lldap-to-ldap/main.go": "sha256:adcc9481d009cad909bd55a71d95c17ce30e29ca63e88a7c9e8101b92d4b872e",
+    "src/cmd/keycape/clients_test.go": "sha256:6a3982c1b2bd9b15c387ba64d4c87b37304dc6f615ed2ab22eec888f620cb1da",
+    "src/cmd/keycape/checkconfig.go": "sha256:2c47c9aedf3457627fdec991703e3be50e5ef554e4104cf3741f8347687279f2",
+    "src/cmd/keycape/main.go": "sha256:553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0",
+    "src/cmd/keycape/checkconfig_test.go": "sha256:06955c996774109b26e4751ab20787f12718a1de96e3483a775fb19688d90e66",
+    "src/cmd/validator/main.go": "sha256:e53b0a7860537dfb1cec69a00cdafe7073b35802421b5977f2fece4de01b9c1f",
+    "src/cmd/lldap-export/main_test.go": "sha256:f105e490c717a414a5a3d1e65ceb4edcf74341ad7713b0accf8117a9b1ee02d2",
+    "src/cmd/lldap-export/main.go": "sha256:f019a6dbb0849d06d5c3729874293d520478ca2887929a0595b59a324097ae75"
+  },
+  "counts_including_subtests": {
+    "pass": 1,
+    "fail": 0,
+    "skip": 0
+  },
+  "failures": [],
+  "skips": [],
+  "source": "/tmp/custodian-keycape-current-client-integration-r1/source",
+  "native_acceptance": false,
+  "credentials_accessed": false,
+  "network": "private empty namespace; fixture loopback only",
+  "home": "new empty sandbox HOME"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/integration-attempt1.jsonl b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/integration-attempt1.jsonl
new file mode 100644
index 0000000..5aa8a9b
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/integration-attempt1.jsonl
@@ -0,0 +1,8 @@
+{"Time":"2026-10-18T09:09:49.041534435Z","Action":"start","Package":"keycape/internal/authclient"}
+{"Time":"2026-10-18T09:09:49.060116204Z","Action":"run","Package":"keycape/internal/authclient","Test":"TestOnlineActualOwnerBoundaryAcrossProcesses"}
+{"Time":"2026-10-18T09:09:49.060220281Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualOwnerBoundaryAcrossProcesses","Output":"=== RUN   TestOnlineActualOwnerBoundaryAcrossProcesses\n"}
+{"Time":"2026-10-18T09:09:49.919297986Z","Action":"output","Package":"keycape/internal/authclient","Test":"TestOnlineActualOwnerBoundaryAcrossProcesses","Output":"--- PASS: TestOnlineActualOwnerBoundaryAcrossProcesses (0.86s)\n"}
+{"Time":"2026-10-18T09:09:49.919485157Z","Action":"pass","Package":"keycape/internal/authclient","Test":"TestOnlineActualOwnerBoundaryAcrossProcesses","Elapsed":0.86}
+{"Time":"2026-10-18T09:09:49.919503065Z","Action":"output","Package":"keycape/internal/authclient","Output":"PASS\n"}
+{"Time":"2026-10-18T09:09:50.926739244Z","Action":"output","Package":"keycape/internal/authclient","Output":"ok  \tkeycape/internal/authclient\t1.884s\n"}
+{"Time":"2026-10-18T09:09:50.926844322Z","Action":"pass","Package":"keycape/internal/authclient","Elapsed":1.885}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/issuer_warden_fixture_test.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/issuer_warden_fixture_test.go
new file mode 100644
index 0000000..540eec7
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/issuer_warden_fixture_test.go
@@ -0,0 +1,90 @@
+//go:build current_owner_fixture
+
+package authclient
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestOnlineActualOwnerBoundaryAcrossProcesses(t *testing.T) {
+	f := onlineProvider(t)
+	first, second := f.issue(), f.issue()
+	admission, firstFile, _ := f.cliInput(first)
+	_, secondFile, _ := f.cliInput(second)
+	directory, err := os.MkdirTemp(t.TempDir(), "owner-")
+	if err != nil {
+		t.Fatal("private fixture directory failed")
+	}
+	config := map[string]interface{}{"directory": directory, "binary": os.Getenv("KEYCAPE_FIXTURE_BINARY"),
+		"admission": admission, "subject": "service:fixture", "tenant": "tenant:fixture", "client_id": "current-client",
+		"sessions": map[string]interface{}{"initial": map[string]string{"file": firstFile, "digest": tokenDigest(first)}, "inverse": map[string]string{"file": secondFile, "digest": tokenDigest(second)}}}
+	configFile := filepath.Join(directory, "source-fixture.json")
+	data, _ := json.Marshal(config)
+	if os.WriteFile(configFile, data, 0600) != nil {
+		t.Fatal("private fixture input failed")
+	}
+	var consumerResults []map[string]interface{}
+	probe := func(tokenFile string, expected bool, label string) {
+		input := struct {
+			Admission OnlineAdmission
+			Expected  ExpectedIdentity
+			TokenFile string
+		}{f.client.admission, onlineExpected, tokenFile}
+		data, _ := json.Marshal(input)
+		file := filepath.Join(directory, label+"-input.json")
+		out := filepath.Join(directory, label+"-observation.json")
+		if os.WriteFile(file, data, 0600) != nil {
+			t.Fatal("consumer fixture input failed")
+		}
+		command := exec.Command(os.Getenv("KEYCAPE_PUBLIC_CONSUMER"), file, out)
+		output, err := command.CombinedOutput()
+		if (err == nil) != expected {
+			t.Fatal("generated Go consumer status mismatch")
+		}
+		if strings.Contains(string(output), first) || strings.Contains(string(output), second) || strings.Contains(string(output), f.issuer.ClientConfig["current-client"].ClientSecret) {
+			t.Fatal("consumer diagnostics disclosed fixture credentials")
+		}
+		if !expected {
+			if _, err := os.Stat(out); !os.IsNotExist(err) {
+				t.Fatal("refused consumer retained observation")
+			}
+		}
+		consumerResults = append(consumerResults, map[string]interface{}{"label": label, "expected_current": expected, "matched": true})
+	}
+	probe(firstFile, true, "go-current-initial")
+	var ownerResults []interface{}
+	for _, phase := range []string{"run", "inverse"} {
+		command := exec.Command("python3", os.Getenv("KEYCAPE_OWNER_FIXTURE"), configFile, phase)
+		output, err := command.CombinedOutput()
+		if err != nil {
+			t.Fatalf("isolated owner phase %s failed: %s", phase, string(output))
+		}
+		if strings.Contains(string(output), first) || strings.Contains(string(output), second) || strings.Contains(string(output), f.issuer.ClientConfig["current-client"].ClientSecret) {
+			t.Fatal("owner diagnostics disclosed fixture credentials")
+		}
+		var result interface{}
+		data, err = os.ReadFile(filepath.Join(directory, phase+"-result.json"))
+		if err != nil || json.Unmarshal(data, &result) != nil {
+			t.Fatal("owner result missing")
+		}
+		ownerResults = append(ownerResults, result)
+		if phase == "run" {
+			probe(firstFile, false, "go-revoked-initial")
+			probe(secondFile, true, "go-current-inverse")
+		}
+	}
+	probe(secondFile, false, "go-revoked-inverse")
+	report := map[string]interface{}{"status": "passed", "owner_processes": 2, "consumer_processes": 4, "owner_results": ownerResults,
+		"go_consumer_results": consumerResults, "issuer": "actual KeyCape token/status handlers over fixture HTTPS",
+		"owner_kernel": "actual Warden Executor/Journal", "admission_and_target": "synthetic source fixture only",
+		"credentials": "synthetic and retained only inside fixture tmpfs", "native_acceptance": false}
+	data, _ = json.MarshalIndent(report, "", "  ")
+	if os.WriteFile(os.Getenv("KEYCAPE_OWNER_REPORT"), append(data, '\n'), 0600) != nil {
+		t.Fatal("fixture report failed")
+	}
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/owner-source.patch b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/owner-source.patch
new file mode 100644
index 0000000..d8848af
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/owner-source.patch
@@ -0,0 +1,2358 @@
+diff --git a/Makefile b/Makefile
+--- a/Makefile
++++ b/Makefile
+@@ -3,7 +3,7 @@
+ IMAGE_TAG      ?= latest
+ IMAGE          := $(IMAGE_REGISTRY)/$(IMAGE_REPO):$(IMAGE_TAG)
+ 
+-.PHONY: dev seed build test lint contract-test image push image-tag
++.PHONY: dev seed build test lint contract-test image push image-tag tokenstatus-export tokenstatus-check
+ 
+ PLAYBOOK_VALIDATOR ?= ../net-kingdom/tools/playbook-capability-contract/playbook_contract_validator.py
+ 
+@@ -16,8 +16,14 @@
+ build:
+ 	cd src && go build ./...
+ 
+-test:
++test: tokenstatus-check
+ 	cd src && go test ./...
++
++tokenstatus-export:
++	python3 tools/export_tokenstatus_client.py
++
++tokenstatus-check:
++	python3 tools/export_tokenstatus_client.py --check
+ 
+ lint:
+ 	cd src && go vet ./...
+diff --git a/adapters/go/tokenstatus/LICENSE b/adapters/go/tokenstatus/LICENSE
+--- /dev/null
++++ b/adapters/go/tokenstatus/LICENSE
+@@ -0,0 +1,151 @@
++# Target Revenue Source License
++
++**Version 1.0, Candidate 1 (V1C1)**
++
++---
++
++> **PRELIMINARY CANDIDATE — SUBJECT TO CHANGE — NOT FINAL**
++>
++> This repository is governed by the Target Revenue Source License
++> (TRSL), Version 1, Candidate 1. This is the framework's first working
++> candidate, adopted as the org's preliminary operating license across
++> all repos (maintainer decision, 2026-07-29) during the build/alpha
++> stage — see `SCOPE.md` §1 and Appendix A of the canonical text (link
++> below) for the alpha/beta risk-acceptance decision this reflects and
++> what it does and does not mean. Full specialist legal review is
++> explicitly deferred until the framework moves out of beta.
++>
++> **Canonical source, full candidate-status banner, and Appendix A
++> (non-normative candidate notes tracking every open item):** the
++> `coulomb` org's `target-revenue` repository,
++> `specs/TargetRevenueSourceLicense-V1C1.md` — this file is the operative
++> legal text (Preamble through Section 11) only; the canonical document
++> is authoritative if this copy and that document ever diverge.
++
++---
++
++## Preamble
++
++This Target Revenue Source License ("**License**") governs the Software identified in the applicable Phase Manifest. It implements the Target Revenue Framework: a defined development Phase accumulates Development Credit and Remission Credit against an immutable Initial Target until the Milestone Release automatically and irrevocably converts to a declared permissive Future License.
++
++Commercial beneficiaries fund the creation and early availability of a software improvement; once the declared target is satisfied, the governed release becomes permissively open source.
++
++## 1. Definitions
++
++Capitalized terms used in this License have the meanings given below. Where a term is also defined in the Phase Manifest or Target Ledger for a specific Phase, the Phase Manifest and Target Ledger govern the *values* (amounts, dates, identifiers) and this License governs the *legal effect* of those values — the two must not be read as conflicting definitions of the same concept.
++
++**"Commercial Entitlement"** means a right, purchased or otherwise granted under a Commercial Use Agreement, to make Commercial Use of the Software during a Phase.
++
++**"Commercial Use"** means billing, invoicing, or otherwise charging any customer a fee, subscription, license fee, or other consideration for or in connection with use of the Software, at any time before the Conversion Event for the applicable Phase, regardless of whether the person or organization billed would otherwise qualify for Noncommercial Use. Commercial Use occurs by virtue of such billing alone, whether or not the resulting payment is registered with the Trust Service; in particular, billing a customer for pre-conversion use of the Software without recording the corresponding payment in the applicable Phase's Target Ledger is Commercial Use without a valid Commercial Entitlement — a violation of Section 3, addressed under Section 7 and, where applicable, the Enforcement Network described in the canonical repository's `specs/EnforcementNetworkConcept.md`.
++
++**"Commercial Use Agreement"** means the separate agreement, referenced by the applicable Phase Manifest, under which a Commercial Entitlement is purchased or granted. This License does not itself set pricing, metering, or payment terms — those are governed by the Commercial Use Agreement.
++
++**"Conversion Event"** means the moment the Outstanding Target for a Phase reaches zero, as computed from the Phase Manifest and Target Ledger per the Target Ledger Specification. The Conversion Event occurs automatically and is not conditioned on any declaration, attestation, or other act by the Licensor or any Trust Service.
++
++**"Development Credit"** means the portion of a collected and settled payment explicitly allocated toward satisfying the Initial Target of a specific Phase, as recorded in that Phase's Target Ledger.
++
++**"Future License"** means the permissive license identified in the applicable Phase Manifest, being either the MIT License or the Apache License, Version 2.0, which applies to the Milestone Release upon the Conversion Event.
++
++**"Initial Target"** means the immutable monetary target declared for a Phase in its Phase Manifest.
++
++**"Licensor"** means **Binky Hedgehog GmbH**, the party that publishes the Phase Manifest and holds the rights necessary to grant this License and the Future License for the Milestone Release.
++
++**"Milestone Release"** means the precisely identified software release designated in the applicable Phase Manifest, identified by an immutable source revision, release artifact, or cryptographic digest.
++
++**"Noncommercial Use"** means use of the Software for personal purposes, private study, hobby or amateur projects; use by any charitable organization, educational institution, public research organization, or government institution acting in a non-revenue-generating capacity; or other use of a materially similar character.
++
++**"Outstanding Target"** means, at any time, `max(0, Initial Target − cumulative Development Credit − cumulative Remission Credit)` for a Phase, as computed from that Phase's Target Ledger.
++
++**"Phase"** means a bounded development undertaking governed by one Initial Target, one Milestone Release, one degeneration policy, and one Future License declaration, as declared in a Phase Manifest.
++
++**"Phase Manifest"** means the published, immutable declaration identifying a Phase, its Milestone Release, Initial Target, Future License, degeneration policy, and Target Ledger location, as specified in the Phase Manifest Specification.
++
++**"Remission Credit"** means a transparent, non-revenue reduction of a Phase's Outstanding Target, generated under that Phase's published degeneration policy and recorded in the Target Ledger.
++
++**"Settled Payment"** means a payment that has cleared through its payment processor and is no longer subject to reversal in the ordinary course (chargeback, dispute, or equivalent), as further specified by the applicable Commercial Use Agreement or monetization extension.
++
++**"Software"** means the source code, object code, and associated documentation of the Milestone Release identified in the applicable Phase Manifest.
++
++**"Target Ledger"** means the append-only record of Development Credit, Remission Credit, and correction entries for a Phase, as specified in the Target Ledger Specification.
++
++**"You"** or **"Licensee"** means the individual or entity exercising rights under this License.
++
++## 2. Grant of Rights for Noncommercial Use
++
++Subject to the terms of this License, the Licensor grants You a worldwide, royalty-free, non-exclusive license, during the applicable Phase, to:
++
++(a) use, reproduce, and study the Software for any Noncommercial Use;
++
++(b) modify the Software and create derivative works of it for any Noncommercial Use; and
++
++(c) redistribute the Software and Your modifications, in source or object form, for any Noncommercial Use, provided that You include this License, unmodified, with any such redistribution, and that You do not remove or alter any copyright, patent, trademark, or attribution notices contained in the Software.
++
++This grant does not extend to Commercial Use. Commercial Use requires a Commercial Entitlement under Section 3.
++
++## 3. Commercial Use
++
++You may not make Commercial Use of the Software during the applicable Phase unless You hold a valid, current Commercial Entitlement under a Commercial Use Agreement with the Licensor covering the applicable Phase. A Commercial Entitlement granted under one Phase's Commercial Use Agreement does not extend to a later Phase's Milestone Release unless the Commercial Use Agreement expressly says so.
++
++This Section 3 states the existence and boundary of the commercial-use restriction. It does not itself set pricing, invoicing, metering, audit rights, or payment terms — those are governed exclusively by the applicable Commercial Use Agreement.
++
++## 4. Patent License
++
++Subject to the terms of this License, each contributor to the Software grants You, during the applicable Phase and solely to the extent of rights granted under Sections 2 and 3, a perpetual (subject to the termination below), worldwide, non-exclusive, no-charge, royalty-free patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Software, limited to those patent claims licensable by that contributor that are necessarily infringed by their contribution(s) alone or by combination of their contribution(s) with the Software.
++
++If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Software or a contribution incorporated within it constitutes direct or contributory patent infringement, then any patent licenses granted to You under this Section 4 for the Software shall terminate as of the date such litigation is filed.
++
++## 5. Automatic Conversion to the Future License
++
++**5.1 Automatic effect.** Upon the Conversion Event for a Phase, the rights and restrictions in Sections 3 (Commercial Use) of this License, as they apply to that Phase's Milestone Release, terminate automatically. In their place, the Milestone Release is licensed under the Future License identified in that Phase's Phase Manifest, effective as of the Conversion Event, without any further act, declaration, or attestation required by the Licensor, any Trust Service, or any other party.
++
++**5.2 Irrevocability.** Once a valid Conversion Event has occurred for a Phase, no subsequent refund, chargeback, accounting correction, dispute, or termination of this License for an unrelated breach shall revoke, suspend, or otherwise impair the Future License grant for that Phase's Milestone Release. Any shortfall or dispute arising after a Conversion Event is a commercial or accounting matter between the relevant parties and does not reinstate a commercial-use restriction over already-converted Software.
++
++**5.3 Prior freedom preserved.** A later Phase covering subsequent improvements to the Software does not restrict, withdraw, or otherwise affect the rights granted under the Future License for an earlier Phase's already-converted Milestone Release.
++
++**5.4 Evidence, not cause.** A Trust Service may publish a Conversion Attestation documenting a Conversion Event. Such an attestation is evidence that the Conversion Event occurred; it is not a condition of, and its absence or delay does not postpone, the automatic effect described in Section 5.1. Any person may independently verify whether a Conversion Event has occurred directly from the Phase Manifest and Target Ledger.
++
++## 6. Successive Phases
++
++The Licensor may declare a new Phase covering subsequent improvements to the Software following a Milestone Release's Conversion Event. Each Phase is independently governed by its own Phase Manifest, Initial Target, degeneration policy, and Target Ledger. Nothing in a later Phase's Phase Manifest may be construed to reduce or withdraw rights already granted under Section 5 for an earlier Phase's Milestone Release.
++
++## 7. Term and Termination
++
++**7.1 Term.** This License applies to the Software for the duration of the applicable Phase, and, for the Milestone Release, indefinitely following that Phase's Conversion Event under the Future License.
++
++**7.2 Termination for breach.** If You breach Section 3 (Commercial Use) or Section 2(c) (redistribution notice requirement), the Licensor may terminate this License as to You. Before such termination becomes effective, the Licensor shall provide You written notice of the breach; if You cure the breach within thirty (30) days of that notice, this License continues in effect. A second breach of the same provision within twelve (12) months may be terminated immediately without a further cure opportunity.
++
++**7.3 Effect of termination.** Termination under this Section 7 affects only Your rights under Sections 2 and 3 for the Phase in which the breach occurred. It does not affect any rights already vested under Section 5 (Automatic Conversion) for a Milestone Release whose Conversion Event has already occurred, per Section 5.2.
++
++**7.4 Public record of breach and resolution.** The Licensor shall cause the Trust Service to publish, as part of the public record for the affected Phase, notice of: (a) any breach notice issued under Section 7.2, stating the general nature of the breach and the date of notice; (b) whether the breach was cured within the applicable cure period, and the date of cure; and (c) any termination determination made under this Section 7, including its effective date and scope. This public record exists to give the ecosystem a transparent, verifiable conformity signal for the Phase, distinct from and in addition to the Development Credit and Remission Credit facts already published under Section 5.4 and the Target Ledger Specification.
++
++A breach that You dispute, and that has not been finally determined, shall be recorded as **alleged**; it shall be recorded as **determined** only once the cure period has run without cure, or the dispute has been resolved against You under the applicable Commercial Use Agreement's dispute process, if any. The Trust Service shall update the record promptly upon resolution in either direction. Recording an alleged or determined breach under this Section 7.4 is a ministerial act of publishing the Licensor's determination (or a dispute process's outcome); it does not give the Trust Service discretionary authority to decide whether a breach occurred, consistent with Section 5.4's evidence-not-cause principle.
++
++Whether, and under what conditions, the public record identifies a Commercial Entitlement holder by name is governed exclusively by the applicable Commercial Use Agreement, which the Licensor and that Commercial Entitlement holder negotiate and agree to directly. This License does not itself set a naming default. Where no Commercial Use Agreement addresses the question, or where the affected party has no Commercial Use Agreement at all (for example, a Section 2(c) breach by a Noncommercial Use licensee), the public record states the Phase and breach category only, without naming the party.
++
++## 8. Disclaimer of Warranty
++
++THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. THE LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE ERROR-FREE OR THAT ANY PHASE WILL REACH ITS CONVERSION EVENT.
++
++## 9. Limitation of Liability
++
++IN NO EVENT SHALL THE LICENSOR OR ANY CONTRIBUTOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE, EXCEPT TO THE EXTENT SUCH LIMITATION IS PROHIBITED BY APPLICABLE LAW.
++
++## 10. Trademarks
++
++This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary attribution.
++
++## 11. General Provisions
++
++**11.1 Governing law and venue.** Adopted for alpha/beta 2026-07-29: disputes arising under this License shall be resolved by binding arbitration, seated at a neutral, arbitration-mature venue (Singapore or London are the two candidates concretely supported by current research), rather than by litigation in a national court. The specific arbitral institution and substantive governing law remain a per-deployment blank pending final selection; they are not fixed by this candidate. See the canonical repository's `history/260729-TRSL-Jurisdiction-Synthesis.md` §2.
++
++**11.2 Severability.** If any provision of this License is held unenforceable, the remaining provisions remain in full force, and the unenforceable provision shall be reformed to the minimum extent necessary to make it enforceable.
++
++**11.3 No waiver.** Failure to enforce any provision of this License is not a waiver of future enforcement of that or any other provision.
++
++**11.4 Entire agreement (as to licensing).** This License, together with the applicable Phase Manifest and, where applicable, the Commercial Use Agreement, constitutes the entire agreement between You and the Licensor regarding the Software's licensing terms. Operations, service, and consulting arrangements are governed by separate agreements, if any, and are not part of this License.
++
++**11.5 Definitions control.** Marketing materials, documentation, or other non-normative communications about the Software must not describe pre-Conversion-Event Software as "Open Source," "free software," or "open core." Pre-conversion Noncommercial Use is **source-available**; pre-conversion Commercial Use requires a **Commercial Entitlement**; only post-conversion Software may be described as Open Source, under the Future License.
++
++---
++
++**No Phase is currently declared for this repository under this License.** Until a Phase Manifest is published and registered with the Trust Service for a Milestone Release in this repository, Sections 2–7 above have no operative subject matter here — this License establishes the governing framework in advance of that declaration, consistent with the org-wide rollout decision recorded in `target-revenue`'s `workplans/TREV-WP-0008-governance-and-pilot-rollout.md`.
+diff --git a/adapters/go/tokenstatus/go.mod b/adapters/go/tokenstatus/go.mod
+--- /dev/null
++++ b/adapters/go/tokenstatus/go.mod
+@@ -0,0 +1,3 @@
++module keycape
++
++go 1.23.0
+diff --git a/adapters/go/tokenstatus/internal/jose/jose.go b/adapters/go/tokenstatus/internal/jose/jose.go
+--- /dev/null
++++ b/adapters/go/tokenstatus/internal/jose/jose.go
+@@ -0,0 +1,171 @@
++// Package jose provides strict RS256 JWT signature verification against a JWK
++// set. It is deliberately narrow: it establishes that a token was signed by a
++// key in the given set and returns its claims. It applies no claim policy —
++// issuer, audience, expiry and nonce rules differ per caller and belong with
++// the caller that knows them.
++//
++// The strictness here is the point. A verifier that accepts an unexpected
++// algorithm, an unbounded exponent or an undersized modulus is worse than no
++// verifier, because callers stop checking what it appears to guarantee.
++package jose
++
++import (
++	"crypto"
++	"crypto/rsa"
++	"crypto/sha256"
++	"encoding/base64"
++	"encoding/json"
++	"errors"
++	"math/big"
++	"strings"
++)
++
++// ErrVerification is returned for every verification failure. The cause is
++// deliberately not distinguished: a caller acting on why a token failed tends to
++// leak that distinction to whoever supplied the token.
++var ErrVerification = errors.New("jose: token verification failed")
++
++// KeySet maps key IDs to RSA public keys.
++type KeySet map[string]*rsa.PublicKey
++
++// ParseJWKS parses a JWK set, keeping only RSA signing keys usable with RS256.
++// Keys that are malformed, too small, or carry an even or trivial exponent are
++// rejected rather than skipped, since a key set that is partly wrong is not
++// evidence of anything.
++func ParseJWKS(raw []byte) (KeySet, error) {
++	var document struct {
++		Keys []struct {
++			Kty string `json:"kty"`
++			Use string `json:"use"`
++			Alg string `json:"alg"`
++			Kid string `json:"kid"`
++			N   string `json:"n"`
++			E   string `json:"e"`
++		} `json:"keys"`
++	}
++	if err := json.Unmarshal(raw, &document); err != nil {
++		return nil, ErrVerification
++	}
++	keys := make(KeySet, len(document.Keys))
++	for _, key := range document.Keys {
++		// Ignore keys for other algorithms or purposes; they are not errors.
++		if key.Kty != "RSA" || (key.Use != "" && key.Use != "sig") || (key.Alg != "" && key.Alg != "RS256") {
++			continue
++		}
++		if key.Kid == "" {
++			return nil, ErrVerification
++		}
++		modulus, errN := decode(key.N)
++		exponent, errE := decode(key.E)
++		if errN != nil || errE != nil || len(exponent) == 0 || len(exponent) > 4 {
++			return nil, ErrVerification
++		}
++		public := &rsa.PublicKey{
++			N: new(big.Int).SetBytes(modulus),
++			E: int(new(big.Int).SetBytes(exponent).Int64()),
++		}
++		if public.N.BitLen() < 2048 || public.E < 3 || public.E%2 == 0 {
++			return nil, ErrVerification
++		}
++		if _, duplicate := keys[key.Kid]; duplicate {
++			return nil, ErrVerification
++		}
++		keys[key.Kid] = public
++	}
++	if len(keys) == 0 {
++		return nil, ErrVerification
++	}
++	return keys, nil
++}
++
++// KeyID returns the key ID from a token's JOSE header, after checking that the
++// header names RS256 and carries no critical extensions. Callers use it to
++// decide whether to refresh their key set before verifying.
++func KeyID(token string) (string, error) {
++	header, _, _, err := split(token)
++	if err != nil {
++		return "", err
++	}
++	return header.Kid, nil
++}
++
++// Verify checks a token's RS256 signature against the key set and returns its
++// claims. It does not inspect any claim.
++func Verify(token string, keys KeySet) (map[string]interface{}, error) {
++	return verify(token, keys, "")
++}
++
++// VerifyTyped applies the same signature verifier with an explicit JOSE type.
++// Existing Verify callers retain their claim/type policy; online access-token
++// consumers opt into the producer's exact JWT header contract here.
++func VerifyTyped(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
++	if expectedType == "" {
++		return nil, ErrVerification
++	}
++	return verify(token, keys, expectedType)
++}
++
++func verify(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
++	header, signingInput, signature, err := split(token)
++	if err != nil {
++		return nil, err
++	}
++	if expectedType != "" && header.Typ != expectedType {
++		return nil, ErrVerification
++	}
++	public, ok := keys[header.Kid]
++	if !ok {
++		return nil, ErrVerification
++	}
++	digest := sha256.Sum256([]byte(signingInput))
++	if rsa.VerifyPKCS1v15(public, crypto.SHA256, digest[:], signature) != nil {
++		return nil, ErrVerification
++	}
++	payload, err := decode(strings.Split(signingInput, ".")[1])
++	if err != nil {
++		return nil, ErrVerification
++	}
++	claims := map[string]interface{}{}
++	if json.Unmarshal(payload, &claims) != nil {
++		return nil, ErrVerification
++	}
++	return claims, nil
++}
++
++type joseHeader struct {
++	Alg  string   `json:"alg"`
++	Typ  string   `json:"typ"`
++	Kid  string   `json:"kid"`
++	Crit []string `json:"crit"`
++}
++
++// split validates the token's shape and header and returns the header, the
++// signing input, and the decoded signature.
++func split(token string) (joseHeader, string, []byte, error) {
++	parts := strings.Split(token, ".")
++	if len(parts) != 3 {
++		return joseHeader{}, "", nil, ErrVerification
++	}
++	raw, err := decode(parts[0])
++	if err != nil {
++		return joseHeader{}, "", nil, ErrVerification
++	}
++	var header joseHeader
++	if json.Unmarshal(raw, &header) != nil {
++		return joseHeader{}, "", nil, ErrVerification
++	}
++	// An unexpected algorithm must fail before any key is selected, so "none"
++	// and symmetric algorithms can never reach the RSA path.
++	if header.Alg != "RS256" || header.Kid == "" || len(header.Crit) != 0 {
++		return joseHeader{}, "", nil, ErrVerification
++	}
++	signature, err := decode(parts[2])
++	if err != nil {
++		return joseHeader{}, "", nil, ErrVerification
++	}
++	return header, parts[0] + "." + parts[1], signature, nil
++}
++
++func decode(segment string) ([]byte, error) {
++	return base64.RawURLEncoding.DecodeString(segment)
++}
+diff --git a/adapters/go/tokenstatus/pkg/tokenstatus/client.go b/adapters/go/tokenstatus/pkg/tokenstatus/client.go
+--- /dev/null
++++ b/adapters/go/tokenstatus/pkg/tokenstatus/client.go
+@@ -0,0 +1,379 @@
++package tokenstatus
++
++import (
++	"bytes"
++	"context"
++	"crypto/sha256"
++	"crypto/tls"
++	"crypto/x509"
++	"encoding/base64"
++	"encoding/hex"
++	"encoding/json"
++	"errors"
++	"io"
++	"math"
++	"mime"
++	"net"
++	"net/http"
++	"net/url"
++	"os"
++	"path"
++	"path/filepath"
++	"strings"
++	"syscall"
++	"time"
++
++	"keycape/internal/jose"
++)
++
++var ErrOnlineToken = errors.New("current authenticated token refused")
++
++// OnlineAdmission is independently admitted owner configuration. The public
++// JWKS/CA and private client credential files are reread for every request.
++// It selects the owning confidential client, not a resource-server delegation.
++type OnlineAdmission struct {
++	Issuer      string `json:"issuer"`
++	Audience    string `json:"audience"`
++	ClientID    string `json:"client_id"`
++	CAFile      string `json:"ca_file"`
++	JWKSFile    string `json:"jwks_file"`
++	SecretFile  string `json:"secret_file"`
++	MaxTokenAge string `json:"max_token_age"`
++}
++
++type ExpectedIdentity struct {
++	Subject       string
++	Tenant        string
++	PrincipalType string
++}
++
++// CurrentToken contains signed identity facts joined to a current issuer
++// observation. It is never a permission, approval or portable execution receipt.
++type CurrentToken struct {
++	Issuer        string    `json:"issuer"`
++	Audience      string    `json:"audience"`
++	ClientID      string    `json:"client_id"`
++	Subject       string    `json:"subject"`
++	Tenant        string    `json:"tenant"`
++	PrincipalType string    `json:"principal_type"`
++	TokenID       string    `json:"jti"`
++	TokenDigest   string    `json:"token_sha256"`
++	IssuedAt      time.Time `json:"issued_at"`
++	NotAfter      time.Time `json:"not_after"`
++	CheckedAt     time.Time `json:"checked_at"`
++	claims        map[string]interface{}
++}
++
++// Claims returns a separate copy of the verified signed facts. Authentication
++// assurance/age, tenant provenance, current groups and resource/effect policy
++// remain the consumer's existing profile obligations, not a new client policy.
++func (t CurrentToken) Claims() map[string]interface{} {
++	if t.claims == nil {
++		return nil
++	}
++	raw, _ := json.Marshal(t.claims)
++	var out map[string]interface{}
++	_ = json.Unmarshal(raw, &out)
++	return out
++}
++
++// InactiveForClient proves only the issuer's current negative response for the
++// named client/token digest. An unknown/other-client token gives the same result;
++// original grant ownership is separately required before asserting cleanup.
++type InactiveForClient struct {
++	Issuer      string    `json:"issuer"`
++	ClientID    string    `json:"client_id"`
++	TokenDigest string    `json:"token_sha256"`
++	CheckedAt   time.Time `json:"checked_at"`
++}
++
++type OnlineClient struct {
++	admission OnlineAdmission
++	age       time.Duration
++	now       func() time.Time
++	// Nil uses the normal resolver/dialer. Tests route a certified DNS name to
++	// isolated loopback; the TLS name/CA and JWT trust checks remain unchanged.
++	dialContext func(context.Context, string, string) (net.Conn, error)
++}
++
++func NewOnlineClient(a OnlineAdmission) (*OnlineClient, error) {
++	u, err := url.Parse(a.Issuer)
++	if err != nil || u.Scheme != "https" || u.Hostname() == "" || u.User != nil || strings.ContainsAny(a.Issuer, "?#") || u.RawPath != "" || (u.Path != "" && path.Clean(u.Path) != u.Path) || strings.HasSuffix(a.Issuer, "/") {
++		return nil, ErrOnlineToken
++	}
++	if a.Audience == "" || a.ClientID == "" || !filepath.IsAbs(a.CAFile) || !filepath.IsAbs(a.JWKSFile) || !filepath.IsAbs(a.SecretFile) {
++		return nil, ErrOnlineToken
++	}
++	age, err := time.ParseDuration(a.MaxTokenAge)
++	if err != nil || age <= 0 || age > time.Hour {
++		return nil, ErrOnlineToken
++	}
++	return &OnlineClient{admission: a, age: age, now: time.Now}, nil
++}
++
++func readOnlineFile(path string, private bool) ([]byte, error) {
++	limit := int64(1 << 20)
++	if private {
++		limit = 16384
++	}
++	return readOnlineBoundedFile(path, private, limit)
++}
++
++func readOnlineBoundedFile(path string, private bool, limit int64) ([]byte, error) {
++	if limit <= 0 || limit > 1<<20 {
++		return nil, ErrOnlineToken
++	}
++	if !filepath.IsAbs(path) {
++		return nil, ErrOnlineToken
++	}
++	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NONBLOCK, 0)
++	if err != nil {
++		return nil, ErrOnlineToken
++	}
++	defer f.Close()
++	info, err := f.Stat()
++	if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0022 != 0 || (private && info.Mode().Perm()&0007 != 0) {
++		return nil, ErrOnlineToken
++	}
++	raw, err := io.ReadAll(io.LimitReader(f, limit+1))
++	if err != nil || len(raw) > int(limit) || len(raw) == 0 {
++		return nil, ErrOnlineToken
++	}
++	return raw, nil
++}
++
++func tokenDigest(raw string) string {
++	digest := sha256.Sum256([]byte(raw))
++	return "sha256:" + hex.EncodeToString(digest[:])
++}
++
++func exactUnix(value interface{}) (time.Time, bool) {
++	n, ok := value.(float64)
++	if !ok || n <= 0 || n > 9007199254740991 || math.Trunc(n) != n {
++		return time.Time{}, false
++	}
++	return time.Unix(int64(n), 0).UTC(), true
++}
++
++func (c *OnlineClient) verify(raw string, expected ExpectedIdentity, now time.Time) (CurrentToken, error) {
++	var out CurrentToken
++	if c == nil || len(raw) == 0 || len(raw) > 32768 || expected.Subject == "" || expected.Tenant == "" || (expected.PrincipalType != "human" && expected.PrincipalType != "service") {
++		return out, ErrOnlineToken
++	}
++	keysRaw, err := readOnlineFile(c.admission.JWKSFile, false)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	keys, err := jose.ParseJWKS(keysRaw)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	claims, err := jose.VerifyTyped(raw, keys, "JWT")
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	if claims["iss"] != c.admission.Issuer || claims["aud"] != c.admission.Audience || claims["sub"] != expected.Subject || claims["tenant"] != expected.Tenant || claims["principal_type"] != expected.PrincipalType {
++		return out, ErrOnlineToken
++	}
++	if azp, present := claims["azp"]; present && azp != c.admission.ClientID {
++		return out, ErrOnlineToken
++	}
++	_, scopeOK := claims["scope"].(string)
++	jti, jtiOK := claims["jti"].(string)
++	decodedID, idErr := base64.RawURLEncoding.Strict().DecodeString(jti)
++	issued, issuedOK := exactUnix(claims["iat"])
++	expires, expiresOK := exactUnix(claims["exp"])
++	if !scopeOK || !jtiOK || idErr != nil || len(decodedID) != 32 || !issuedOK || !expiresOK || issued.After(now) || !expires.After(issued) || !now.Before(expires) {
++		return out, ErrOnlineToken
++	}
++	if nbf, present := claims["nbf"]; present {
++		start, valid := exactUnix(nbf)
++		if !valid || start.After(now) {
++			return out, ErrOnlineToken
++		}
++	}
++	end := issued.Add(c.age)
++	if expires.Before(end) {
++		end = expires
++	}
++	if !now.Before(end) {
++		return out, ErrOnlineToken
++	}
++	return CurrentToken{Issuer: c.admission.Issuer, Audience: c.admission.Audience, ClientID: c.admission.ClientID,
++		Subject: expected.Subject, Tenant: expected.Tenant, PrincipalType: expected.PrincipalType,
++		TokenID: jti, TokenDigest: tokenDigest(raw), IssuedAt: issued, NotAfter: end, CheckedAt: now, claims: claims}, nil
++}
++
++type statusWire struct {
++	Active    *bool  `json:"active"`
++	ClientID  string `json:"client_id"`
++	TokenType string `json:"token_type"`
++	Issuer    string `json:"iss"`
++	Subject   string `json:"sub"`
++	Audience  string `json:"aud"`
++	Scope     string `json:"scope"`
++	IssuedAt  int64  `json:"iat"`
++	ExpiresAt int64  `json:"exp"`
++	TokenID   string `json:"jti"`
++}
++
++func decodeOnlineObject(raw []byte, out interface{}) (map[string]bool, error) {
++	d := json.NewDecoder(bytes.NewReader(raw))
++	first, err := d.Token()
++	if err != nil || first != json.Delim('{') {
++		return nil, ErrOnlineToken
++	}
++	seen := map[string]bool{}
++	for d.More() {
++		key, err := d.Token()
++		name, ok := key.(string)
++		if err != nil || !ok || seen[name] {
++			return nil, ErrOnlineToken
++		}
++		seen[name] = true
++		var value json.RawMessage
++		if d.Decode(&value) != nil || bytes.Equal(bytes.TrimSpace(value), []byte("null")) {
++			return nil, ErrOnlineToken
++		}
++	}
++	if last, err := d.Token(); err != nil || last != json.Delim('}') {
++		return nil, ErrOnlineToken
++	}
++	if _, err := d.Token(); err != io.EOF {
++		return nil, ErrOnlineToken
++	}
++	d = json.NewDecoder(bytes.NewReader(raw))
++	d.DisallowUnknownFields()
++	if d.Decode(out) != nil {
++		return nil, ErrOnlineToken
++	}
++	return seen, nil
++}
++
++func decodeOnlineStatus(raw []byte) (statusWire, error) {
++	var out statusWire
++	seen, err := decodeOnlineObject(raw, &out)
++	if err != nil || out.Active == nil || (!*out.Active && len(seen) != 1) {
++		return out, ErrOnlineToken
++	}
++	if *out.Active {
++		if len(seen) != 10 {
++			return out, ErrOnlineToken
++		}
++		for _, field := range []string{"active", "client_id", "token_type", "iss", "sub", "aud", "scope", "iat", "exp", "jti"} {
++			if !seen[field] {
++				return out, ErrOnlineToken
++			}
++		}
++	}
++	return out, nil
++}
++
++func (c *OnlineClient) request(ctx context.Context, endpoint, raw string) (statusWire, error) {
++	var out statusWire
++	if c == nil || ctx == nil || ctx.Err() != nil || len(raw) == 0 || len(raw) > 32768 || (endpoint != "/introspect" && endpoint != "/revoke") {
++		return out, ErrOnlineToken
++	}
++	ca, err := readOnlineFile(c.admission.CAFile, false)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	roots := x509.NewCertPool()
++	if !roots.AppendCertsFromPEM(ca) {
++		return out, ErrOnlineToken
++	}
++	secretRaw, err := readOnlineFile(c.admission.SecretFile, true)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	secret := strings.TrimSuffix(strings.TrimSuffix(string(secretRaw), "\n"), "\r")
++	if secret == "" || strings.ContainsAny(secret, "\r\n\x00") {
++		return out, ErrOnlineToken
++	}
++	form := url.Values{"token": {raw}, "token_type_hint": {"access_token"}}
++	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.admission.Issuer+endpoint, strings.NewReader(form.Encode()))
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
++	req.Header.Set("Cache-Control", "no-cache")
++	req.SetBasicAuth(url.QueryEscape(c.admission.ClientID), url.QueryEscape(secret))
++	transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext}
++	defer transport.CloseIdleConnections()
++	client := &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }}
++	response, err := client.Do(req)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	defer response.Body.Close()
++	if response.StatusCode != http.StatusOK || response.Header.Get("Cache-Control") != "no-store" {
++		return out, ErrOnlineToken
++	}
++	body, err := io.ReadAll(io.LimitReader(response.Body, 65537))
++	if err != nil || len(body) > 65536 {
++		return out, ErrOnlineToken
++	}
++	if endpoint == "/revoke" {
++		if len(body) != 0 {
++			return out, ErrOnlineToken
++		}
++		return out, nil
++	}
++	media, _, err := mime.ParseMediaType(response.Header.Get("Content-Type"))
++	if err != nil || media != "application/json" {
++		return out, ErrOnlineToken
++	}
++	return decodeOnlineStatus(body)
++}
++
++// Check verifies expected identity before accessing the private client credential,
++// sends a new authenticated introspection and rechecks lifetime after the network.
++func (c *OnlineClient) Check(ctx context.Context, raw string, expected ExpectedIdentity) (CurrentToken, error) {
++	if c == nil || ctx == nil || ctx.Err() != nil {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	identity, err := c.verify(raw, expected, c.now().UTC())
++	if err != nil {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	status, err := c.request(ctx, "/introspect", raw)
++	if err != nil || status.Active == nil || !*status.Active {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	expires, _ := exactUnix(identity.claims["exp"])
++	if status.ClientID != c.admission.ClientID || status.TokenType != "Bearer" || status.Issuer != identity.Issuer || status.Subject != identity.Subject || status.Audience != identity.Audience || status.TokenID != identity.TokenID || status.Scope != identity.claims["scope"] || status.IssuedAt != identity.IssuedAt.Unix() || status.ExpiresAt != expires.Unix() {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	end := c.now().UTC()
++	if end.Before(identity.CheckedAt) {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	// A slow lookup cannot retain expired facts or a withdrawn JWT trust key.
++	return c.verify(raw, expected, end)
++}
++
++// Revoke performs cleanup only for the exact opaque token. An empty 200 is not
++// proof: a separate authenticated introspection must confirm inactive-for-client.
++// The caller retains original grant ownership and uncertainty/retry duties.
++func (c *OnlineClient) Revoke(ctx context.Context, raw string) (InactiveForClient, error) {
++	if c == nil {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	if _, err := c.request(ctx, "/revoke", raw); err != nil {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	return c.ObserveInactive(ctx, raw)
++}
++
++// ObserveInactive is read-only. Unavailability or a malformed response is never
++// interpreted as revocation; the negative result remains scoped to this client.
++func (c *OnlineClient) ObserveInactive(ctx context.Context, raw string) (InactiveForClient, error) {
++	if c == nil {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	status, err := c.request(ctx, "/introspect", raw)
++	if err != nil || status.Active == nil || *status.Active {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	return InactiveForClient{Issuer: c.admission.Issuer, ClientID: c.admission.ClientID, TokenDigest: tokenDigest(raw), CheckedAt: c.now().UTC()}, nil
++}
+diff --git a/adapters/go/tokenstatus/producer-source.json b/adapters/go/tokenstatus/producer-source.json
+--- /dev/null
++++ b/adapters/go/tokenstatus/producer-source.json
+@@ -0,0 +1,18 @@
++{
++  "source_of_truth": "key-cape source; generated by tools/export_tokenstatus_client.py",
++  "source_files": [
++    "src/internal/authclient/online.go",
++    "src/internal/jose/jose.go",
++    "LICENSE"
++  ],
++  "transformation": "replace only the first package declaration authclient with tokenstatus; all remaining client bytes and shared JOSE bytes exact",
++  "module": "keycape",
++  "profile": "issuer online access-token status; no policy evaluator or deployment",
++  "supported_file_boundary": "Linux owner execution profile; POSIX mode checks; not a Windows ACL contract",
++  "sha256": {
++    "LICENSE": "sha256:ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
++    "go.mod": "sha256:e8b028e1002e63a76dba78a4abbd67882307ad198e4783bad631652061aa0f54",
++    "internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
++    "pkg/tokenstatus/client.go": "sha256:f34626a85d67590b9c61474f19ce1021f8afd17093f8f522b3f98e9cef34e575"
++  }
++}
+diff --git a/docs/current-token-client.md b/docs/current-token-client.md
+--- /dev/null
++++ b/docs/current-token-client.md
+@@ -0,0 +1,130 @@
++# Shared current-token client and private CLI observations
++
++Source preparation under proposed KEY-WP-0042 and the existing CUST-WP-0080 /
++NK48 / Apps operation and application obligations. This is a client of the
++issuer's optional online profile, not another issuer, PDP, approval service or
++application-local token registry. Native issuer/profile/consumer admission is
++still required. Actual operation/effect permission remains with existing owners.
++
++## One producer, two consumption surfaces
++
++`src/internal/authclient/online.go` is the single implementation. The existing
++KeyCape executable exposes it as `check-current-token`, `revoke-token` and
++`check-inactive-token` for owner processes. Go consumers use the generated
++`adapters/go/tokenstatus` module and import `keycape/pkg/tokenstatus` through an
++exact pinned source/dependency lock. `make tokenstatus-export` generates that
++five-file module; `make tokenstatus-check`, ordinary `make test` and the root Go
++suite refuse drift. The sole client transformation is its first package
++declaration; all remaining bytes and the shared JOSE primitive are exact.
++No policy evaluator, signing key, credential, daemon or deployment is exported.
++
++The client uses the existing producer `internal/jose` verifier. Its additive
++`VerifyTyped` path requires the actual RS256 / JWT producer header; legacy
++`Verify` callers retain their existing type policy. Keys are independently
++admitted public JWKS, never fetched from the status response or discovered by
++the token. The minimal generated module uses Go 1.23 and standard libraries.
++Its file boundary is the current **Linux owner profile**: POSIX mode checks do
++not establish Windows ACL behavior or a broader platform admission.
++
++## Current status is an authenticated fact
++
++`OnlineClient.Check(ctx, token, ExpectedIdentity{...})` validates the signature,
++issuer, exact single resource audience, subject, tenant, human/service type,
++optional authorized-party binding, access-token purpose, unique jti and integer
++issued/expiry/not-before bounds before reading the private caller credential.
++It bounds identity by expiry and an independently admitted token age (at most
++one hour), then performs a new authenticated introspection. It joins every
++returned identity/client/audience/jti/scope/time field to those signed facts.
++After network I/O it checks time again and reloads JWT trust so a delayed answer
++cannot retain expired facts or a withdrawn signing key. No positive is cached.
++
++The explicit HTTPS issuer origin supplies the exact `/introspect` and `/revoke`
++paths; redirects, query/fragment/ambiguous issuer paths, environment proxies and
++ambient transports are not used. CA, JWKS and private caller credential files
++are reread for each operation with regular-file/mode/size guards. File opens do
++not block on FIFO replacement. Private credentials can be atomically rotated
++without retaining a cached value. Requests have a five-second bound and responses
++a 64 KiB bound. Duplicate/null/missing/extra fields, mismatched facts, non-JSON or
++cacheable status responses and unavailable/unauthenticated transport refuse with
++one fixed error. Secret, token and response values are never part of errors.
++
++`CurrentToken.Claims()` returns a separate copy of verified signed facts. Those
++facts remain snapshots: original authentication time is not the current lookup
++time. Minimum assurance/authentication age, tenant provenance, current groups,
++resource/action policy, exact approval and effect authority remain the existing
++consumer profile's obligations. A fresh status response is not a new MFA act or
++permission. A Forgejo sign-in token does not grant release-write or inverse
++authority, and no operator client/route is selected by this source package.
++
++## Negative scope and cleanup
++
++`ObserveInactive` performs an independent **read-only** status lookup. It never
++infers inactivity from transport failure, malformed output or an unsuccessful
++positive check. `Revoke` sends the exact token, requires an empty successful
++response and then obtains that separate negative readback. Both return only
++`InactiveForClient`: the exact digest is currently inactive for the configured
++client. Unknown and other-client tokens have the same negative response.
++
++That result alone cannot prove original grant ownership, global revocation or a
++completed operation's cleanup. The owner retains its independently authenticated
++original issuance/current-positive evidence, exact token digest/jti and operation
++correspondence before mapping a negative observation to a parent-session receipt.
++Cleanup can continue after business-token freshness/key withdrawal; it creates
++no business authority. Unavailable/ambiguous cleanup remains unverified and
++requires the existing durable owner retry/recovery path. It is not success.
++
++## Existing CLI
++
++The public admission file contains only references and independently admitted
++bindings; for example (paths/client are placeholders, not operational defaults):
++
++```json
++{
++  "issuer": "https://owner-admitted-issuer.example",
++  "audience": "owner-admitted-resource",
++  "client_id": "owner-admitted-confidential-client",
++  "ca_file": "/run/owner-identity/issuer-ca.pem",
++  "jwks_file": "/run/owner-identity/admitted-jwks.json",
++  "secret_file": "/run/owner-identity/current-client-credential",
++  "max_token_age": "5m"
++}
++```
++
++Use an existing owner-acquired private KeyCape token JSON file, and the access
++token's exact `sha256:` digest from the owner-bound session/transaction record.
++No token or client credential goes in argv. Follow the existing Warden routing /
++owner-native acquisition and custody path; this source adds no credential lane.
++
++```text
++keycape check-current-token --admission-file /ABS/profile.json --token-file /ABS/private-token.json --token-sha256 sha256:OWNER_BOUND_DIGEST --subject OWNER_EXPECTED_SUBJECT --tenant OWNER_EXPECTED_TENANT --principal-type human --out /ABS/PRIVATE-DIR/new-observation.json
++keycape revoke-token --admission-file /ABS/profile.json --token-file /ABS/private-token.json --token-sha256 sha256:OWNER_BOUND_DIGEST --out /ABS/PRIVATE-DIR/new-cleanup-observation.json
++keycape check-inactive-token --admission-file /ABS/profile.json --token-file /ABS/private-token.json --token-sha256 sha256:OWNER_BOUND_DIGEST --out /ABS/PRIVATE-DIR/new-independent-negative.json
++```
++
++The placeholders deliberately do not form an operational command. Current checks
++require explicit expected subject/tenant/type. Negative/cleanup commands refuse
++those business-identity flags because they report only the bounded client status.
++Duplicate flags and duplicate/unknown/null input fields refuse. The token file
++must be private, the digest must match the exact parsed access token, and the new
++observation must have a 0700 parent outside Git. Outputs are exclusive 0600 files;
++failures remove only their own inode and cannot delete another attempt's replaced
++file. Standard output/errors expose fixed status, not claims or credential values.
++
++`keycape.current-token-observation.v1` is a **private, unsigned producer command
++result**, not a portable execution receipt. Current output includes bounded
++identity/token references and signed assurance/tenant-provenance facts; it omits
++bearers, credentials and group/role snapshots. Negative output states its client
++scope. The invoking owner authenticates exact binary/config/custody and binds its
++own case, acceptance, descriptor, source/target, principal, transaction and effect.
++Local file presence, digests or a successful command do not supply those grants.
++
++## Scope of verification
++
++Source checks use actual token/status handlers over isolated HTTPS, actual human
++PKCE claim construction and the same CLI implementation. The separate cross-owner
++fixture runs a built executable, generated public Go consumer and actual Warden
++Executor/SQLite in distinct Python processes. Synthetic case/catalog/owner
++attestations and a disposable file target do not establish Forgejo/browser
++acceptance, real-factor possession, production custody or approved native effects.
++The online issuer profile, owner mappings and source/package/type admission remain
++under review; all corresponding native gates stay open.
+diff --git a/docs/online-token-status.md b/docs/online-token-status.md
+--- a/docs/online-token-status.md
++++ b/docs/online-token-status.md
+@@ -109,6 +109,11 @@
+ renewed authentication cannot revive a consumed approval or replay a mutation.
+ This issuer capability alone implements none of those consumer bindings.
+ 
++The producer-owned [current-token client](current-token-client.md) supplies the
++shared Go/CLI transport and cryptographic/status join. Its private observations
++retain this distinction: an inactive-for-client result is not an original
++ownership or execution receipt. Native client/profile adoption remains open.
++
+ Native completion still requires independent issuer/profile review, exact
+ image/config/trust admission, bounded retained-token custody, real human/service
+ issuance, private transport, current-token/revocation integration in each owner,
+diff --git a/src/cmd/keycape/main.go b/src/cmd/keycape/main.go
+--- a/src/cmd/keycape/main.go
++++ b/src/cmd/keycape/main.go
+@@ -49,7 +49,7 @@
+ 		return
+ 	}
+ 
+-	if len(os.Args) > 1 && (os.Args[1] == "login" || os.Args[1] == "service-token" || os.Args[1] == "verify-client") {
++	if len(os.Args) > 1 && (os.Args[1] == "login" || os.Args[1] == "service-token" || os.Args[1] == "verify-client" || os.Args[1] == "check-current-token" || os.Args[1] == "revoke-token" || os.Args[1] == "check-inactive-token") {
+ 		if err := authclient.Run(context.Background(), os.Args[1:], os.Stderr); err != nil {
+ 			fmt.Fprintln(os.Stderr, err)
+ 			os.Exit(1)
+diff --git a/src/internal/authclient/cli.go b/src/internal/authclient/cli.go
+--- a/src/internal/authclient/cli.go
++++ b/src/internal/authclient/cli.go
+@@ -25,6 +25,9 @@
+ 		return errors.New("expected login, service-token or verify-client")
+ 	}
+ 	mode := args[0]
++	if mode == "check-current-token" || mode == "revoke-token" || mode == "check-inactive-token" {
++		return runOnline(ctx, mode, args[1:], stderr)
++	}
+ 	if mode == "verify-client" {
+ 		return verifyClient(ctx, args[1:], stderr)
+ 	}
+diff --git a/src/internal/authclient/online.go b/src/internal/authclient/online.go
+--- /dev/null
++++ b/src/internal/authclient/online.go
+@@ -0,0 +1,379 @@
++package authclient
++
++import (
++	"bytes"
++	"context"
++	"crypto/sha256"
++	"crypto/tls"
++	"crypto/x509"
++	"encoding/base64"
++	"encoding/hex"
++	"encoding/json"
++	"errors"
++	"io"
++	"math"
++	"mime"
++	"net"
++	"net/http"
++	"net/url"
++	"os"
++	"path"
++	"path/filepath"
++	"strings"
++	"syscall"
++	"time"
++
++	"keycape/internal/jose"
++)
++
++var ErrOnlineToken = errors.New("current authenticated token refused")
++
++// OnlineAdmission is independently admitted owner configuration. The public
++// JWKS/CA and private client credential files are reread for every request.
++// It selects the owning confidential client, not a resource-server delegation.
++type OnlineAdmission struct {
++	Issuer      string `json:"issuer"`
++	Audience    string `json:"audience"`
++	ClientID    string `json:"client_id"`
++	CAFile      string `json:"ca_file"`
++	JWKSFile    string `json:"jwks_file"`
++	SecretFile  string `json:"secret_file"`
++	MaxTokenAge string `json:"max_token_age"`
++}
++
++type ExpectedIdentity struct {
++	Subject       string
++	Tenant        string
++	PrincipalType string
++}
++
++// CurrentToken contains signed identity facts joined to a current issuer
++// observation. It is never a permission, approval or portable execution receipt.
++type CurrentToken struct {
++	Issuer        string    `json:"issuer"`
++	Audience      string    `json:"audience"`
++	ClientID      string    `json:"client_id"`
++	Subject       string    `json:"subject"`
++	Tenant        string    `json:"tenant"`
++	PrincipalType string    `json:"principal_type"`
++	TokenID       string    `json:"jti"`
++	TokenDigest   string    `json:"token_sha256"`
++	IssuedAt      time.Time `json:"issued_at"`
++	NotAfter      time.Time `json:"not_after"`
++	CheckedAt     time.Time `json:"checked_at"`
++	claims        map[string]interface{}
++}
++
++// Claims returns a separate copy of the verified signed facts. Authentication
++// assurance/age, tenant provenance, current groups and resource/effect policy
++// remain the consumer's existing profile obligations, not a new client policy.
++func (t CurrentToken) Claims() map[string]interface{} {
++	if t.claims == nil {
++		return nil
++	}
++	raw, _ := json.Marshal(t.claims)
++	var out map[string]interface{}
++	_ = json.Unmarshal(raw, &out)
++	return out
++}
++
++// InactiveForClient proves only the issuer's current negative response for the
++// named client/token digest. An unknown/other-client token gives the same result;
++// original grant ownership is separately required before asserting cleanup.
++type InactiveForClient struct {
++	Issuer      string    `json:"issuer"`
++	ClientID    string    `json:"client_id"`
++	TokenDigest string    `json:"token_sha256"`
++	CheckedAt   time.Time `json:"checked_at"`
++}
++
++type OnlineClient struct {
++	admission OnlineAdmission
++	age       time.Duration
++	now       func() time.Time
++	// Nil uses the normal resolver/dialer. Tests route a certified DNS name to
++	// isolated loopback; the TLS name/CA and JWT trust checks remain unchanged.
++	dialContext func(context.Context, string, string) (net.Conn, error)
++}
++
++func NewOnlineClient(a OnlineAdmission) (*OnlineClient, error) {
++	u, err := url.Parse(a.Issuer)
++	if err != nil || u.Scheme != "https" || u.Hostname() == "" || u.User != nil || strings.ContainsAny(a.Issuer, "?#") || u.RawPath != "" || (u.Path != "" && path.Clean(u.Path) != u.Path) || strings.HasSuffix(a.Issuer, "/") {
++		return nil, ErrOnlineToken
++	}
++	if a.Audience == "" || a.ClientID == "" || !filepath.IsAbs(a.CAFile) || !filepath.IsAbs(a.JWKSFile) || !filepath.IsAbs(a.SecretFile) {
++		return nil, ErrOnlineToken
++	}
++	age, err := time.ParseDuration(a.MaxTokenAge)
++	if err != nil || age <= 0 || age > time.Hour {
++		return nil, ErrOnlineToken
++	}
++	return &OnlineClient{admission: a, age: age, now: time.Now}, nil
++}
++
++func readOnlineFile(path string, private bool) ([]byte, error) {
++	limit := int64(1 << 20)
++	if private {
++		limit = 16384
++	}
++	return readOnlineBoundedFile(path, private, limit)
++}
++
++func readOnlineBoundedFile(path string, private bool, limit int64) ([]byte, error) {
++	if limit <= 0 || limit > 1<<20 {
++		return nil, ErrOnlineToken
++	}
++	if !filepath.IsAbs(path) {
++		return nil, ErrOnlineToken
++	}
++	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NONBLOCK, 0)
++	if err != nil {
++		return nil, ErrOnlineToken
++	}
++	defer f.Close()
++	info, err := f.Stat()
++	if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0022 != 0 || (private && info.Mode().Perm()&0007 != 0) {
++		return nil, ErrOnlineToken
++	}
++	raw, err := io.ReadAll(io.LimitReader(f, limit+1))
++	if err != nil || len(raw) > int(limit) || len(raw) == 0 {
++		return nil, ErrOnlineToken
++	}
++	return raw, nil
++}
++
++func tokenDigest(raw string) string {
++	digest := sha256.Sum256([]byte(raw))
++	return "sha256:" + hex.EncodeToString(digest[:])
++}
++
++func exactUnix(value interface{}) (time.Time, bool) {
++	n, ok := value.(float64)
++	if !ok || n <= 0 || n > 9007199254740991 || math.Trunc(n) != n {
++		return time.Time{}, false
++	}
++	return time.Unix(int64(n), 0).UTC(), true
++}
++
++func (c *OnlineClient) verify(raw string, expected ExpectedIdentity, now time.Time) (CurrentToken, error) {
++	var out CurrentToken
++	if c == nil || len(raw) == 0 || len(raw) > 32768 || expected.Subject == "" || expected.Tenant == "" || (expected.PrincipalType != "human" && expected.PrincipalType != "service") {
++		return out, ErrOnlineToken
++	}
++	keysRaw, err := readOnlineFile(c.admission.JWKSFile, false)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	keys, err := jose.ParseJWKS(keysRaw)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	claims, err := jose.VerifyTyped(raw, keys, "JWT")
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	if claims["iss"] != c.admission.Issuer || claims["aud"] != c.admission.Audience || claims["sub"] != expected.Subject || claims["tenant"] != expected.Tenant || claims["principal_type"] != expected.PrincipalType {
++		return out, ErrOnlineToken
++	}
++	if azp, present := claims["azp"]; present && azp != c.admission.ClientID {
++		return out, ErrOnlineToken
++	}
++	_, scopeOK := claims["scope"].(string)
++	jti, jtiOK := claims["jti"].(string)
++	decodedID, idErr := base64.RawURLEncoding.Strict().DecodeString(jti)
++	issued, issuedOK := exactUnix(claims["iat"])
++	expires, expiresOK := exactUnix(claims["exp"])
++	if !scopeOK || !jtiOK || idErr != nil || len(decodedID) != 32 || !issuedOK || !expiresOK || issued.After(now) || !expires.After(issued) || !now.Before(expires) {
++		return out, ErrOnlineToken
++	}
++	if nbf, present := claims["nbf"]; present {
++		start, valid := exactUnix(nbf)
++		if !valid || start.After(now) {
++			return out, ErrOnlineToken
++		}
++	}
++	end := issued.Add(c.age)
++	if expires.Before(end) {
++		end = expires
++	}
++	if !now.Before(end) {
++		return out, ErrOnlineToken
++	}
++	return CurrentToken{Issuer: c.admission.Issuer, Audience: c.admission.Audience, ClientID: c.admission.ClientID,
++		Subject: expected.Subject, Tenant: expected.Tenant, PrincipalType: expected.PrincipalType,
++		TokenID: jti, TokenDigest: tokenDigest(raw), IssuedAt: issued, NotAfter: end, CheckedAt: now, claims: claims}, nil
++}
++
++type statusWire struct {
++	Active    *bool  `json:"active"`
++	ClientID  string `json:"client_id"`
++	TokenType string `json:"token_type"`
++	Issuer    string `json:"iss"`
++	Subject   string `json:"sub"`
++	Audience  string `json:"aud"`
++	Scope     string `json:"scope"`
++	IssuedAt  int64  `json:"iat"`
++	ExpiresAt int64  `json:"exp"`
++	TokenID   string `json:"jti"`
++}
++
++func decodeOnlineObject(raw []byte, out interface{}) (map[string]bool, error) {
++	d := json.NewDecoder(bytes.NewReader(raw))
++	first, err := d.Token()
++	if err != nil || first != json.Delim('{') {
++		return nil, ErrOnlineToken
++	}
++	seen := map[string]bool{}
++	for d.More() {
++		key, err := d.Token()
++		name, ok := key.(string)
++		if err != nil || !ok || seen[name] {
++			return nil, ErrOnlineToken
++		}
++		seen[name] = true
++		var value json.RawMessage
++		if d.Decode(&value) != nil || bytes.Equal(bytes.TrimSpace(value), []byte("null")) {
++			return nil, ErrOnlineToken
++		}
++	}
++	if last, err := d.Token(); err != nil || last != json.Delim('}') {
++		return nil, ErrOnlineToken
++	}
++	if _, err := d.Token(); err != io.EOF {
++		return nil, ErrOnlineToken
++	}
++	d = json.NewDecoder(bytes.NewReader(raw))
++	d.DisallowUnknownFields()
++	if d.Decode(out) != nil {
++		return nil, ErrOnlineToken
++	}
++	return seen, nil
++}
++
++func decodeOnlineStatus(raw []byte) (statusWire, error) {
++	var out statusWire
++	seen, err := decodeOnlineObject(raw, &out)
++	if err != nil || out.Active == nil || (!*out.Active && len(seen) != 1) {
++		return out, ErrOnlineToken
++	}
++	if *out.Active {
++		if len(seen) != 10 {
++			return out, ErrOnlineToken
++		}
++		for _, field := range []string{"active", "client_id", "token_type", "iss", "sub", "aud", "scope", "iat", "exp", "jti"} {
++			if !seen[field] {
++				return out, ErrOnlineToken
++			}
++		}
++	}
++	return out, nil
++}
++
++func (c *OnlineClient) request(ctx context.Context, endpoint, raw string) (statusWire, error) {
++	var out statusWire
++	if c == nil || ctx == nil || ctx.Err() != nil || len(raw) == 0 || len(raw) > 32768 || (endpoint != "/introspect" && endpoint != "/revoke") {
++		return out, ErrOnlineToken
++	}
++	ca, err := readOnlineFile(c.admission.CAFile, false)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	roots := x509.NewCertPool()
++	if !roots.AppendCertsFromPEM(ca) {
++		return out, ErrOnlineToken
++	}
++	secretRaw, err := readOnlineFile(c.admission.SecretFile, true)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	secret := strings.TrimSuffix(strings.TrimSuffix(string(secretRaw), "\n"), "\r")
++	if secret == "" || strings.ContainsAny(secret, "\r\n\x00") {
++		return out, ErrOnlineToken
++	}
++	form := url.Values{"token": {raw}, "token_type_hint": {"access_token"}}
++	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.admission.Issuer+endpoint, strings.NewReader(form.Encode()))
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
++	req.Header.Set("Cache-Control", "no-cache")
++	req.SetBasicAuth(url.QueryEscape(c.admission.ClientID), url.QueryEscape(secret))
++	transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext}
++	defer transport.CloseIdleConnections()
++	client := &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }}
++	response, err := client.Do(req)
++	if err != nil {
++		return out, ErrOnlineToken
++	}
++	defer response.Body.Close()
++	if response.StatusCode != http.StatusOK || response.Header.Get("Cache-Control") != "no-store" {
++		return out, ErrOnlineToken
++	}
++	body, err := io.ReadAll(io.LimitReader(response.Body, 65537))
++	if err != nil || len(body) > 65536 {
++		return out, ErrOnlineToken
++	}
++	if endpoint == "/revoke" {
++		if len(body) != 0 {
++			return out, ErrOnlineToken
++		}
++		return out, nil
++	}
++	media, _, err := mime.ParseMediaType(response.Header.Get("Content-Type"))
++	if err != nil || media != "application/json" {
++		return out, ErrOnlineToken
++	}
++	return decodeOnlineStatus(body)
++}
++
++// Check verifies expected identity before accessing the private client credential,
++// sends a new authenticated introspection and rechecks lifetime after the network.
++func (c *OnlineClient) Check(ctx context.Context, raw string, expected ExpectedIdentity) (CurrentToken, error) {
++	if c == nil || ctx == nil || ctx.Err() != nil {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	identity, err := c.verify(raw, expected, c.now().UTC())
++	if err != nil {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	status, err := c.request(ctx, "/introspect", raw)
++	if err != nil || status.Active == nil || !*status.Active {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	expires, _ := exactUnix(identity.claims["exp"])
++	if status.ClientID != c.admission.ClientID || status.TokenType != "Bearer" || status.Issuer != identity.Issuer || status.Subject != identity.Subject || status.Audience != identity.Audience || status.TokenID != identity.TokenID || status.Scope != identity.claims["scope"] || status.IssuedAt != identity.IssuedAt.Unix() || status.ExpiresAt != expires.Unix() {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	end := c.now().UTC()
++	if end.Before(identity.CheckedAt) {
++		return CurrentToken{}, ErrOnlineToken
++	}
++	// A slow lookup cannot retain expired facts or a withdrawn JWT trust key.
++	return c.verify(raw, expected, end)
++}
++
++// Revoke performs cleanup only for the exact opaque token. An empty 200 is not
++// proof: a separate authenticated introspection must confirm inactive-for-client.
++// The caller retains original grant ownership and uncertainty/retry duties.
++func (c *OnlineClient) Revoke(ctx context.Context, raw string) (InactiveForClient, error) {
++	if c == nil {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	if _, err := c.request(ctx, "/revoke", raw); err != nil {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	return c.ObserveInactive(ctx, raw)
++}
++
++// ObserveInactive is read-only. Unavailability or a malformed response is never
++// interpreted as revocation; the negative result remains scoped to this client.
++func (c *OnlineClient) ObserveInactive(ctx context.Context, raw string) (InactiveForClient, error) {
++	if c == nil {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	status, err := c.request(ctx, "/introspect", raw)
++	if err != nil || status.Active == nil || *status.Active {
++		return InactiveForClient{}, ErrOnlineToken
++	}
++	return InactiveForClient{Issuer: c.admission.Issuer, ClientID: c.admission.ClientID, TokenDigest: tokenDigest(raw), CheckedAt: c.now().UTC()}, nil
++}
+diff --git a/src/internal/authclient/online_cli.go b/src/internal/authclient/online_cli.go
+--- /dev/null
++++ b/src/internal/authclient/online_cli.go
+@@ -0,0 +1,160 @@
++package authclient
++
++import (
++	"context"
++	"encoding/hex"
++	"encoding/json"
++	"flag"
++	"fmt"
++	"io"
++	"os"
++	"path/filepath"
++	"strings"
++)
++
++// onlineObservation is a private producer-owned command result, not a signed
++// authority receipt. The invoking owner authenticates binary/config/custody and
++// binds its own case, descriptor, transaction, principal and exact effect.
++type onlineObservation struct {
++	Schema              string                 `json:"schema"`
++	Status              string                 `json:"status"`
++	Current             *CurrentToken          `json:"current,omitempty"`
++	AuthenticationFacts map[string]interface{} `json:"signed_authentication_facts,omitempty"`
++	Inactive            *InactiveForClient     `json:"inactive_for_client,omitempty"`
++}
++
++func validOnlineDigest(raw string) bool {
++	if !strings.HasPrefix(raw, "sha256:") || len(raw) != 71 || strings.ToLower(raw) != raw {
++		return false
++	}
++	_, err := hex.DecodeString(raw[7:])
++	return err == nil
++}
++
++func parseOnlineFlags(fs *flag.FlagSet, args []string) error {
++	seen := map[string]bool{}
++	for i := 0; i < len(args); i++ {
++		name := strings.TrimLeft(args[i], "-")
++		if name == args[i] || name == "" {
++			return ErrOnlineToken
++		}
++		name, _, inline := strings.Cut(name, "=")
++		if fs.Lookup(name) == nil || seen[name] {
++			return ErrOnlineToken
++		}
++		seen[name] = true
++		if !inline {
++			i++
++			if i >= len(args) {
++				return ErrOnlineToken
++			}
++		}
++	}
++	if fs.Parse(args) != nil || fs.NArg() != 0 {
++		return ErrOnlineToken
++	}
++	return nil
++}
++
++func currentOnlineOutput(file *os.File) bool {
++	opened, err := file.Stat()
++	if err != nil {
++		return false
++	}
++	current, err := os.Lstat(file.Name())
++	return err == nil && current.Mode().IsRegular() && os.SameFile(opened, current)
++}
++
++func runOnline(ctx context.Context, mode string, args []string, stderr io.Writer) error {
++	fs := flag.NewFlagSet(mode, flag.ContinueOnError)
++	fs.SetOutput(io.Discard)
++	admissionFile := fs.String("admission-file", "", "independently admitted public profile")
++	tokenFile := fs.String("token-file", "", "private owner-acquired token JSON file")
++	digest := fs.String("token-sha256", "", "exact owner-bound access-token digest")
++	subject := fs.String("subject", "", "expected signed subject for current check")
++	tenant := fs.String("tenant", "", "expected signed tenant for current check")
++	principal := fs.String("principal-type", "", "human or service for current check")
++	out := fs.String("out", "", "new private observation file outside Git")
++	if parseOnlineFlags(fs, args) != nil || *admissionFile == "" || *tokenFile == "" || !filepath.IsAbs(*out) || !validOnlineDigest(*digest) {
++		return ErrOnlineToken
++	}
++	if mode == "check-current-token" && (*subject == "" || *tenant == "" || (*principal != "human" && *principal != "service")) {
++		return ErrOnlineToken
++	}
++	if (mode == "revoke-token" || mode == "check-inactive-token") && (*subject != "" || *tenant != "" || *principal != "") {
++		return ErrOnlineToken
++	}
++	raw, err := readOnlineFile(*admissionFile, false)
++	if err != nil {
++		return ErrOnlineToken
++	}
++	var admission OnlineAdmission
++	if _, err = decodeOnlineObject(raw, &admission); err != nil {
++		return ErrOnlineToken
++	}
++	client, err := NewOnlineClient(admission)
++	if err != nil {
++		return ErrOnlineToken
++	}
++	raw, err = readOnlineBoundedFile(*tokenFile, true, 131072)
++	if err != nil {
++		return ErrOnlineToken
++	}
++	var tokens Tokens
++	if _, err = decodeOnlineObject(raw, &tokens); err != nil || tokens.TokenType != "Bearer" || tokens.AccessToken == "" || tokenDigest(tokens.AccessToken) != *digest {
++		return ErrOnlineToken
++	}
++	parent, err := filepath.EvalSymlinks(filepath.Dir(*out))
++	if err != nil {
++		return ErrOnlineToken
++	}
++	info, err := os.Stat(parent)
++	if err != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
++		return ErrOnlineToken
++	}
++	file, err := reserveOutput(*out)
++	if err != nil {
++		return ErrOnlineToken
++	}
++	success := false
++	defer func() {
++		if !success && currentOnlineOutput(file) {
++			_ = os.Remove(file.Name())
++		}
++		_ = file.Close()
++	}()
++	observation := onlineObservation{Schema: "keycape.current-token-observation.v1"}
++	switch mode {
++	case "check-current-token":
++		current, err := client.Check(ctx, tokens.AccessToken, ExpectedIdentity{Subject: *subject, Tenant: *tenant, PrincipalType: *principal})
++		if err != nil {
++			return ErrOnlineToken
++		}
++		observation.Status = "current"
++		observation.Current = &current
++		facts := current.Claims()
++		observation.AuthenticationFacts = map[string]interface{}{"assurance": facts["assurance"], "tenant_source": facts["tenant_source"]}
++	case "revoke-token":
++		inactive, err := client.Revoke(ctx, tokens.AccessToken)
++		if err != nil {
++			return ErrOnlineToken
++		}
++		observation.Status = "inactive-for-client"
++		observation.Inactive = &inactive
++	case "check-inactive-token":
++		inactive, err := client.ObserveInactive(ctx, tokens.AccessToken)
++		if err != nil {
++			return ErrOnlineToken
++		}
++		observation.Status = "inactive-for-client"
++		observation.Inactive = &inactive
++	default:
++		return ErrOnlineToken
++	}
++	if json.NewEncoder(file).Encode(observation) != nil || file.Sync() != nil || !currentOnlineOutput(file) {
++		return ErrOnlineToken
++	}
++	success = true
++	_, _ = fmt.Fprintln(stderr, "PASS issuer token-status observation written; execution authority remains with its owner")
++	return nil
++}
+diff --git a/src/internal/authclient/online_cli_test.go b/src/internal/authclient/online_cli_test.go
+--- /dev/null
++++ b/src/internal/authclient/online_cli_test.go
+@@ -0,0 +1,166 @@
++package authclient
++
++import (
++	"bytes"
++	"context"
++	"encoding/json"
++	"os"
++	"path/filepath"
++	"strings"
++	"testing"
++)
++
++func onlinePrivateDir(t *testing.T) string {
++	t.Helper()
++	dir := t.TempDir()
++	if os.Chmod(dir, 0700) != nil {
++		t.Fatal("private fixture directory failed")
++	}
++	return dir
++}
++
++func (f *onlineFixture) cliInput(raw string) (string, string, []string) {
++	f.t.Helper()
++	dir := f.t.TempDir()
++	admission, token := filepath.Join(dir, "admission.json"), filepath.Join(dir, "token.json")
++	a, _ := json.Marshal(f.client.admission)
++	b, _ := json.Marshal(Tokens{AccessToken: raw, TokenType: "Bearer", ExpiresIn: 900})
++	if os.WriteFile(admission, a, 0644) != nil || os.WriteFile(token, b, 0600) != nil {
++		f.t.Fatal("fixture input write failed")
++	}
++	return admission, token, []string{"--admission-file", admission, "--token-file", token, "--token-sha256", tokenDigest(raw)}
++}
++
++func TestOnlineCLIUsesActualProducerAndPrivateObservation(t *testing.T) {
++	f := onlineProvider(t)
++	raw := f.issue()
++	_, _, base := f.cliInput(raw)
++	dir := onlinePrivateDir(t)
++	out := filepath.Join(dir, "current.json")
++	args := append([]string{"check-current-token"}, base...)
++	args = append(args, "--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service", "--out", out)
++	var log bytes.Buffer
++	if Run(context.Background(), args, &log) != nil {
++		t.Fatal("current-token command failed")
++	}
++	data, err := os.ReadFile(out)
++	if err != nil {
++		t.Fatal("observation unavailable")
++	}
++	var observation onlineObservation
++	if json.Unmarshal(data, &observation) != nil || observation.Schema != "keycape.current-token-observation.v1" || observation.Status != "current" || observation.Current == nil || observation.Current.TokenDigest != tokenDigest(raw) || observation.AuthenticationFacts["assurance"] == nil {
++		t.Fatal("wrong producer observation")
++	}
++	info, _ := os.Stat(out)
++	if info.Mode().Perm() != 0600 {
++		t.Fatal("observation is public")
++	}
++	if strings.Contains(string(data), raw) || strings.Contains(log.String(), raw) || strings.Contains(log.String(), onlineExpected.Subject) || strings.Contains(log.String(), f.issuer.ClientConfig["current-client"].ClientSecret) {
++		t.Fatal("command exposed private facts")
++	}
++	if Run(context.Background(), args, &log) == nil {
++		t.Fatal("existing observation overwritten")
++	}
++	currentBefore, _ := os.ReadFile(out)
++	if !bytes.Equal(currentBefore, data) {
++		t.Fatal("prior observation changed")
++	}
++	revokedOut := filepath.Join(dir, "inactive.json")
++	args = append([]string{"revoke-token"}, base...)
++	args = append(args, "--out", revokedOut)
++	if Run(context.Background(), args, &log) != nil {
++		t.Fatal("cleanup observation failed")
++	}
++	data, _ = os.ReadFile(revokedOut)
++	if json.Unmarshal(data, &observation) != nil || observation.Status != "inactive-for-client" || observation.Inactive == nil || observation.Inactive.TokenDigest != tokenDigest(raw) {
++		t.Fatal("cleanup scope not explicit")
++	}
++	failedOut := filepath.Join(dir, "failed.json")
++	args = append([]string{"check-current-token"}, base...)
++	args = append(args, "--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service", "--out", failedOut)
++	if Run(context.Background(), args, &log) == nil {
++		t.Fatal("revoked token accepted by actual command")
++	}
++	if _, err = os.Stat(failedOut); !os.IsNotExist(err) {
++		t.Fatal("failed command retained positive output")
++	}
++}
++
++func TestOnlineCLIRejectsChangedTokenAndUntrustedInput(t *testing.T) {
++	for _, kind := range []string{"wrong-hash", "duplicate-flag", "token-replaced", "duplicate-admission", "duplicate-token", "public-token", "shared-output-parent", "git-output", "output-symlink", "unknown-flag", "cleanup-identity-flags"} {
++		t.Run(kind, func(t *testing.T) {
++			f := onlineProvider(t)
++			raw := f.issue()
++			admission, token, base := f.cliInput(raw)
++			dir := onlinePrivateDir(t)
++			out := filepath.Join(dir, "result.json")
++			mode := "check-current-token"
++			extra := []string{"--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service"}
++			switch kind {
++			case "wrong-hash":
++				base[len(base)-1] = "sha256:" + strings.Repeat("0", 64)
++			case "duplicate-flag":
++				base = append(base, "--token-sha256", tokenDigest(raw))
++			case "token-replaced":
++				other := f.issue()
++				b, _ := json.Marshal(Tokens{AccessToken: other, TokenType: "Bearer"})
++				_ = os.WriteFile(token, b, 0600)
++			case "duplicate-admission":
++				b, _ := os.ReadFile(admission)
++				b = append([]byte(`{"issuer":"https://forged.invalid",`), b[1:]...)
++				_ = os.WriteFile(admission, b, 0644)
++			case "duplicate-token":
++				b, _ := os.ReadFile(token)
++				b = append([]byte(`{"token_type":"Bearer",`), b[1:]...)
++				_ = os.WriteFile(token, b, 0600)
++			case "public-token":
++				_ = os.Chmod(token, 0644)
++			case "shared-output-parent":
++				_ = os.Chmod(dir, 0755)
++			case "git-output":
++				_ = os.WriteFile(filepath.Join(dir, ".git"), []byte("gitdir: unused"), 0600)
++			case "output-symlink":
++				target := filepath.Join(t.TempDir(), "untouched")
++				_ = os.WriteFile(target, []byte("original"), 0600)
++				_ = os.Symlink(target, out)
++			case "unknown-flag":
++				extra = append(extra, "--secret-raw=must-not-echo-this")
++			case "cleanup-identity-flags":
++				mode = "revoke-token"
++			}
++			args := append([]string{mode}, base...)
++			args = append(args, extra...)
++			args = append(args, "--out", out)
++			var log bytes.Buffer
++			if Run(context.Background(), args, &log) == nil || f.introspections.Load() != 0 || f.revocations.Load() != 0 {
++				t.Fatal("untrusted command input reached issuer")
++			}
++			if strings.Contains(log.String(), "must-not-echo-this") || strings.Contains(log.String(), raw) {
++				t.Fatal("refusal echoed input")
++			}
++		})
++	}
++}
++
++func TestOnlineCLIFailureDoesNotDeleteReplacedObservation(t *testing.T) {
++	f := onlineProvider(t)
++	raw := f.issue()
++	_, _, base := f.cliInput(raw)
++	dir := onlinePrivateDir(t)
++	out := filepath.Join(dir, "result.json")
++	f.afterStatus.Store(func() {
++		if os.Remove(out) != nil || os.WriteFile(out, []byte("replacement owned by another attempt"), 0600) != nil {
++			t.Error("replacement fixture failed")
++		}
++	})
++	args := append([]string{"check-current-token"}, base...)
++	args = append(args, "--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service", "--out", out)
++	var log bytes.Buffer
++	if Run(context.Background(), args, &log) == nil {
++		t.Fatal("replaced observation reported successful")
++	}
++	data, _ := os.ReadFile(out)
++	if string(data) != "replacement owned by another attempt" {
++		t.Fatal("another attempt's output removed")
++	}
++}
+diff --git a/src/internal/authclient/online_export_test.go b/src/internal/authclient/online_export_test.go
+--- /dev/null
++++ b/src/internal/authclient/online_export_test.go
+@@ -0,0 +1,20 @@
++package authclient
++
++import (
++	"os/exec"
++	"path/filepath"
++	"runtime"
++	"testing"
++)
++
++func TestOnlineExportMatchesItsSingleProducer(t *testing.T) {
++	_, file, _, ok := runtime.Caller(0)
++	if !ok {
++		t.Fatal("producer source location unavailable")
++	}
++	root := filepath.Clean(filepath.Join(filepath.Dir(file), "../../.."))
++	cmd := exec.Command("python3", filepath.Join(root, "tools/export_tokenstatus_client.py"), "--check")
++	if err := cmd.Run(); err != nil {
++		t.Fatal("public adapter differs from the single producer source")
++	}
++}
+diff --git a/src/internal/authclient/online_human_test.go b/src/internal/authclient/online_human_test.go
+--- /dev/null
++++ b/src/internal/authclient/online_human_test.go
+@@ -0,0 +1,78 @@
++package authclient
++
++import (
++	"context"
++	"crypto/sha256"
++	"encoding/base64"
++	"encoding/json"
++	"net/http"
++	"net/http/httptest"
++	"net/url"
++	"strings"
++	"testing"
++	"time"
++
++	"keycape/internal/domain"
++	"keycape/internal/server/oidc"
++)
++
++type onlineHumanDirectory struct{ user domain.User }
++
++func (d *onlineHumanDirectory) LookupUser(context.Context, string) (*domain.User, error) {
++	return &d.user, nil
++}
++func (d *onlineHumanDirectory) LookupGroups(context.Context, string) ([]domain.Group, error) {
++	return nil, nil
++}
++func (d *onlineHumanDirectory) ListUsers(context.Context) ([]domain.User, error) {
++	return []domain.User{d.user}, nil
++}
++func (d *onlineHumanDirectory) ValidatePassword(context.Context, string, string) (bool, error) {
++	return false, nil
++}
++
++func TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus(t *testing.T) {
++	f := onlineProvider(t)
++	directory := &onlineHumanDirectory{user: domain.User{ID: "uid=operator,ou=people,dc=fixture", Username: "operator", Enabled: true, Tenant: "tenant:fixture", Groups: []string{"fixture-allowed"}}}
++	client := f.issuer.ClientConfig["current-client"]
++	client.GrantTypes = []string{"authorization_code"}
++	client.ServiceSubject = ""
++	client.AllowedScopes = []string{"openid", "profile", "groups"}
++	client.RedirectURIs = []string{"https://owner.fixture.invalid/callback"}
++	f.issuer.Users = directory
++	f.status.Users = directory
++	verifier := strings.Repeat("v", 43)
++	hash := sha256.Sum256([]byte(verifier))
++	authenticated := time.Now().Add(-time.Minute).Truncate(time.Second)
++	code := f.issuer.Sessions.Create(&oidc.PKCESession{ClientID: client.ClientID, Username: directory.user.Username,
++		RedirectURI: client.RedirectURIs[0], PKCEChallengeMethod: "S256", PKCEChallenge: base64.RawURLEncoding.EncodeToString(hash[:]),
++		Scopes: client.AllowedScopes, MFAVerified: true, AuthTime: authenticated, ExpiresAt: time.Now().Add(time.Minute)})
++	form := url.Values{"grant_type": {"authorization_code"}, "client_id": {client.ClientID}, "code": {code}, "code_verifier": {verifier}, "redirect_uri": {client.RedirectURIs[0]}}
++	r := httptest.NewRequest(http.MethodPost, "/token", strings.NewReader(form.Encode()))
++	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
++	r.SetBasicAuth(url.QueryEscape(client.ClientID), url.QueryEscape(client.ClientSecret))
++	w := httptest.NewRecorder()
++	f.issuer.ServeHTTP(w, r)
++	var tokens Tokens
++	if w.Code != 200 || json.Unmarshal(w.Body.Bytes(), &tokens) != nil {
++		t.Fatal("actual human PKCE fixture failed")
++	}
++	expected := ExpectedIdentity{Subject: directory.user.ID, Tenant: directory.user.Tenant, PrincipalType: "human"}
++	current, err := f.client.Check(context.Background(), tokens.AccessToken, expected)
++	if err != nil {
++		t.Fatal("actual human current status failed")
++	}
++	facts := current.Claims()
++	assurance, ok := facts["assurance"].(map[string]interface{})
++	if !ok || assurance["level"] != "aal2" || assurance["mfa"] != true || assurance["at"] != float64(authenticated.Unix()) || facts["tenant_source"] != "directory" {
++		t.Fatal("signed authentication provenance changed or was upgraded to current time")
++	}
++	before := f.introspections.Load()
++	if _, err = f.client.Check(context.Background(), tokens.IDToken, expected); err == nil || f.introspections.Load() != before {
++		t.Fatal("ID token was substituted for access-token status")
++	}
++	directory.user.Groups = []string{"netkingdom-suspended"}
++	if _, err = f.client.Check(context.Background(), tokens.AccessToken, expected); err == nil {
++		t.Fatal("suspended human remained current")
++	}
++}
+diff --git a/src/internal/authclient/online_test.go b/src/internal/authclient/online_test.go
+--- /dev/null
++++ b/src/internal/authclient/online_test.go
+@@ -0,0 +1,463 @@
++package authclient
++
++import (
++	"context"
++	"crypto/rand"
++	"crypto/rsa"
++	"encoding/json"
++	"encoding/pem"
++	"errors"
++	"fmt"
++	"net"
++	"net/http"
++	"net/http/httptest"
++	"net/url"
++	"os"
++	"path/filepath"
++	"strings"
++	"sync/atomic"
++	"syscall"
++	"testing"
++	"time"
++
++	"keycape/internal/domain"
++	"keycape/internal/jose"
++	"keycape/internal/server/oidc"
++	"keycape/internal/server/telemetry"
++)
++
++type onlineFixture struct {
++	t              *testing.T
++	client         *OnlineClient
++	issuer         *oidc.TokenHandler
++	status         *oidc.TokenStatusHandler
++	server         *httptest.Server
++	mode           atomic.Value
++	introspections atomic.Int64
++	revocations    atomic.Int64
++	afterStatus    atomic.Value
++}
++
++func onlineProvider(t *testing.T) *onlineFixture {
++	t.Helper()
++	key, err := rsa.GenerateKey(rand.Reader, 2048)
++	if err != nil {
++		t.Fatal("fixture key creation failed")
++	}
++	store, _ := oidc.NewTokenStatusStore(128)
++	f := &onlineFixture{t: t}
++	f.mode.Store("")
++	f.afterStatus.Store(func() {})
++	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { f.serve(w, r) }))
++	t.Cleanup(server.Close)
++	f.server = server
++	clients := map[string]*domain.Client{
++		"current-client": {ClientID: "current-client", ClientType: "confidential", ClientSecret: "synthetic + % /: current", Audience: "resource:fixture", GrantTypes: []string{"client_credentials"}, AllowedScopes: []string{"fixture.read"}, ServiceSubject: "service:fixture", Tenant: "tenant:fixture"},
++		"other-client":   {ClientID: "other-client", ClientType: "confidential", ClientSecret: "synthetic other", Audience: "resource:fixture", GrantTypes: []string{"client_credentials"}, AllowedScopes: []string{"fixture.read"}, ServiceSubject: "service:fixture", Tenant: "tenant:fixture"},
++	}
++	f.issuer = &oidc.TokenHandler{ClientConfig: clients, Sessions: oidc.NewSessionStore(), SigningKey: key, Issuer: server.URL, TokenLifetime: 15 * time.Minute, Emitter: telemetry.NoopEmitter{}, Tokens: store}
++	f.status = &oidc.TokenStatusHandler{Tokens: store, ClientConfig: clients, SigningKey: &key.PublicKey, Issuer: server.URL}
++	dir := t.TempDir()
++	ca := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw})
++	caFile, keysFile, secretFile := filepath.Join(dir, "ca.pem"), filepath.Join(dir, "keys.json"), filepath.Join(dir, "caller")
++	if os.WriteFile(caFile, ca, 0644) != nil || os.WriteFile(secretFile, []byte(clients["current-client"].ClientSecret), 0600) != nil {
++		t.Fatal("fixture files failed")
++	}
++	keys := oidc.NewKeySet()
++	keys.AddKey("key-1", &key.PublicKey)
++	w := httptest.NewRecorder()
++	oidc.NewJWKSHandler(keys).ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/jwks", nil))
++	if os.WriteFile(keysFile, w.Body.Bytes(), 0644) != nil {
++		t.Fatal("fixture public keys failed")
++	}
++	f.client, err = NewOnlineClient(OnlineAdmission{Issuer: server.URL, Audience: "resource:fixture", ClientID: "current-client", CAFile: caFile, JWKSFile: keysFile, SecretFile: secretFile, MaxTokenAge: "5m"})
++	if err != nil {
++		t.Fatal("fixture admission failed")
++	}
++	return f
++}
++
++func (f *onlineFixture) serve(w http.ResponseWriter, r *http.Request) {
++	mode := f.mode.Load().(string)
++	switch r.URL.Path {
++	case "/token":
++		f.issuer.ServeHTTP(w, r)
++	case "/revoke":
++		f.revocations.Add(1)
++		if mode == "revoke-no-effect" {
++			w.Header().Set("Cache-Control", "no-store")
++			w.WriteHeader(http.StatusOK)
++			return
++		}
++		if mode == "revoke-body" {
++			w.Header().Set("Cache-Control", "no-store")
++			fmt.Fprint(w, "unexpected")
++			return
++		}
++		f.status.Revoke(w, r)
++	case "/introspect":
++		f.introspections.Add(1)
++		if mode == "redirect" {
++			http.Redirect(w, r, f.server.URL+"/sink", 307)
++			return
++		}
++		if mode == "unavailable" {
++			w.WriteHeader(503)
++			return
++		}
++		if mode == "oversize" {
++			w.Header().Set("Cache-Control", "no-store")
++			w.Header().Set("Content-Type", "application/json")
++			fmt.Fprint(w, strings.Repeat("x", 65537))
++			return
++		}
++		recorded := httptest.NewRecorder()
++		f.status.Introspect(recorded, r)
++		for key, values := range recorded.Header() {
++			for _, value := range values {
++				w.Header().Add(key, value)
++			}
++		}
++		if mode == "cached" {
++			w.Header().Set("Cache-Control", "max-age=30")
++		}
++		if mode == "wrong-content-type" {
++			w.Header().Set("Content-Type", "text/plain")
++		}
++		var body map[string]interface{}
++		if json.Unmarshal(recorded.Body.Bytes(), &body) != nil {
++			w.WriteHeader(recorded.Code)
++			_, _ = w.Write(recorded.Body.Bytes())
++			return
++		}
++		switch mode {
++		case "missing-active":
++			delete(body, "active")
++		case "wrong-active-type":
++			body["active"] = "true"
++		case "missing-scope":
++			delete(body, "scope")
++		case "null-scope":
++			body["scope"] = nil
++		case "wrong-client":
++			body["client_id"] = "other-client"
++		case "wrong-subject":
++			body["sub"] = "service:other"
++		case "wrong-issuer":
++			body["iss"] = "https://other.invalid"
++		case "wrong-audience":
++			body["aud"] = "resource:other"
++		case "wrong-jti":
++			body["jti"] = "different-token-id"
++		case "wrong-expiry":
++			body["exp"] = body["exp"].(float64) + 10
++		case "wrong-issued":
++			body["iat"] = body["iat"].(float64) - 1
++		case "wrong-scope":
++			body["scope"] = "different.scope"
++		case "wrong-token-type":
++			body["token_type"] = "Other"
++		case "unknown-field":
++			body["authority"] = true
++		}
++		f.afterStatus.Load().(func())()
++		w.WriteHeader(recorded.Code)
++		encoded, _ := json.Marshal(body)
++		if mode == "duplicate-active" {
++			encoded = append([]byte(`{"active":false,`), encoded[1:]...)
++		}
++		if mode == "trailing-json" {
++			encoded = append(encoded, []byte(`{}`)...)
++		}
++		_, _ = w.Write(encoded)
++	case "/sink":
++		f.t.Error("credential redirect followed")
++		w.WriteHeader(500)
++	default:
++		w.WriteHeader(404)
++	}
++}
++
++func (f *onlineFixture) issue() string {
++	f.t.Helper()
++	r := httptest.NewRequest(http.MethodPost, "/token", strings.NewReader(url.Values{"grant_type": {"client_credentials"}}.Encode()))
++	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
++	client := f.issuer.ClientConfig["current-client"]
++	r.SetBasicAuth(url.QueryEscape(client.ClientID), url.QueryEscape(client.ClientSecret))
++	w := httptest.NewRecorder()
++	f.issuer.ServeHTTP(w, r)
++	var token Tokens
++	if w.Code != http.StatusOK || json.Unmarshal(w.Body.Bytes(), &token) != nil || token.AccessToken == "" {
++		f.t.Fatal("actual fixture issuance failed")
++	}
++	return token.AccessToken
++}
++
++var onlineExpected = ExpectedIdentity{Subject: "service:fixture", Tenant: "tenant:fixture", PrincipalType: "service"}
++
++func TestOnlineActualIssuerCurrentRevocationAndFreshGrant(t *testing.T) {
++	f := onlineProvider(t)
++	first := f.issue()
++	ctx := context.Background()
++	identity, err := f.client.Check(ctx, first, onlineExpected)
++	if err != nil || identity.Subject != onlineExpected.Subject || identity.ClientID != "current-client" || identity.TokenDigest != tokenDigest(first) || identity.TokenID == "" || !identity.CheckedAt.Before(identity.NotAfter) {
++		t.Fatal("current exact identity not established")
++	}
++	claims := identity.Claims()
++	claims["sub"] = "changed"
++	if identity.Claims()["sub"] != onlineExpected.Subject {
++		t.Fatal("returned facts share mutable state")
++	}
++	if _, err = f.client.Check(ctx, first, onlineExpected); err != nil || f.introspections.Load() != 2 {
++		t.Fatal("current status was cached")
++	}
++	if _, err = f.client.ObserveInactive(ctx, first); err == nil || f.revocations.Load() != 0 {
++		t.Fatal("read-only negative check changed active authority")
++	}
++	closed, err := f.client.Revoke(ctx, first)
++	if err != nil || closed.ClientID != "current-client" || closed.TokenDigest != identity.TokenDigest {
++		t.Fatal("issuer negative cleanup readback failed")
++	}
++	if _, err = f.client.Check(ctx, first, onlineExpected); err == nil {
++		t.Fatal("revoked token accepted")
++	}
++	before := f.revocations.Load()
++	if _, err = f.client.ObserveInactive(ctx, first); err != nil || f.revocations.Load() != before {
++		t.Fatal("independent negative readback failed or mutated token")
++	}
++	second := f.issue()
++	current, err := f.client.Check(ctx, second, onlineExpected)
++	if err != nil || current.TokenID == identity.TokenID || current.TokenDigest == identity.TokenDigest {
++		t.Fatal("fresh grant did not establish distinct identity")
++	}
++}
++
++func TestOnlineIdentityMismatchRefusesBeforeNetwork(t *testing.T) {
++	for _, kind := range []string{"subject", "tenant", "principal", "audience", "issuer", "tamper", "key", "no-jti", "ID-token", "stale"} {
++		t.Run(kind, func(t *testing.T) {
++			f := onlineProvider(t)
++			raw := f.issue()
++			expect := onlineExpected
++			switch kind {
++			case "subject":
++				expect.Subject = "other"
++			case "tenant":
++				expect.Tenant = "other"
++			case "principal":
++				expect.PrincipalType = "human"
++			case "audience":
++				f.client.admission.Audience = "other"
++			case "issuer":
++				f.client.admission.Issuer = "https://different.invalid"
++			case "tamper":
++				raw += "changed"
++			case "key":
++				key, _ := rsa.GenerateKey(rand.Reader, 2048)
++				raw = signToken(t, key, "key-1", map[string]interface{}{"iss": f.server.URL})
++			case "no-jti":
++				f.issuer.Tokens = nil
++				raw = f.issue()
++			case "ID-token":
++				identity, err := f.client.verify(raw, expect, time.Now())
++				if err != nil {
++					t.Fatal("fixture identity failed")
++				}
++				claims := identity.Claims()
++				delete(claims, "scope")
++				raw, err = oidc.BuildJWT(claims, "key-1", f.issuer.SigningKey)
++				if err != nil {
++					t.Fatal("fixture purpose token failed")
++				}
++			case "stale":
++				f.client.now = func() time.Time { return time.Now().Add(10 * time.Minute) }
++			}
++			if _, err := f.client.Check(context.Background(), raw, expect); !errors.Is(err, ErrOnlineToken) || f.introspections.Load() != 0 {
++				t.Fatal("unbound identity reached credential-bearing endpoint")
++			}
++		})
++	}
++}
++
++func TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus(t *testing.T) {
++	for _, mode := range []string{"missing-active", "wrong-active-type", "missing-scope", "null-scope", "wrong-client", "wrong-subject", "wrong-issuer", "wrong-audience", "wrong-jti", "wrong-expiry", "wrong-issued", "wrong-scope", "wrong-token-type", "unknown-field", "duplicate-active", "trailing-json", "redirect", "unavailable", "oversize", "cached", "wrong-content-type"} {
++		t.Run(mode, func(t *testing.T) {
++			f := onlineProvider(t)
++			raw := f.issue()
++			f.mode.Store(mode)
++			if _, err := f.client.Check(context.Background(), raw, onlineExpected); !errors.Is(err, ErrOnlineToken) || err.Error() != ErrOnlineToken.Error() {
++				t.Fatal("unsafe response accepted or disclosed detail")
++			}
++		})
++	}
++}
++
++func TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope(t *testing.T) {
++	f := onlineProvider(t)
++	raw := f.issue()
++	f.mode.Store("revoke-no-effect")
++	if _, err := f.client.Revoke(context.Background(), raw); err == nil {
++		t.Fatal("empty 200 mistaken for confirmed inactive state")
++	}
++	f.mode.Store("revoke-body")
++	if _, err := f.client.Revoke(context.Background(), raw); err == nil {
++		t.Fatal("unexpected cleanup output accepted")
++	}
++	f.mode.Store("")
++	f.client.admission.ClientID = "other-client"
++	if os.WriteFile(f.client.admission.SecretFile, []byte("synthetic other"), 0600) != nil {
++		t.Fatal("fixture credential write failed")
++	}
++	result, err := f.client.Revoke(context.Background(), raw)
++	if err != nil || result.ClientID != "other-client" {
++		t.Fatal("wrong-client negative scope not explicit")
++	}
++	f.client.admission.ClientID = "current-client"
++	_ = os.WriteFile(f.client.admission.SecretFile, []byte("synthetic + % /: current"), 0600)
++	if _, err = f.client.Check(context.Background(), raw, onlineExpected); err != nil {
++		t.Fatal("another client acquired revocation authority")
++	}
++}
++
++func TestOnlineReloadsCredentialsKeysAndTrustFiles(t *testing.T) {
++	for _, kind := range []string{"secret", "keys", "ca", "secret-world-readable", "public-writable", "secret-fifo"} {
++		t.Run(kind, func(t *testing.T) {
++			f := onlineProvider(t)
++			raw := f.issue()
++			if _, err := f.client.Check(context.Background(), raw, onlineExpected); err != nil {
++				t.Fatal("fixture current check failed")
++			}
++			switch kind {
++			case "secret":
++				_ = os.WriteFile(f.client.admission.SecretFile, []byte("changed synthetic"), 0600)
++			case "keys":
++				_ = os.WriteFile(f.client.admission.JWKSFile, []byte(`{"keys":[]}`), 0644)
++			case "ca":
++				_ = os.WriteFile(f.client.admission.CAFile, []byte("not a certificate"), 0644)
++			case "secret-world-readable":
++				_ = os.Chmod(f.client.admission.SecretFile, 0644)
++			case "public-writable":
++				_ = os.Chmod(f.client.admission.JWKSFile, 0666)
++			case "secret-fifo":
++				_ = os.Remove(f.client.admission.SecretFile)
++				if syscall.Mkfifo(f.client.admission.SecretFile, 0600) != nil {
++					t.Fatal("FIFO fixture failed")
++				}
++			}
++			if _, err := f.client.Check(context.Background(), raw, onlineExpected); err == nil {
++				t.Fatal("withdrawn or unsafe input reused")
++			}
++		})
++	}
++}
++
++func TestOnlineRechecksExpiryClockAndKeyAfterStatus(t *testing.T) {
++	for _, kind := range []string{"expiry", "clock-backwards", "withdrawn-key"} {
++		t.Run(kind, func(t *testing.T) {
++			f := onlineProvider(t)
++			raw := f.issue()
++			now := time.Now()
++			calls := 0
++			f.client.now = func() time.Time {
++				calls++
++				if calls == 1 {
++					return now
++				}
++				if kind == "expiry" {
++					return now.Add(10 * time.Minute)
++				}
++				if kind == "clock-backwards" {
++					return now.Add(-time.Second)
++				}
++				return now
++			}
++			if kind == "withdrawn-key" {
++				f.afterStatus.Store(func() { _ = os.WriteFile(f.client.admission.JWKSFile, []byte(`{"keys":[]}`), 0644) })
++			}
++			if _, err := f.client.Check(context.Background(), raw, onlineExpected); err == nil || f.introspections.Load() != 1 {
++				t.Fatal("delayed status preserved withdrawn identity")
++			}
++		})
++	}
++}
++
++func TestOnlineCancellationAndAmbientProxyDoNotLeakInputs(t *testing.T) {
++	f := onlineProvider(t)
++	if f.server.Certificate().VerifyHostname("example.com") != nil {
++		t.Fatal("fixture certificate lacks test DNS identity")
++	}
++	original, _ := url.Parse(f.server.URL)
++	_, port, _ := net.SplitHostPort(original.Host)
++	dnsAddress := net.JoinHostPort("example.com", port)
++	f.client.admission.Issuer = "https://" + dnsAddress
++	f.issuer.Issuer = f.client.admission.Issuer
++	f.status.Issuer = f.client.admission.Issuer
++	f.client.dialContext = func(ctx context.Context, network, address string) (net.Conn, error) {
++		if address == dnsAddress {
++			address = original.Host
++		}
++		return (&net.Dialer{}).DialContext(ctx, network, address)
++	}
++	raw := f.issue()
++	proxyCalls := atomic.Int64{}
++	proxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { proxyCalls.Add(1); w.WriteHeader(500) }))
++	defer proxy.Close()
++	t.Setenv("HTTPS_PROXY", proxy.URL)
++	t.Setenv("HTTP_PROXY", proxy.URL)
++	t.Setenv("ALL_PROXY", proxy.URL)
++	t.Setenv("NO_PROXY", "")
++	if _, err := f.client.Check(context.Background(), raw, onlineExpected); err != nil || proxyCalls.Load() != 0 {
++		t.Fatal("ambient proxy affected explicit owner transport")
++	}
++	ctx, cancel := context.WithCancel(context.Background())
++	cancel()
++	before := f.introspections.Load()
++	if _, err := f.client.Check(ctx, raw, onlineExpected); err == nil || f.introspections.Load() != before {
++		t.Fatal("cancelled check reached provider")
++	}
++	if _, err := f.client.Revoke(ctx, raw); err == nil || f.revocations.Load() != 0 {
++		t.Fatal("cancelled cleanup reached provider")
++	}
++}
++
++func TestOnlineMalformedAdmissionAndNegativeStatus(t *testing.T) {
++	f := onlineProvider(t)
++	for _, issuer := range []string{"http://issuer.invalid", "https://user@issuer.invalid", "https://issuer.invalid?", "https://issuer.invalid#", "https://issuer.invalid/../other", "https://issuer.invalid/%2Fother", "https://issuer.invalid/"} {
++		a := f.client.admission
++		a.Issuer = issuer
++		if _, err := NewOnlineClient(a); err == nil {
++			t.Fatal("ambiguous issuer admitted")
++		}
++	}
++	for _, raw := range []string{`null`, `[]`, `{}`, `{"active":null}`, `{"active":false,"sub":"hidden"}`, `{"active":false,"active":false}`, `{"active":false}{}`} {
++		if _, err := decodeOnlineStatus([]byte(raw)); err == nil {
++			t.Fatal("ambiguous inactive response accepted")
++		}
++	}
++	if status, err := decodeOnlineStatus([]byte(`{"active":false}`)); err != nil || *status.Active {
++		t.Fatal("exact inactive response refused")
++	}
++}
++
++func TestOnlineUsesSharedTypedJOSEVerifier(t *testing.T) {
++	f := onlineProvider(t)
++	raw := f.issue()
++	data, err := os.ReadFile(f.client.admission.JWKSFile)
++	if err != nil {
++		t.Fatal("fixture public keys unavailable")
++	}
++	keys, err := jose.ParseJWKS(data)
++	if err != nil {
++		t.Fatal("fixture public keys invalid")
++	}
++	if _, err = jose.VerifyTyped(raw, keys, "JWT"); err != nil {
++		t.Fatal("actual producer token rejected")
++	}
++	for _, typ := range []string{"", "at+jwt", "other"} {
++		if _, err = jose.VerifyTyped(raw, keys, typ); err == nil {
++			t.Fatal("unadmitted JWT type accepted")
++		}
++	}
++	if _, err = jose.Verify(raw, keys); err != nil {
++		t.Fatal("legacy shared signature verifier changed")
++	}
++}
+diff --git a/src/internal/jose/jose.go b/src/internal/jose/jose.go
+--- a/src/internal/jose/jose.go
++++ b/src/internal/jose/jose.go
+@@ -92,9 +92,26 @@
+ // Verify checks a token's RS256 signature against the key set and returns its
+ // claims. It does not inspect any claim.
+ func Verify(token string, keys KeySet) (map[string]interface{}, error) {
++	return verify(token, keys, "")
++}
++
++// VerifyTyped applies the same signature verifier with an explicit JOSE type.
++// Existing Verify callers retain their claim/type policy; online access-token
++// consumers opt into the producer's exact JWT header contract here.
++func VerifyTyped(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
++	if expectedType == "" {
++		return nil, ErrVerification
++	}
++	return verify(token, keys, expectedType)
++}
++
++func verify(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
+ 	header, signingInput, signature, err := split(token)
+ 	if err != nil {
+ 		return nil, err
++	}
++	if expectedType != "" && header.Typ != expectedType {
++		return nil, ErrVerification
+ 	}
+ 	public, ok := keys[header.Kid]
+ 	if !ok {
+@@ -117,6 +134,7 @@
+ 
+ type joseHeader struct {
+ 	Alg  string   `json:"alg"`
++	Typ  string   `json:"typ"`
+ 	Kid  string   `json:"kid"`
+ 	Crit []string `json:"crit"`
+ }
+diff --git a/tools/export_tokenstatus_client.py b/tools/export_tokenstatus_client.py
+--- /dev/null
++++ b/tools/export_tokenstatus_client.py
+@@ -0,0 +1,43 @@
++"""Export the producer's one online client; never maintain a consumer fork."""
++from pathlib import Path
++import argparse
++import hashlib
++import json
++
++ROOT = Path(__file__).resolve().parent.parent
++DESTINATION = ROOT / 'adapters/go/tokenstatus'
++
++def main():
++    parser = argparse.ArgumentParser()
++    parser.add_argument('--check', action='store_true')
++    args = parser.parse_args()
++    client = (ROOT / 'src/internal/authclient/online.go').read_bytes()
++    assert client.startswith(b'package authclient\n')
++    output = {
++        'pkg/tokenstatus/client.go': client.replace(b'package authclient\n', b'package tokenstatus\n', 1),
++        'internal/jose/jose.go': (ROOT / 'src/internal/jose/jose.go').read_bytes(),
++        'LICENSE': (ROOT / 'LICENSE').read_bytes(),
++        'go.mod': b'module keycape\n\ngo 1.23.0\n',
++    }
++    metadata = {
++        'source_of_truth': 'key-cape source; generated by tools/export_tokenstatus_client.py',
++        'source_files': ['src/internal/authclient/online.go', 'src/internal/jose/jose.go', 'LICENSE'],
++        'transformation': 'replace only the first package declaration authclient with tokenstatus; all remaining client bytes and shared JOSE bytes exact',
++        'module': 'keycape', 'profile': 'issuer online access-token status; no policy evaluator or deployment',
++        'supported_file_boundary': 'Linux owner execution profile; POSIX mode checks; not a Windows ACL contract',
++        'sha256': {name: 'sha256:' + hashlib.sha256(raw).hexdigest() for name,raw in sorted(output.items())},
++    }
++    output['producer-source.json'] = (json.dumps(metadata, indent=2) + '\n').encode()
++    actual = {str(p.relative_to(DESTINATION)) for p in DESTINATION.rglob('*') if p.is_file()}
++    if actual - set(output):
++        raise SystemExit('unexpected generated adapter file; reconcile explicitly')
++    if args.check:
++        if any(not (DESTINATION / name).is_file() or (DESTINATION / name).read_bytes()!=raw for name,raw in output.items()):
++            raise SystemExit('producer/consumer token-status source drift')
++    else:
++        for name, raw in output.items():
++            path=DESTINATION/name;path.parent.mkdir(parents=True, exist_ok=True);path.write_bytes(raw)
++    print(json.dumps({'status':'verified' if args.check else 'exported','files':len(output)}))
++
++if __name__ == '__main__':
++    main()
+diff --git a/workplans/KEY-WP-0042-online-access-token-status.md b/workplans/KEY-WP-0042-online-access-token-status.md
+--- a/workplans/KEY-WP-0042-online-access-token-status.md
++++ b/workplans/KEY-WP-0042-online-access-token-status.md
+@@ -82,3 +82,35 @@
+ checks. This closes source task T02 only. T01 independent issuer/profile review,
+ T03 native admission and all existing consumer operation/effect bindings remain
+ open. Evidence is retained by CUST-WP-0080 under keycape-token-status-r1.
++
++## Provide the shared producer client and owner-private command observations
++
++```task
++id: KEY-WP-0042-T04
++status: done
++priority: high
++state_hub_task_id: "4c71c9f7-8e14-5fec-8491-d7a7995f97e2"
++```
++
++2026-10-18 source outcome: `internal/authclient/online.go` owns strict current
++token/status joining, explicit HTTPS/CA/JWKS/current-credential admission,
++identity-first credential access, per-check rereads, response/clock/lifetime
++rechecks and independent read-only inactive observation. The existing executable
++exposes `check-current-token`, `revoke-token`, `check-inactive-token`, with exact
++token digest binding and new private observation outputs outside Git. Negative
++output is explicitly inactive-for-client, never global revocation/ownership.
++The public five-file Go adapter is generated from the same client and JOSE bytes;
++ordinary source checks refuse drift. Source/contract: `docs/current-token-client.md`.
++
++The full source race suite passes 724 test/subtest results with the same six
++native/external skips. Human PKCE tests retain actual subject/assurance/auth-time/
++tenant provenance and refuse ID-token substitution. A separate source fixture
++uses the built CLI, generated Go consumer and actual Warden kernel across fresh
++owner processes, with real fixture HTTPS status and independent negative cleanup
++checks. Owner approvals/case/catalog and target are synthetic; there is no native
++admission or second real application acceptance. The first CLI fixture's directory
++permissions, archive-only Warden Git metadata failure and original API absence are
++retained as failures, not backfilled successes. Source/evidence:
++`the-custodian/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/`.
++T01 independent issuer/profile review, T03 native lifecycle, NK48/Apps actual
++operation/inverse/ongoing-resource bindings and all full target gates remain open.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/Makefile b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/Makefile
new file mode 100644
index 0000000..e41dc78
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/Makefile
@@ -0,0 +1,41 @@
+IMAGE_REGISTRY ?= 92.205.130.254:32166
+IMAGE_REPO     ?= coulomb/key-cape
+IMAGE_TAG      ?= latest
+IMAGE          := $(IMAGE_REGISTRY)/$(IMAGE_REPO):$(IMAGE_TAG)
+
+.PHONY: dev seed build test lint contract-test image push image-tag tokenstatus-export tokenstatus-check
+
+PLAYBOOK_VALIDATOR ?= ../net-kingdom/tools/playbook-capability-contract/playbook_contract_validator.py
+
+dev:
+	docker compose -f docker-compose.dev.yml up
+
+seed:
+	docker compose -f docker-compose.dev.yml exec lldap /scripts/seed.sh
+
+build:
+	cd src && go build ./...
+
+test: tokenstatus-check
+	cd src && go test ./...
+
+tokenstatus-export:
+	python3 tools/export_tokenstatus_client.py
+
+tokenstatus-check:
+	python3 tools/export_tokenstatus_client.py --check
+
+lint:
+	cd src && go vet ./...
+
+contract-test:
+	python3 $(PLAYBOOK_VALIDATOR) capabilities/playbooks/*.yaml
+
+image:
+	docker build -t $(IMAGE) .
+
+push: image
+	docker push $(IMAGE)
+
+image-tag:
+	docker tag $(IMAGE) $(IMAGE_REGISTRY)/$(IMAGE_REPO):$(IMAGE_TAG)
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/LICENSE b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/LICENSE
new file mode 100644
index 0000000..7e08e28
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/LICENSE
@@ -0,0 +1,151 @@
+# Target Revenue Source License
+
+**Version 1.0, Candidate 1 (V1C1)**
+
+---
+
+> **PRELIMINARY CANDIDATE — SUBJECT TO CHANGE — NOT FINAL**
+>
+> This repository is governed by the Target Revenue Source License
+> (TRSL), Version 1, Candidate 1. This is the framework's first working
+> candidate, adopted as the org's preliminary operating license across
+> all repos (maintainer decision, 2026-07-29) during the build/alpha
+> stage — see `SCOPE.md` §1 and Appendix A of the canonical text (link
+> below) for the alpha/beta risk-acceptance decision this reflects and
+> what it does and does not mean. Full specialist legal review is
+> explicitly deferred until the framework moves out of beta.
+>
+> **Canonical source, full candidate-status banner, and Appendix A
+> (non-normative candidate notes tracking every open item):** the
+> `coulomb` org's `target-revenue` repository,
+> `specs/TargetRevenueSourceLicense-V1C1.md` — this file is the operative
+> legal text (Preamble through Section 11) only; the canonical document
+> is authoritative if this copy and that document ever diverge.
+
+---
+
+## Preamble
+
+This Target Revenue Source License ("**License**") governs the Software identified in the applicable Phase Manifest. It implements the Target Revenue Framework: a defined development Phase accumulates Development Credit and Remission Credit against an immutable Initial Target until the Milestone Release automatically and irrevocably converts to a declared permissive Future License.
+
+Commercial beneficiaries fund the creation and early availability of a software improvement; once the declared target is satisfied, the governed release becomes permissively open source.
+
+## 1. Definitions
+
+Capitalized terms used in this License have the meanings given below. Where a term is also defined in the Phase Manifest or Target Ledger for a specific Phase, the Phase Manifest and Target Ledger govern the *values* (amounts, dates, identifiers) and this License governs the *legal effect* of those values — the two must not be read as conflicting definitions of the same concept.
+
+**"Commercial Entitlement"** means a right, purchased or otherwise granted under a Commercial Use Agreement, to make Commercial Use of the Software during a Phase.
+
+**"Commercial Use"** means billing, invoicing, or otherwise charging any customer a fee, subscription, license fee, or other consideration for or in connection with use of the Software, at any time before the Conversion Event for the applicable Phase, regardless of whether the person or organization billed would otherwise qualify for Noncommercial Use. Commercial Use occurs by virtue of such billing alone, whether or not the resulting payment is registered with the Trust Service; in particular, billing a customer for pre-conversion use of the Software without recording the corresponding payment in the applicable Phase's Target Ledger is Commercial Use without a valid Commercial Entitlement — a violation of Section 3, addressed under Section 7 and, where applicable, the Enforcement Network described in the canonical repository's `specs/EnforcementNetworkConcept.md`.
+
+**"Commercial Use Agreement"** means the separate agreement, referenced by the applicable Phase Manifest, under which a Commercial Entitlement is purchased or granted. This License does not itself set pricing, metering, or payment terms — those are governed by the Commercial Use Agreement.
+
+**"Conversion Event"** means the moment the Outstanding Target for a Phase reaches zero, as computed from the Phase Manifest and Target Ledger per the Target Ledger Specification. The Conversion Event occurs automatically and is not conditioned on any declaration, attestation, or other act by the Licensor or any Trust Service.
+
+**"Development Credit"** means the portion of a collected and settled payment explicitly allocated toward satisfying the Initial Target of a specific Phase, as recorded in that Phase's Target Ledger.
+
+**"Future License"** means the permissive license identified in the applicable Phase Manifest, being either the MIT License or the Apache License, Version 2.0, which applies to the Milestone Release upon the Conversion Event.
+
+**"Initial Target"** means the immutable monetary target declared for a Phase in its Phase Manifest.
+
+**"Licensor"** means **Binky Hedgehog GmbH**, the party that publishes the Phase Manifest and holds the rights necessary to grant this License and the Future License for the Milestone Release.
+
+**"Milestone Release"** means the precisely identified software release designated in the applicable Phase Manifest, identified by an immutable source revision, release artifact, or cryptographic digest.
+
+**"Noncommercial Use"** means use of the Software for personal purposes, private study, hobby or amateur projects; use by any charitable organization, educational institution, public research organization, or government institution acting in a non-revenue-generating capacity; or other use of a materially similar character.
+
+**"Outstanding Target"** means, at any time, `max(0, Initial Target − cumulative Development Credit − cumulative Remission Credit)` for a Phase, as computed from that Phase's Target Ledger.
+
+**"Phase"** means a bounded development undertaking governed by one Initial Target, one Milestone Release, one degeneration policy, and one Future License declaration, as declared in a Phase Manifest.
+
+**"Phase Manifest"** means the published, immutable declaration identifying a Phase, its Milestone Release, Initial Target, Future License, degeneration policy, and Target Ledger location, as specified in the Phase Manifest Specification.
+
+**"Remission Credit"** means a transparent, non-revenue reduction of a Phase's Outstanding Target, generated under that Phase's published degeneration policy and recorded in the Target Ledger.
+
+**"Settled Payment"** means a payment that has cleared through its payment processor and is no longer subject to reversal in the ordinary course (chargeback, dispute, or equivalent), as further specified by the applicable Commercial Use Agreement or monetization extension.
+
+**"Software"** means the source code, object code, and associated documentation of the Milestone Release identified in the applicable Phase Manifest.
+
+**"Target Ledger"** means the append-only record of Development Credit, Remission Credit, and correction entries for a Phase, as specified in the Target Ledger Specification.
+
+**"You"** or **"Licensee"** means the individual or entity exercising rights under this License.
+
+## 2. Grant of Rights for Noncommercial Use
+
+Subject to the terms of this License, the Licensor grants You a worldwide, royalty-free, non-exclusive license, during the applicable Phase, to:
+
+(a) use, reproduce, and study the Software for any Noncommercial Use;
+
+(b) modify the Software and create derivative works of it for any Noncommercial Use; and
+
+(c) redistribute the Software and Your modifications, in source or object form, for any Noncommercial Use, provided that You include this License, unmodified, with any such redistribution, and that You do not remove or alter any copyright, patent, trademark, or attribution notices contained in the Software.
+
+This grant does not extend to Commercial Use. Commercial Use requires a Commercial Entitlement under Section 3.
+
+## 3. Commercial Use
+
+You may not make Commercial Use of the Software during the applicable Phase unless You hold a valid, current Commercial Entitlement under a Commercial Use Agreement with the Licensor covering the applicable Phase. A Commercial Entitlement granted under one Phase's Commercial Use Agreement does not extend to a later Phase's Milestone Release unless the Commercial Use Agreement expressly says so.
+
+This Section 3 states the existence and boundary of the commercial-use restriction. It does not itself set pricing, invoicing, metering, audit rights, or payment terms — those are governed exclusively by the applicable Commercial Use Agreement.
+
+## 4. Patent License
+
+Subject to the terms of this License, each contributor to the Software grants You, during the applicable Phase and solely to the extent of rights granted under Sections 2 and 3, a perpetual (subject to the termination below), worldwide, non-exclusive, no-charge, royalty-free patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Software, limited to those patent claims licensable by that contributor that are necessarily infringed by their contribution(s) alone or by combination of their contribution(s) with the Software.
+
+If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Software or a contribution incorporated within it constitutes direct or contributory patent infringement, then any patent licenses granted to You under this Section 4 for the Software shall terminate as of the date such litigation is filed.
+
+## 5. Automatic Conversion to the Future License
+
+**5.1 Automatic effect.** Upon the Conversion Event for a Phase, the rights and restrictions in Sections 3 (Commercial Use) of this License, as they apply to that Phase's Milestone Release, terminate automatically. In their place, the Milestone Release is licensed under the Future License identified in that Phase's Phase Manifest, effective as of the Conversion Event, without any further act, declaration, or attestation required by the Licensor, any Trust Service, or any other party.
+
+**5.2 Irrevocability.** Once a valid Conversion Event has occurred for a Phase, no subsequent refund, chargeback, accounting correction, dispute, or termination of this License for an unrelated breach shall revoke, suspend, or otherwise impair the Future License grant for that Phase's Milestone Release. Any shortfall or dispute arising after a Conversion Event is a commercial or accounting matter between the relevant parties and does not reinstate a commercial-use restriction over already-converted Software.
+
+**5.3 Prior freedom preserved.** A later Phase covering subsequent improvements to the Software does not restrict, withdraw, or otherwise affect the rights granted under the Future License for an earlier Phase's already-converted Milestone Release.
+
+**5.4 Evidence, not cause.** A Trust Service may publish a Conversion Attestation documenting a Conversion Event. Such an attestation is evidence that the Conversion Event occurred; it is not a condition of, and its absence or delay does not postpone, the automatic effect described in Section 5.1. Any person may independently verify whether a Conversion Event has occurred directly from the Phase Manifest and Target Ledger.
+
+## 6. Successive Phases
+
+The Licensor may declare a new Phase covering subsequent improvements to the Software following a Milestone Release's Conversion Event. Each Phase is independently governed by its own Phase Manifest, Initial Target, degeneration policy, and Target Ledger. Nothing in a later Phase's Phase Manifest may be construed to reduce or withdraw rights already granted under Section 5 for an earlier Phase's Milestone Release.
+
+## 7. Term and Termination
+
+**7.1 Term.** This License applies to the Software for the duration of the applicable Phase, and, for the Milestone Release, indefinitely following that Phase's Conversion Event under the Future License.
+
+**7.2 Termination for breach.** If You breach Section 3 (Commercial Use) or Section 2(c) (redistribution notice requirement), the Licensor may terminate this License as to You. Before such termination becomes effective, the Licensor shall provide You written notice of the breach; if You cure the breach within thirty (30) days of that notice, this License continues in effect. A second breach of the same provision within twelve (12) months may be terminated immediately without a further cure opportunity.
+
+**7.3 Effect of termination.** Termination under this Section 7 affects only Your rights under Sections 2 and 3 for the Phase in which the breach occurred. It does not affect any rights already vested under Section 5 (Automatic Conversion) for a Milestone Release whose Conversion Event has already occurred, per Section 5.2.
+
+**7.4 Public record of breach and resolution.** The Licensor shall cause the Trust Service to publish, as part of the public record for the affected Phase, notice of: (a) any breach notice issued under Section 7.2, stating the general nature of the breach and the date of notice; (b) whether the breach was cured within the applicable cure period, and the date of cure; and (c) any termination determination made under this Section 7, including its effective date and scope. This public record exists to give the ecosystem a transparent, verifiable conformity signal for the Phase, distinct from and in addition to the Development Credit and Remission Credit facts already published under Section 5.4 and the Target Ledger Specification.
+
+A breach that You dispute, and that has not been finally determined, shall be recorded as **alleged**; it shall be recorded as **determined** only once the cure period has run without cure, or the dispute has been resolved against You under the applicable Commercial Use Agreement's dispute process, if any. The Trust Service shall update the record promptly upon resolution in either direction. Recording an alleged or determined breach under this Section 7.4 is a ministerial act of publishing the Licensor's determination (or a dispute process's outcome); it does not give the Trust Service discretionary authority to decide whether a breach occurred, consistent with Section 5.4's evidence-not-cause principle.
+
+Whether, and under what conditions, the public record identifies a Commercial Entitlement holder by name is governed exclusively by the applicable Commercial Use Agreement, which the Licensor and that Commercial Entitlement holder negotiate and agree to directly. This License does not itself set a naming default. Where no Commercial Use Agreement addresses the question, or where the affected party has no Commercial Use Agreement at all (for example, a Section 2(c) breach by a Noncommercial Use licensee), the public record states the Phase and breach category only, without naming the party.
+
+## 8. Disclaimer of Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. THE LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE ERROR-FREE OR THAT ANY PHASE WILL REACH ITS CONVERSION EVENT.
+
+## 9. Limitation of Liability
+
+IN NO EVENT SHALL THE LICENSOR OR ANY CONTRIBUTOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE, EXCEPT TO THE EXTENT SUCH LIMITATION IS PROHIBITED BY APPLICABLE LAW.
+
+## 10. Trademarks
+
+This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary attribution.
+
+## 11. General Provisions
+
+**11.1 Governing law and venue.** Adopted for alpha/beta 2026-07-29: disputes arising under this License shall be resolved by binding arbitration, seated at a neutral, arbitration-mature venue (Singapore or London are the two candidates concretely supported by current research), rather than by litigation in a national court. The specific arbitral institution and substantive governing law remain a per-deployment blank pending final selection; they are not fixed by this candidate. See the canonical repository's `history/260729-TRSL-Jurisdiction-Synthesis.md` §2.
+
+**11.2 Severability.** If any provision of this License is held unenforceable, the remaining provisions remain in full force, and the unenforceable provision shall be reformed to the minimum extent necessary to make it enforceable.
+
+**11.3 No waiver.** Failure to enforce any provision of this License is not a waiver of future enforcement of that or any other provision.
+
+**11.4 Entire agreement (as to licensing).** This License, together with the applicable Phase Manifest and, where applicable, the Commercial Use Agreement, constitutes the entire agreement between You and the Licensor regarding the Software's licensing terms. Operations, service, and consulting arrangements are governed by separate agreements, if any, and are not part of this License.
+
+**11.5 Definitions control.** Marketing materials, documentation, or other non-normative communications about the Software must not describe pre-Conversion-Event Software as "Open Source," "free software," or "open core." Pre-conversion Noncommercial Use is **source-available**; pre-conversion Commercial Use requires a **Commercial Entitlement**; only post-conversion Software may be described as Open Source, under the Future License.
+
+---
+
+**No Phase is currently declared for this repository under this License.** Until a Phase Manifest is published and registered with the Trust Service for a Milestone Release in this repository, Sections 2–7 above have no operative subject matter here — this License establishes the governing framework in advance of that declaration, consistent with the org-wide rollout decision recorded in `target-revenue`'s `workplans/TREV-WP-0008-governance-and-pilot-rollout.md`.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/go.mod b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/go.mod
new file mode 100644
index 0000000..e41be92
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/go.mod
@@ -0,0 +1,3 @@
+module keycape
+
+go 1.23.0
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/internal/jose/jose.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/internal/jose/jose.go
new file mode 100644
index 0000000..6eef3d8
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/internal/jose/jose.go
@@ -0,0 +1,171 @@
+// Package jose provides strict RS256 JWT signature verification against a JWK
+// set. It is deliberately narrow: it establishes that a token was signed by a
+// key in the given set and returns its claims. It applies no claim policy —
+// issuer, audience, expiry and nonce rules differ per caller and belong with
+// the caller that knows them.
+//
+// The strictness here is the point. A verifier that accepts an unexpected
+// algorithm, an unbounded exponent or an undersized modulus is worse than no
+// verifier, because callers stop checking what it appears to guarantee.
+package jose
+
+import (
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"math/big"
+	"strings"
+)
+
+// ErrVerification is returned for every verification failure. The cause is
+// deliberately not distinguished: a caller acting on why a token failed tends to
+// leak that distinction to whoever supplied the token.
+var ErrVerification = errors.New("jose: token verification failed")
+
+// KeySet maps key IDs to RSA public keys.
+type KeySet map[string]*rsa.PublicKey
+
+// ParseJWKS parses a JWK set, keeping only RSA signing keys usable with RS256.
+// Keys that are malformed, too small, or carry an even or trivial exponent are
+// rejected rather than skipped, since a key set that is partly wrong is not
+// evidence of anything.
+func ParseJWKS(raw []byte) (KeySet, error) {
+	var document struct {
+		Keys []struct {
+			Kty string `json:"kty"`
+			Use string `json:"use"`
+			Alg string `json:"alg"`
+			Kid string `json:"kid"`
+			N   string `json:"n"`
+			E   string `json:"e"`
+		} `json:"keys"`
+	}
+	if err := json.Unmarshal(raw, &document); err != nil {
+		return nil, ErrVerification
+	}
+	keys := make(KeySet, len(document.Keys))
+	for _, key := range document.Keys {
+		// Ignore keys for other algorithms or purposes; they are not errors.
+		if key.Kty != "RSA" || (key.Use != "" && key.Use != "sig") || (key.Alg != "" && key.Alg != "RS256") {
+			continue
+		}
+		if key.Kid == "" {
+			return nil, ErrVerification
+		}
+		modulus, errN := decode(key.N)
+		exponent, errE := decode(key.E)
+		if errN != nil || errE != nil || len(exponent) == 0 || len(exponent) > 4 {
+			return nil, ErrVerification
+		}
+		public := &rsa.PublicKey{
+			N: new(big.Int).SetBytes(modulus),
+			E: int(new(big.Int).SetBytes(exponent).Int64()),
+		}
+		if public.N.BitLen() < 2048 || public.E < 3 || public.E%2 == 0 {
+			return nil, ErrVerification
+		}
+		if _, duplicate := keys[key.Kid]; duplicate {
+			return nil, ErrVerification
+		}
+		keys[key.Kid] = public
+	}
+	if len(keys) == 0 {
+		return nil, ErrVerification
+	}
+	return keys, nil
+}
+
+// KeyID returns the key ID from a token's JOSE header, after checking that the
+// header names RS256 and carries no critical extensions. Callers use it to
+// decide whether to refresh their key set before verifying.
+func KeyID(token string) (string, error) {
+	header, _, _, err := split(token)
+	if err != nil {
+		return "", err
+	}
+	return header.Kid, nil
+}
+
+// Verify checks a token's RS256 signature against the key set and returns its
+// claims. It does not inspect any claim.
+func Verify(token string, keys KeySet) (map[string]interface{}, error) {
+	return verify(token, keys, "")
+}
+
+// VerifyTyped applies the same signature verifier with an explicit JOSE type.
+// Existing Verify callers retain their claim/type policy; online access-token
+// consumers opt into the producer's exact JWT header contract here.
+func VerifyTyped(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
+	if expectedType == "" {
+		return nil, ErrVerification
+	}
+	return verify(token, keys, expectedType)
+}
+
+func verify(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
+	header, signingInput, signature, err := split(token)
+	if err != nil {
+		return nil, err
+	}
+	if expectedType != "" && header.Typ != expectedType {
+		return nil, ErrVerification
+	}
+	public, ok := keys[header.Kid]
+	if !ok {
+		return nil, ErrVerification
+	}
+	digest := sha256.Sum256([]byte(signingInput))
+	if rsa.VerifyPKCS1v15(public, crypto.SHA256, digest[:], signature) != nil {
+		return nil, ErrVerification
+	}
+	payload, err := decode(strings.Split(signingInput, ".")[1])
+	if err != nil {
+		return nil, ErrVerification
+	}
+	claims := map[string]interface{}{}
+	if json.Unmarshal(payload, &claims) != nil {
+		return nil, ErrVerification
+	}
+	return claims, nil
+}
+
+type joseHeader struct {
+	Alg  string   `json:"alg"`
+	Typ  string   `json:"typ"`
+	Kid  string   `json:"kid"`
+	Crit []string `json:"crit"`
+}
+
+// split validates the token's shape and header and returns the header, the
+// signing input, and the decoded signature.
+func split(token string) (joseHeader, string, []byte, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	raw, err := decode(parts[0])
+	if err != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	var header joseHeader
+	if json.Unmarshal(raw, &header) != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	// An unexpected algorithm must fail before any key is selected, so "none"
+	// and symmetric algorithms can never reach the RSA path.
+	if header.Alg != "RS256" || header.Kid == "" || len(header.Crit) != 0 {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	signature, err := decode(parts[2])
+	if err != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	return header, parts[0] + "." + parts[1], signature, nil
+}
+
+func decode(segment string) ([]byte, error) {
+	return base64.RawURLEncoding.DecodeString(segment)
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/pkg/tokenstatus/client.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/pkg/tokenstatus/client.go
new file mode 100644
index 0000000..5b2057c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/pkg/tokenstatus/client.go
@@ -0,0 +1,379 @@
+package tokenstatus
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"math"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"keycape/internal/jose"
+)
+
+var ErrOnlineToken = errors.New("current authenticated token refused")
+
+// OnlineAdmission is independently admitted owner configuration. The public
+// JWKS/CA and private client credential files are reread for every request.
+// It selects the owning confidential client, not a resource-server delegation.
+type OnlineAdmission struct {
+	Issuer      string `json:"issuer"`
+	Audience    string `json:"audience"`
+	ClientID    string `json:"client_id"`
+	CAFile      string `json:"ca_file"`
+	JWKSFile    string `json:"jwks_file"`
+	SecretFile  string `json:"secret_file"`
+	MaxTokenAge string `json:"max_token_age"`
+}
+
+type ExpectedIdentity struct {
+	Subject       string
+	Tenant        string
+	PrincipalType string
+}
+
+// CurrentToken contains signed identity facts joined to a current issuer
+// observation. It is never a permission, approval or portable execution receipt.
+type CurrentToken struct {
+	Issuer        string    `json:"issuer"`
+	Audience      string    `json:"audience"`
+	ClientID      string    `json:"client_id"`
+	Subject       string    `json:"subject"`
+	Tenant        string    `json:"tenant"`
+	PrincipalType string    `json:"principal_type"`
+	TokenID       string    `json:"jti"`
+	TokenDigest   string    `json:"token_sha256"`
+	IssuedAt      time.Time `json:"issued_at"`
+	NotAfter      time.Time `json:"not_after"`
+	CheckedAt     time.Time `json:"checked_at"`
+	claims        map[string]interface{}
+}
+
+// Claims returns a separate copy of the verified signed facts. Authentication
+// assurance/age, tenant provenance, current groups and resource/effect policy
+// remain the consumer's existing profile obligations, not a new client policy.
+func (t CurrentToken) Claims() map[string]interface{} {
+	if t.claims == nil {
+		return nil
+	}
+	raw, _ := json.Marshal(t.claims)
+	var out map[string]interface{}
+	_ = json.Unmarshal(raw, &out)
+	return out
+}
+
+// InactiveForClient proves only the issuer's current negative response for the
+// named client/token digest. An unknown/other-client token gives the same result;
+// original grant ownership is separately required before asserting cleanup.
+type InactiveForClient struct {
+	Issuer      string    `json:"issuer"`
+	ClientID    string    `json:"client_id"`
+	TokenDigest string    `json:"token_sha256"`
+	CheckedAt   time.Time `json:"checked_at"`
+}
+
+type OnlineClient struct {
+	admission OnlineAdmission
+	age       time.Duration
+	now       func() time.Time
+	// Nil uses the normal resolver/dialer. Tests route a certified DNS name to
+	// isolated loopback; the TLS name/CA and JWT trust checks remain unchanged.
+	dialContext func(context.Context, string, string) (net.Conn, error)
+}
+
+func NewOnlineClient(a OnlineAdmission) (*OnlineClient, error) {
+	u, err := url.Parse(a.Issuer)
+	if err != nil || u.Scheme != "https" || u.Hostname() == "" || u.User != nil || strings.ContainsAny(a.Issuer, "?#") || u.RawPath != "" || (u.Path != "" && path.Clean(u.Path) != u.Path) || strings.HasSuffix(a.Issuer, "/") {
+		return nil, ErrOnlineToken
+	}
+	if a.Audience == "" || a.ClientID == "" || !filepath.IsAbs(a.CAFile) || !filepath.IsAbs(a.JWKSFile) || !filepath.IsAbs(a.SecretFile) {
+		return nil, ErrOnlineToken
+	}
+	age, err := time.ParseDuration(a.MaxTokenAge)
+	if err != nil || age <= 0 || age > time.Hour {
+		return nil, ErrOnlineToken
+	}
+	return &OnlineClient{admission: a, age: age, now: time.Now}, nil
+}
+
+func readOnlineFile(path string, private bool) ([]byte, error) {
+	limit := int64(1 << 20)
+	if private {
+		limit = 16384
+	}
+	return readOnlineBoundedFile(path, private, limit)
+}
+
+func readOnlineBoundedFile(path string, private bool, limit int64) ([]byte, error) {
+	if limit <= 0 || limit > 1<<20 {
+		return nil, ErrOnlineToken
+	}
+	if !filepath.IsAbs(path) {
+		return nil, ErrOnlineToken
+	}
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, ErrOnlineToken
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0022 != 0 || (private && info.Mode().Perm()&0007 != 0) {
+		return nil, ErrOnlineToken
+	}
+	raw, err := io.ReadAll(io.LimitReader(f, limit+1))
+	if err != nil || len(raw) > int(limit) || len(raw) == 0 {
+		return nil, ErrOnlineToken
+	}
+	return raw, nil
+}
+
+func tokenDigest(raw string) string {
+	digest := sha256.Sum256([]byte(raw))
+	return "sha256:" + hex.EncodeToString(digest[:])
+}
+
+func exactUnix(value interface{}) (time.Time, bool) {
+	n, ok := value.(float64)
+	if !ok || n <= 0 || n > 9007199254740991 || math.Trunc(n) != n {
+		return time.Time{}, false
+	}
+	return time.Unix(int64(n), 0).UTC(), true
+}
+
+func (c *OnlineClient) verify(raw string, expected ExpectedIdentity, now time.Time) (CurrentToken, error) {
+	var out CurrentToken
+	if c == nil || len(raw) == 0 || len(raw) > 32768 || expected.Subject == "" || expected.Tenant == "" || (expected.PrincipalType != "human" && expected.PrincipalType != "service") {
+		return out, ErrOnlineToken
+	}
+	keysRaw, err := readOnlineFile(c.admission.JWKSFile, false)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	keys, err := jose.ParseJWKS(keysRaw)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	claims, err := jose.VerifyTyped(raw, keys, "JWT")
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	if claims["iss"] != c.admission.Issuer || claims["aud"] != c.admission.Audience || claims["sub"] != expected.Subject || claims["tenant"] != expected.Tenant || claims["principal_type"] != expected.PrincipalType {
+		return out, ErrOnlineToken
+	}
+	if azp, present := claims["azp"]; present && azp != c.admission.ClientID {
+		return out, ErrOnlineToken
+	}
+	_, scopeOK := claims["scope"].(string)
+	jti, jtiOK := claims["jti"].(string)
+	decodedID, idErr := base64.RawURLEncoding.Strict().DecodeString(jti)
+	issued, issuedOK := exactUnix(claims["iat"])
+	expires, expiresOK := exactUnix(claims["exp"])
+	if !scopeOK || !jtiOK || idErr != nil || len(decodedID) != 32 || !issuedOK || !expiresOK || issued.After(now) || !expires.After(issued) || !now.Before(expires) {
+		return out, ErrOnlineToken
+	}
+	if nbf, present := claims["nbf"]; present {
+		start, valid := exactUnix(nbf)
+		if !valid || start.After(now) {
+			return out, ErrOnlineToken
+		}
+	}
+	end := issued.Add(c.age)
+	if expires.Before(end) {
+		end = expires
+	}
+	if !now.Before(end) {
+		return out, ErrOnlineToken
+	}
+	return CurrentToken{Issuer: c.admission.Issuer, Audience: c.admission.Audience, ClientID: c.admission.ClientID,
+		Subject: expected.Subject, Tenant: expected.Tenant, PrincipalType: expected.PrincipalType,
+		TokenID: jti, TokenDigest: tokenDigest(raw), IssuedAt: issued, NotAfter: end, CheckedAt: now, claims: claims}, nil
+}
+
+type statusWire struct {
+	Active    *bool  `json:"active"`
+	ClientID  string `json:"client_id"`
+	TokenType string `json:"token_type"`
+	Issuer    string `json:"iss"`
+	Subject   string `json:"sub"`
+	Audience  string `json:"aud"`
+	Scope     string `json:"scope"`
+	IssuedAt  int64  `json:"iat"`
+	ExpiresAt int64  `json:"exp"`
+	TokenID   string `json:"jti"`
+}
+
+func decodeOnlineObject(raw []byte, out interface{}) (map[string]bool, error) {
+	d := json.NewDecoder(bytes.NewReader(raw))
+	first, err := d.Token()
+	if err != nil || first != json.Delim('{') {
+		return nil, ErrOnlineToken
+	}
+	seen := map[string]bool{}
+	for d.More() {
+		key, err := d.Token()
+		name, ok := key.(string)
+		if err != nil || !ok || seen[name] {
+			return nil, ErrOnlineToken
+		}
+		seen[name] = true
+		var value json.RawMessage
+		if d.Decode(&value) != nil || bytes.Equal(bytes.TrimSpace(value), []byte("null")) {
+			return nil, ErrOnlineToken
+		}
+	}
+	if last, err := d.Token(); err != nil || last != json.Delim('}') {
+		return nil, ErrOnlineToken
+	}
+	if _, err := d.Token(); err != io.EOF {
+		return nil, ErrOnlineToken
+	}
+	d = json.NewDecoder(bytes.NewReader(raw))
+	d.DisallowUnknownFields()
+	if d.Decode(out) != nil {
+		return nil, ErrOnlineToken
+	}
+	return seen, nil
+}
+
+func decodeOnlineStatus(raw []byte) (statusWire, error) {
+	var out statusWire
+	seen, err := decodeOnlineObject(raw, &out)
+	if err != nil || out.Active == nil || (!*out.Active && len(seen) != 1) {
+		return out, ErrOnlineToken
+	}
+	if *out.Active {
+		if len(seen) != 10 {
+			return out, ErrOnlineToken
+		}
+		for _, field := range []string{"active", "client_id", "token_type", "iss", "sub", "aud", "scope", "iat", "exp", "jti"} {
+			if !seen[field] {
+				return out, ErrOnlineToken
+			}
+		}
+	}
+	return out, nil
+}
+
+func (c *OnlineClient) request(ctx context.Context, endpoint, raw string) (statusWire, error) {
+	var out statusWire
+	if c == nil || ctx == nil || ctx.Err() != nil || len(raw) == 0 || len(raw) > 32768 || (endpoint != "/introspect" && endpoint != "/revoke") {
+		return out, ErrOnlineToken
+	}
+	ca, err := readOnlineFile(c.admission.CAFile, false)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(ca) {
+		return out, ErrOnlineToken
+	}
+	secretRaw, err := readOnlineFile(c.admission.SecretFile, true)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	secret := strings.TrimSuffix(strings.TrimSuffix(string(secretRaw), "\n"), "\r")
+	if secret == "" || strings.ContainsAny(secret, "\r\n\x00") {
+		return out, ErrOnlineToken
+	}
+	form := url.Values{"token": {raw}, "token_type_hint": {"access_token"}}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.admission.Issuer+endpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Cache-Control", "no-cache")
+	req.SetBasicAuth(url.QueryEscape(c.admission.ClientID), url.QueryEscape(secret))
+	transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext}
+	defer transport.CloseIdleConnections()
+	client := &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }}
+	response, err := client.Do(req)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK || response.Header.Get("Cache-Control") != "no-store" {
+		return out, ErrOnlineToken
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, 65537))
+	if err != nil || len(body) > 65536 {
+		return out, ErrOnlineToken
+	}
+	if endpoint == "/revoke" {
+		if len(body) != 0 {
+			return out, ErrOnlineToken
+		}
+		return out, nil
+	}
+	media, _, err := mime.ParseMediaType(response.Header.Get("Content-Type"))
+	if err != nil || media != "application/json" {
+		return out, ErrOnlineToken
+	}
+	return decodeOnlineStatus(body)
+}
+
+// Check verifies expected identity before accessing the private client credential,
+// sends a new authenticated introspection and rechecks lifetime after the network.
+func (c *OnlineClient) Check(ctx context.Context, raw string, expected ExpectedIdentity) (CurrentToken, error) {
+	if c == nil || ctx == nil || ctx.Err() != nil {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	identity, err := c.verify(raw, expected, c.now().UTC())
+	if err != nil {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	status, err := c.request(ctx, "/introspect", raw)
+	if err != nil || status.Active == nil || !*status.Active {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	expires, _ := exactUnix(identity.claims["exp"])
+	if status.ClientID != c.admission.ClientID || status.TokenType != "Bearer" || status.Issuer != identity.Issuer || status.Subject != identity.Subject || status.Audience != identity.Audience || status.TokenID != identity.TokenID || status.Scope != identity.claims["scope"] || status.IssuedAt != identity.IssuedAt.Unix() || status.ExpiresAt != expires.Unix() {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	end := c.now().UTC()
+	if end.Before(identity.CheckedAt) {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	// A slow lookup cannot retain expired facts or a withdrawn JWT trust key.
+	return c.verify(raw, expected, end)
+}
+
+// Revoke performs cleanup only for the exact opaque token. An empty 200 is not
+// proof: a separate authenticated introspection must confirm inactive-for-client.
+// The caller retains original grant ownership and uncertainty/retry duties.
+func (c *OnlineClient) Revoke(ctx context.Context, raw string) (InactiveForClient, error) {
+	if c == nil {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	if _, err := c.request(ctx, "/revoke", raw); err != nil {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	return c.ObserveInactive(ctx, raw)
+}
+
+// ObserveInactive is read-only. Unavailability or a malformed response is never
+// interpreted as revocation; the negative result remains scoped to this client.
+func (c *OnlineClient) ObserveInactive(ctx context.Context, raw string) (InactiveForClient, error) {
+	if c == nil {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	status, err := c.request(ctx, "/introspect", raw)
+	if err != nil || status.Active == nil || *status.Active {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	return InactiveForClient{Issuer: c.admission.Issuer, ClientID: c.admission.ClientID, TokenDigest: tokenDigest(raw), CheckedAt: c.now().UTC()}, nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/producer-source.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/producer-source.json
new file mode 100644
index 0000000..87a48b6
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/adapters/go/tokenstatus/producer-source.json
@@ -0,0 +1,18 @@
+{
+  "source_of_truth": "key-cape source; generated by tools/export_tokenstatus_client.py",
+  "source_files": [
+    "src/internal/authclient/online.go",
+    "src/internal/jose/jose.go",
+    "LICENSE"
+  ],
+  "transformation": "replace only the first package declaration authclient with tokenstatus; all remaining client bytes and shared JOSE bytes exact",
+  "module": "keycape",
+  "profile": "issuer online access-token status; no policy evaluator or deployment",
+  "supported_file_boundary": "Linux owner execution profile; POSIX mode checks; not a Windows ACL contract",
+  "sha256": {
+    "LICENSE": "sha256:ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6",
+    "go.mod": "sha256:e8b028e1002e63a76dba78a4abbd67882307ad198e4783bad631652061aa0f54",
+    "internal/jose/jose.go": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d",
+    "pkg/tokenstatus/client.go": "sha256:f34626a85d67590b9c61474f19ce1021f8afd17093f8f522b3f98e9cef34e575"
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/docs/current-token-client.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/docs/current-token-client.md
new file mode 100644
index 0000000..490af8a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/docs/current-token-client.md
@@ -0,0 +1,130 @@
+# Shared current-token client and private CLI observations
+
+Source preparation under proposed KEY-WP-0042 and the existing CUST-WP-0080 /
+NK48 / Apps operation and application obligations. This is a client of the
+issuer's optional online profile, not another issuer, PDP, approval service or
+application-local token registry. Native issuer/profile/consumer admission is
+still required. Actual operation/effect permission remains with existing owners.
+
+## One producer, two consumption surfaces
+
+`src/internal/authclient/online.go` is the single implementation. The existing
+KeyCape executable exposes it as `check-current-token`, `revoke-token` and
+`check-inactive-token` for owner processes. Go consumers use the generated
+`adapters/go/tokenstatus` module and import `keycape/pkg/tokenstatus` through an
+exact pinned source/dependency lock. `make tokenstatus-export` generates that
+five-file module; `make tokenstatus-check`, ordinary `make test` and the root Go
+suite refuse drift. The sole client transformation is its first package
+declaration; all remaining bytes and the shared JOSE primitive are exact.
+No policy evaluator, signing key, credential, daemon or deployment is exported.
+
+The client uses the existing producer `internal/jose` verifier. Its additive
+`VerifyTyped` path requires the actual RS256 / JWT producer header; legacy
+`Verify` callers retain their existing type policy. Keys are independently
+admitted public JWKS, never fetched from the status response or discovered by
+the token. The minimal generated module uses Go 1.23 and standard libraries.
+Its file boundary is the current **Linux owner profile**: POSIX mode checks do
+not establish Windows ACL behavior or a broader platform admission.
+
+## Current status is an authenticated fact
+
+`OnlineClient.Check(ctx, token, ExpectedIdentity{...})` validates the signature,
+issuer, exact single resource audience, subject, tenant, human/service type,
+optional authorized-party binding, access-token purpose, unique jti and integer
+issued/expiry/not-before bounds before reading the private caller credential.
+It bounds identity by expiry and an independently admitted token age (at most
+one hour), then performs a new authenticated introspection. It joins every
+returned identity/client/audience/jti/scope/time field to those signed facts.
+After network I/O it checks time again and reloads JWT trust so a delayed answer
+cannot retain expired facts or a withdrawn signing key. No positive is cached.
+
+The explicit HTTPS issuer origin supplies the exact `/introspect` and `/revoke`
+paths; redirects, query/fragment/ambiguous issuer paths, environment proxies and
+ambient transports are not used. CA, JWKS and private caller credential files
+are reread for each operation with regular-file/mode/size guards. File opens do
+not block on FIFO replacement. Private credentials can be atomically rotated
+without retaining a cached value. Requests have a five-second bound and responses
+a 64 KiB bound. Duplicate/null/missing/extra fields, mismatched facts, non-JSON or
+cacheable status responses and unavailable/unauthenticated transport refuse with
+one fixed error. Secret, token and response values are never part of errors.
+
+`CurrentToken.Claims()` returns a separate copy of verified signed facts. Those
+facts remain snapshots: original authentication time is not the current lookup
+time. Minimum assurance/authentication age, tenant provenance, current groups,
+resource/action policy, exact approval and effect authority remain the existing
+consumer profile's obligations. A fresh status response is not a new MFA act or
+permission. A Forgejo sign-in token does not grant release-write or inverse
+authority, and no operator client/route is selected by this source package.
+
+## Negative scope and cleanup
+
+`ObserveInactive` performs an independent **read-only** status lookup. It never
+infers inactivity from transport failure, malformed output or an unsuccessful
+positive check. `Revoke` sends the exact token, requires an empty successful
+response and then obtains that separate negative readback. Both return only
+`InactiveForClient`: the exact digest is currently inactive for the configured
+client. Unknown and other-client tokens have the same negative response.
+
+That result alone cannot prove original grant ownership, global revocation or a
+completed operation's cleanup. The owner retains its independently authenticated
+original issuance/current-positive evidence, exact token digest/jti and operation
+correspondence before mapping a negative observation to a parent-session receipt.
+Cleanup can continue after business-token freshness/key withdrawal; it creates
+no business authority. Unavailable/ambiguous cleanup remains unverified and
+requires the existing durable owner retry/recovery path. It is not success.
+
+## Existing CLI
+
+The public admission file contains only references and independently admitted
+bindings; for example (paths/client are placeholders, not operational defaults):
+
+```json
+{
+  "issuer": "https://owner-admitted-issuer.example",
+  "audience": "owner-admitted-resource",
+  "client_id": "owner-admitted-confidential-client",
+  "ca_file": "/run/owner-identity/issuer-ca.pem",
+  "jwks_file": "/run/owner-identity/admitted-jwks.json",
+  "secret_file": "/run/owner-identity/current-client-credential",
+  "max_token_age": "5m"
+}
+```
+
+Use an existing owner-acquired private KeyCape token JSON file, and the access
+token's exact `sha256:` digest from the owner-bound session/transaction record.
+No token or client credential goes in argv. Follow the existing Warden routing /
+owner-native acquisition and custody path; this source adds no credential lane.
+
+```text
+keycape check-current-token --admission-file /ABS/profile.json --token-file /ABS/private-token.json --token-sha256 sha256:OWNER_BOUND_DIGEST --subject OWNER_EXPECTED_SUBJECT --tenant OWNER_EXPECTED_TENANT --principal-type human --out /ABS/PRIVATE-DIR/new-observation.json
+keycape revoke-token --admission-file /ABS/profile.json --token-file /ABS/private-token.json --token-sha256 sha256:OWNER_BOUND_DIGEST --out /ABS/PRIVATE-DIR/new-cleanup-observation.json
+keycape check-inactive-token --admission-file /ABS/profile.json --token-file /ABS/private-token.json --token-sha256 sha256:OWNER_BOUND_DIGEST --out /ABS/PRIVATE-DIR/new-independent-negative.json
+```
+
+The placeholders deliberately do not form an operational command. Current checks
+require explicit expected subject/tenant/type. Negative/cleanup commands refuse
+those business-identity flags because they report only the bounded client status.
+Duplicate flags and duplicate/unknown/null input fields refuse. The token file
+must be private, the digest must match the exact parsed access token, and the new
+observation must have a 0700 parent outside Git. Outputs are exclusive 0600 files;
+failures remove only their own inode and cannot delete another attempt's replaced
+file. Standard output/errors expose fixed status, not claims or credential values.
+
+`keycape.current-token-observation.v1` is a **private, unsigned producer command
+result**, not a portable execution receipt. Current output includes bounded
+identity/token references and signed assurance/tenant-provenance facts; it omits
+bearers, credentials and group/role snapshots. Negative output states its client
+scope. The invoking owner authenticates exact binary/config/custody and binds its
+own case, acceptance, descriptor, source/target, principal, transaction and effect.
+Local file presence, digests or a successful command do not supply those grants.
+
+## Scope of verification
+
+Source checks use actual token/status handlers over isolated HTTPS, actual human
+PKCE claim construction and the same CLI implementation. The separate cross-owner
+fixture runs a built executable, generated public Go consumer and actual Warden
+Executor/SQLite in distinct Python processes. Synthetic case/catalog/owner
+attestations and a disposable file target do not establish Forgejo/browser
+acceptance, real-factor possession, production custody or approved native effects.
+The online issuer profile, owner mappings and source/package/type admission remain
+under review; all corresponding native gates stay open.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/docs/online-token-status.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/docs/online-token-status.md
new file mode 100644
index 0000000..db12b15
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/docs/online-token-status.md
@@ -0,0 +1,124 @@
+# Optional online access-token status
+
+Source proposal under KEY-WP-0042, driven by CUST-WP-0080 and existing
+NK-WP-0048-T34/T42/T43 and RAPPS-WP-0016-T08/T09. Independent issuer/consumer
+contract review and native admission remain required. Existing deployments are
+unchanged. This extends the bounded issuer; it does not introduce a broker,
+approval store, PDP, or a second application-local token registry.
+
+The legacy profile authenticates self-contained JWTs until expiry. That does
+not establish that an operation's initiating token is still unrevoked. The
+optional profile adds issuer-owned current access-token status using
+[RFC 7662](https://www.rfc-editor.org/rfc/rfc7662.html) introspection and
+[RFC 7009](https://www.rfc-editor.org/rfc/rfc7009.html) revocation. It supports
+access tokens only, without refresh tokens or token exchange.
+
+## Enablement and lifecycle
+
+Owner-admitted configuration opts in explicitly:
+
+```yaml
+tokenStatus:
+  enabled: true
+  maxEntries: 10000
+```
+
+The issuer must use HTTPS at its existing trusted ingress. The server's internal
+HTTP listener and reverse-proxy topology are unchanged; direct HTTP exposure is
+not admitted by an HTTPS issuer string. Omitted configuration keeps the existing
+expiry-only token/UserInfo contract and advertises no new endpoints. Enabling
+status registers `/introspect` and `/revoke`, advertises their implemented client
+authentication methods, and connects the same store to issuance and UserInfo.
+
+Human PKCE and service grants add a cryptographically random `jti` to each access
+token. ID-token claims and existing assurance/tenant provenance remain unchanged.
+Distinct grants in the same second have distinct bearer tokens: a new grant can
+never remint a revoked token. A successful response is emitted only after the
+token hash, expiry and current registration commitment have been recorded. No
+bearer, client secret or identity/group snapshot is retained in the status store.
+
+The store is bounded to the configured count (default 10000, maximum 1000000).
+Live records and revocation tombstones are never evicted to admit another grant;
+capacity exhaustion refuses issuance with a fixed 503. Expired entries are
+collected when admitting a new token. Capacity and per-client ingress rate limits
+need workload-representative admission: this is not a throughput/availability
+claim or protection against an authorized client filling the bound.
+
+This profile uses KeyCape's existing **single-instance topology**. Status is
+process-local. Restart, deployment, rollback or store loss makes every earlier
+token inactive at online endpoints, even if its JWT signature/expiry still
+validates offline. Consumers must reauthenticate; there is no recovery replay
+or token-state import that can resurrect revoked authority. Multiple replicas
+are unsupported. Native admission must include this interruption and the
+measured reauthentication/recovery procedure. A persisted/shared store is not
+introduced here.
+
+## Introspection and revocation
+
+Both endpoints accept POST form bodies only, bound to 64 KiB; token values are
+bound to 32 KiB. Query parameters, duplicate form or authentication fields,
+unsupported content types and malformed authentication refuse without echoing
+input. Responses use `Cache-Control: no-store` and `Pragma: no-cache`.
+
+Introspection requires the existing registered confidential client's
+`client_secret_basic` authentication. Only that client's own issued tokens can
+be inspected. A separate resource audience is returned as `aud`, not confused
+with the issuing `client_id`. Cross-client resource-server delegation needs a
+separately reviewed authorization contract and is not implicitly granted by a
+matching audience string. Public clients cannot enumerate token status.
+
+An active response means the exact access token was issued in this process,
+has not expired or been revoked, still matches its current complete registration,
+and passes current issuer/signature/purpose validation. For humans, directory
+lookup must succeed and the current account must be enabled and not suspended.
+Status is checked again after directory lookup. Service subjects remain bound
+to their current registration. Active output contains only standard access-token
+metadata; inactive output contains only `active: false`. Unknown tokens, ID
+tokens, altered tokens, another client's tokens and expired/revoked tokens all
+return that same inactive response to an authenticated introspector.
+
+Revocation authenticates confidential clients using the same method. A registered
+public client may revoke its own token using `client_id` plus possession of that
+bearer; public-client introspection remains unavailable. Revocation only affects
+the exact token issued to that client. Unknown, other-client, expired and already
+revoked tokens all produce the same empty 200. No token existence is disclosed.
+Token-type hints do not bypass the actual access-token lookup. Removal or changes
+to a registration invalidate online status; the commitment explicitly includes
+the secret digest and internal token lifetime omitted from public Client JSON.
+
+When enabled, actual UserInfo consults the same store before lookup and again
+after it. Revocation therefore affects that existing endpoint immediately on its
+next check. Ordinary login/logout and upstream Authelia sessions are distinct:
+neither browser logout nor deleting a local cookie is represented as global
+JWT revocation.
+
+## Consumer contract and remaining acceptance
+
+Online status establishes current access-token status, not permission
+for an application resource or privileged effect. Consumers still independently
+validate the actual signed token, admitted issuer/key/audience/type, subject,
+tenant, principal type, assurance and freshness. The authenticated introspection
+response must refer to that exact token/client. Obtain a new current response
+before each protected operation; unavailable, malformed, inactive or ambiguous
+responses refuse. A cached positive is not a current-session check.
+
+Access Engine retains resource/action decisions, Approval Engine exact one-shot
+approval, Warden admission and owner adapters execution. Bind their existing
+descriptor, case, transaction and exact effect before dispatch. A separate new
+operation/inverse token must be acquired and revoked on every terminal path;
+renewed authentication cannot revive a consumed approval or replay a mutation.
+This issuer capability alone implements none of those consumer bindings.
+
+The producer-owned [current-token client](current-token-client.md) supplies the
+shared Go/CLI transport and cryptographic/status join. Its private observations
+retain this distinction: an inactive-for-client result is not an original
+ownership or execution receipt. Native client/profile adoption remains open.
+
+Native completion still requires independent issuer/profile review, exact
+image/config/trust admission, bounded retained-token custody, real human/service
+issuance, private transport, current-token/revocation integration in each owner,
+all exit-path cleanup, restart/expiry/unavailable/refusal checks, ongoing
+HTTP/API/Git/SSH authorization and audit evidence. Offline consumers which never
+consult the endpoint retain their existing JWT validity; no estate-wide immediate
+revocation claim follows from source implementation. Disabling the feature is
+not an acceptable fallback for a consumer admitted under the online profile.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/cmd/keycape/main.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/cmd/keycape/main.go
new file mode 100644
index 0000000..818b239
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/cmd/keycape/main.go
@@ -0,0 +1,488 @@
+// keycape is the main server binary for the KeyCape IAM profile service.
+// It orchestrates Authelia, LLDAP, and privacyIDEA to implement the
+// NetKingdom IAM Profile (OIDC/PKCE Authorization Code Flow).
+package main
+
+import (
+	"context"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"flag"
+	"fmt"
+	"keycape/internal/server/readiness"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"keycape/internal/adapters/authelia"
+	"keycape/internal/adapters/lldap"
+	"keycape/internal/adapters/privacyidea"
+	"keycape/internal/adapters/tenantengine"
+	"keycape/internal/authclient"
+	"keycape/internal/config"
+	"keycape/internal/domain"
+	servererrors "keycape/internal/server/errors"
+	"keycape/internal/server/oidc"
+	"keycape/internal/server/policy"
+	"keycape/internal/server/telemetry"
+)
+
+const version = "0.1.0"
+
+func main() {
+	if len(os.Args) > 1 && os.Args[1] == "check-config" {
+		os.Exit(runCheckConfig(os.Args[2:], os.Stdout))
+	}
+
+	if len(os.Args) > 1 && os.Args[1] == "probe-upstream-issuer" {
+		if err := authelia.RunIssuerProbe(context.Background(), os.Args[2:], os.Stdout); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		return
+	}
+
+	if len(os.Args) > 1 && (os.Args[1] == "login" || os.Args[1] == "service-token" || os.Args[1] == "verify-client" || os.Args[1] == "check-current-token" || os.Args[1] == "revoke-token" || os.Args[1] == "check-inactive-token") {
+		if err := authclient.Run(context.Background(), os.Args[1:], os.Stderr); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		return
+	}
+
+	log := zerolog.New(os.Stdout).With().Timestamp().Logger()
+
+	// -----------------------------------------------------------------
+	// 1. Parse flags and load config.
+	// -----------------------------------------------------------------
+	var cfgPath string
+	flag.StringVar(&cfgPath, "config", "", "path to YAML config file (env: KEYCAPE_CONFIG)")
+	flag.Parse()
+
+	cfg, err := config.Load(cfgPath)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to load config")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 2. Validate config.
+	// -----------------------------------------------------------------
+	errs := config.ValidateConfig(cfg)
+	if len(errs) > 0 {
+		log.Error().Strs("errors", errs).Msg("config validation failed")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 3. Load RSA private key.
+	// -----------------------------------------------------------------
+	privateKey, err := loadPrivateKey(cfg.PrivateKeyPEM)
+	if err != nil {
+		log.Error().Err(err).Str("path", cfg.PrivateKeyPEM).Msg("failed to load private key")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 4. Build JWKS from public key.
+	// -----------------------------------------------------------------
+	ks := oidc.NewKeySet()
+	ks.AddKey("key-1", &privateKey.PublicKey)
+
+	// -----------------------------------------------------------------
+	// 5. Build client registry.
+	// -----------------------------------------------------------------
+	clients, err := buildClientRegistry(cfg.Clients)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to build client registry")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 6. Create adapters.
+	// -----------------------------------------------------------------
+	lldapAdapter := lldap.New(cfg.LLDAP)
+	autheliaAdapter := authelia.New(cfg.Authelia, nil)
+	privacyIDEAAdapter := privacyidea.New(cfg.PrivacyIDEA, nil)
+
+	// -----------------------------------------------------------------
+	// 7. Create telemetry emitter.
+	// -----------------------------------------------------------------
+	emitter := telemetry.NewLogEmitter(log)
+
+	// -----------------------------------------------------------------
+	// 8. Create enforcement registry.
+	// -----------------------------------------------------------------
+	enforcement := servererrors.DefaultRegistry()
+
+	// -----------------------------------------------------------------
+	// 9. Create session store.
+	// -----------------------------------------------------------------
+	sessions := oidc.NewSessionStore()
+
+	// -----------------------------------------------------------------
+	// 10. Parse token lifetime.
+	// -----------------------------------------------------------------
+	tokenLifetime := 15 * time.Minute
+	if cfg.TokenLifetime != "" {
+		d, err := time.ParseDuration(cfg.TokenLifetime)
+		if err != nil {
+			log.Error().Err(err).Str("tokenLifetime", cfg.TokenLifetime).Msg("invalid tokenLifetime")
+			os.Exit(1)
+		}
+		tokenLifetime = d
+	}
+
+	// -----------------------------------------------------------------
+	// 11. Build issuer base URL.
+	// -----------------------------------------------------------------
+	issuer := strings.TrimRight(cfg.Issuer, "/")
+
+	// -----------------------------------------------------------------
+	// 12. Register HTTP handlers.
+	// -----------------------------------------------------------------
+	mux := http.NewServeMux()
+	var tokenStatus *oidc.TokenStatusStore
+	var introspectionEndpoint, revocationEndpoint string
+	if cfg.TokenStatus.Enabled {
+		limit := cfg.TokenStatus.MaxEntries
+		if limit == 0 {
+			limit = 10000
+		}
+		var err error
+		tokenStatus, err = oidc.NewTokenStatusStore(limit)
+		if err != nil {
+			log.Error().Msg("invalid token-status configuration")
+			os.Exit(1)
+		}
+		status := &oidc.TokenStatusHandler{Tokens: tokenStatus, ClientConfig: clients, Users: lldapAdapter, SigningKey: &privateKey.PublicKey, Issuer: issuer}
+		mux.HandleFunc("/introspect", status.Introspect)
+		mux.HandleFunc("/revoke", status.Revoke)
+		introspectionEndpoint, revocationEndpoint = issuer+"/introspect", issuer+"/revoke"
+	}
+
+	// Discovery.
+	mux.Handle("/.well-known/openid-configuration", oidc.NewDiscoveryHandler(oidc.DiscoveryConfig{
+		Issuer:                issuer,
+		AuthorizationEndpoint: issuer + "/authorize",
+		TokenEndpoint:         issuer + "/token",
+		JWKSUri:               issuer + "/jwks",
+		UserinfoEndpoint:      issuer + "/userinfo",
+		EndSessionEndpoint:    issuer + "/logout",
+		IntrospectionEndpoint: introspectionEndpoint,
+		RevocationEndpoint:    revocationEndpoint,
+		Clients:               clients,
+	}))
+
+	// JWKS.
+	mux.Handle("/jwks", oidc.NewJWKSHandler(ks))
+
+	// Authorize handler (with enforcement middleware).
+	logins := oidc.NewLoginSessionStore()
+	authorizeHandler := &oidc.AuthorizeHandler{
+		AccountPortalURL: cfg.AccountPortalURL,
+		ClientConfig:     clients,
+		Auth:             autheliaAdapter,
+		MFA:              privacyIDEAAdapter,
+		Sessions:         sessions,
+		Logins:           logins,
+		Handoffs:         oidc.NewHandoffStore(),
+		Issuer:           issuer,
+		Emitter:          emitter,
+		Users:            lldapAdapter,
+	}
+	if path := os.Getenv("KEYCAPE_POLICY_PATH"); path != "" {
+		policies, err := policy.Open(path, clients)
+		if err != nil {
+			log.Error().Msg("authentication policy store unavailable")
+			os.Exit(1)
+		}
+		authorizeHandler.EffectivePolicy = policies.Effective
+		mux.Handle("/platform/authentication-policy", policy.Handler(policies, issuer, &privateKey.PublicKey))
+	}
+	mux.Handle("/authorize", enforcement.Middleware(authorizeHandler))
+	mux.Handle("/authorize/callback", authorizeHandler)
+	mux.Handle("/authorize/return", authorizeHandler)
+	mux.Handle("/authorize/register", authorizeHandler)
+	mux.Handle("/logout", &oidc.LogoutHandler{
+		ClientConfig: clients,
+		Logins:       logins,
+		SecureCookie: strings.HasPrefix(strings.ToLower(issuer), "https://"),
+	})
+
+	if cfg.AccountPortalURL != "" {
+		mux.Handle("/account/logout", &oidc.AccountLogoutHandler{
+			PortalURL: cfg.AccountPortalURL, UpstreamLogoutURL: cfg.BrowserLogoutURL,
+			Logins: logins, Issuer: issuer,
+		})
+	}
+
+	// Token handler (with enforcement middleware).
+	tokenHandler := &oidc.TokenHandler{
+		ClientConfig:  clients,
+		Sessions:      sessions,
+		Users:         lldapAdapter,
+		SigningKey:    privateKey,
+		Issuer:        issuer,
+		TokenLifetime: tokenLifetime,
+		Emitter:       emitter,
+		// Opt-in: nil unless tenantEngine.baseURL is configured, which is what
+		// leaves tenant_roles off the stock server (KEY-WP-0024). The adapter
+		// fails open, so a configured-but-unreachable cache omits the claim
+		// rather than failing issuance.
+		TenantEngine: buildTenantEngine(cfg.TenantEngine),
+		Tokens:       tokenStatus,
+	}
+	mux.Handle("/token", enforcement.Middleware(tokenHandler))
+
+	// Userinfo handler.
+	mux.Handle("/userinfo", &oidc.UserinfoHandler{
+		Users:        lldapAdapter,
+		SigningKey:   &privateKey.PublicKey,
+		Issuer:       issuer,
+		Emitter:      emitter,
+		Tokens:       tokenStatus,
+		ClientConfig: clients,
+	})
+
+	// Healthz.
+	// /readyz gates traffic on the dependencies a login needs; /healthz stays a
+	// liveness signal (KEY-WP-0025). Restarting KeyCape because LLDAP blinked
+	// would convert a dependency blip into an outage of our own, so the two must
+	// not be the same endpoint.
+	mux.Handle("/readyz", readiness.New(2*time.Second, 3*time.Second,
+		readiness.Check{Name: "lldap", Probe: func(ctx context.Context) error {
+			return lldapAdapter.Ping(ctx)
+		}},
+		readiness.Check{Name: "authelia", Probe: httpReachable(cfg.Authelia.TokenBaseURL, cfg.Authelia.BaseURL)},
+		readiness.Check{Name: "privacyidea", Probe: httpReachable(cfg.PrivacyIDEA.BaseURL)},
+		readiness.Check{Name: "factor_reader", Probe: privacyIDEAAdapter.Probe},
+	))
+
+	// Liveness only: this says the process is up, and deliberately probes
+	// nothing. See /readyz.
+	mux.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(map[string]string{
+			"status":  "ok",
+			"version": version,
+		})
+	})
+
+	// Inject emitter into request context.
+	handler := withEmitter(mux, emitter)
+
+	// -----------------------------------------------------------------
+	// 13. Start HTTP server.
+	// -----------------------------------------------------------------
+	addr := fmt.Sprintf(":%d", cfg.Port)
+	if cfg.Port == 0 {
+		addr = ":8080"
+	}
+
+	log.Info().
+		Str("issuer", issuer).
+		Str("addr", addr).
+		Str("environment", cfg.Environment).
+		Str("version", version).
+		Msg("starting keycape server")
+
+	srv := &http.Server{
+		Addr:         addr,
+		Handler:      handler,
+		ReadTimeout:  30 * time.Second,
+		WriteTimeout: 30 * time.Second,
+		IdleTimeout:  120 * time.Second,
+	}
+
+	// Serve in the background so shutdown can be driven by a signal. Without
+	// this the process died on SIGTERM mid-request, so every rolling restart
+	// returned errors to whoever was logging in at that moment.
+	serveErr := make(chan error, 1)
+	go func() {
+		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			serveErr <- err
+			return
+		}
+		serveErr <- nil
+	}()
+
+	signals := make(chan os.Signal, 1)
+	signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
+
+	select {
+	case err := <-serveErr:
+		if err != nil {
+			log.Error().Err(err).Msg("server error")
+			os.Exit(1)
+		}
+	case sig := <-signals:
+		log.Info().Str("signal", sig.String()).Msg("shutting down")
+		// In-flight requests get a bounded window to finish. In-memory login and
+		// authorization state does not survive this and is not meant to: a
+		// browser mid-login must start again after a restart. That is a
+		// documented limit of the single-replica topology, not a bug to paper
+		// over here -- see docs/operations.md.
+		ctx, cancel := context.WithTimeout(context.Background(), shutdownGrace)
+		defer cancel()
+		if err := srv.Shutdown(ctx); err != nil {
+			log.Error().Err(err).Msg("graceful shutdown failed; exiting anyway")
+			os.Exit(1)
+		}
+		log.Info().Msg("shutdown complete")
+	}
+}
+
+// shutdownGrace bounds how long in-flight requests may finish after a signal.
+// Kept under the 30s read/write timeouts so a stuck request cannot outlive the
+// window an orchestrator typically allows before sending SIGKILL.
+const shutdownGrace = 15 * time.Second
+
+// httpReachable probes the first non-empty URL with a GET, reporting whether the
+// dependency answered at all. It is a reachability check, not a functional one:
+// any HTTP response means something is listening and speaking HTTP there.
+func httpReachable(candidates ...string) func(context.Context) error {
+	target := ""
+	for _, candidate := range candidates {
+		if candidate != "" {
+			target = candidate
+			break
+		}
+	}
+	return func(ctx context.Context) error {
+		if target == "" {
+			return fmt.Errorf("no endpoint configured")
+		}
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, target, nil)
+		if err != nil {
+			return err
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		return nil
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+// loadPrivateKey reads a PEM file and parses the RSA private key.
+// Supports both PKCS#1 ("RSA PRIVATE KEY") and PKCS#8 ("PRIVATE KEY") PEM blocks.
+func loadPrivateKey(path string) (*rsa.PrivateKey, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read key file: %w", err)
+	}
+
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, fmt.Errorf("no PEM block found in %q", path)
+	}
+
+	switch block.Type {
+	case "RSA PRIVATE KEY":
+		key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("parse PKCS1 private key: %w", err)
+		}
+		return key, nil
+	case "PRIVATE KEY":
+		key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("parse PKCS8 private key: %w", err)
+		}
+		rsaKey, ok := key.(*rsa.PrivateKey)
+		if !ok {
+			return nil, fmt.Errorf("private key is not an RSA key")
+		}
+		return rsaKey, nil
+	default:
+		return nil, fmt.Errorf("unexpected PEM block type %q; expected RSA PRIVATE KEY or PRIVATE KEY", block.Type)
+	}
+}
+
+// buildClientRegistry converts []ClientConfig into the map used by handlers.
+func buildClientRegistry(cfgClients []config.ClientConfig) (map[string]*domain.Client, error) {
+	return buildClientRegistryWith(cfgClients, os.Getenv)
+}
+
+// buildClientRegistryWith resolves env: secretRefs through getenv, so
+// check-config can build the registry without any secret value.
+func buildClientRegistryWith(cfgClients []config.ClientConfig, getenv func(string) string) (map[string]*domain.Client, error) {
+	m := make(map[string]*domain.Client, len(cfgClients))
+	for i := range cfgClients {
+		c := &cfgClients[i]
+		clientSecret := ""
+		var clientTokenLifetime time.Duration
+		if strings.HasPrefix(c.SecretRef, "env:") {
+			envName := strings.TrimPrefix(c.SecretRef, "env:")
+			clientSecret = getenv(envName)
+			if clientSecret == "" {
+				return nil, fmt.Errorf("client %q secret environment variable %q is empty", c.ClientID, envName)
+			}
+		}
+		if c.TokenLifetime != "" {
+			parsedLifetime, parseErr := time.ParseDuration(c.TokenLifetime)
+			if parseErr != nil {
+				return nil, fmt.Errorf("client %q tokenLifetime is invalid: %w", c.ClientID, parseErr)
+			}
+			clientTokenLifetime = parsedLifetime
+		}
+		m[c.ClientID] = &domain.Client{
+			ClientID:        c.ClientID,
+			DisplayName:     c.DisplayName,
+			RedirectURIs:    c.RedirectURIs,
+			AllowedScopes:   c.AllowedScopes,
+			GrantTypes:      c.GrantTypes,
+			ClientType:      c.ClientType,
+			SecretRef:       c.SecretRef,
+			ClientSecret:    clientSecret,
+			Audience:        c.Audience,
+			ServiceSubject:  c.ServiceSubject,
+			Tenant:          c.Tenant,
+			Roles:           c.Roles,
+			TokenLifetime:   clientTokenLifetime,
+			MFARequired:     c.MFARequired,
+			MFAOptional:     c.MFAOptional,
+			RegistrationURL: c.RegistrationURL,
+			EnrollmentURL:   c.EnrollmentURL,
+			SignInDiagnosis: c.SignInDiagnosis,
+		}
+	}
+	return m, nil
+}
+
+// withEmitter wraps a handler to inject the telemetry emitter into every request context.
+func withEmitter(next http.Handler, e telemetry.Emitter) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := telemetry.WithEmitter(context.Background(), e)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// buildTenantEngine returns the tenant_roles cache client, or nil when the
+// claim is not configured. Validation has already accepted the URL and timeout.
+func buildTenantEngine(cfg config.TenantEngineConfig) *tenantengine.Client {
+	if cfg.BaseURL == "" {
+		return nil
+	}
+	var httpClient *http.Client
+	if cfg.Timeout != "" {
+		if timeout, err := time.ParseDuration(cfg.Timeout); err == nil {
+			httpClient = &http.Client{Timeout: timeout}
+		}
+	}
+	return tenantengine.New(cfg.BaseURL, httpClient)
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/cli.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/cli.go
new file mode 100644
index 0000000..57f0acc
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/cli.go
@@ -0,0 +1,233 @@
+package authclient
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// Run executes a caller command. Output contains only instructions or status.
+func Run(ctx context.Context, args []string, stderr io.Writer) error {
+	if len(args) == 0 {
+		return errors.New("expected login, service-token or verify-client")
+	}
+	mode := args[0]
+	if mode == "check-current-token" || mode == "revoke-token" || mode == "check-inactive-token" {
+		return runOnline(ctx, mode, args[1:], stderr)
+	}
+	if mode == "verify-client" {
+		return verifyClient(ctx, args[1:], stderr)
+	}
+	if mode != "login" && mode != "service-token" {
+		return errors.New("unknown authentication command")
+	}
+	fs := flag.NewFlagSet(mode, flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	issuer := fs.String("issuer", "", "HTTPS issuer")
+	id := fs.String("client-id", "", "registered client ID")
+	audience := fs.String("audience", "", "expected access audience (defaults to client ID)")
+	scope := fs.String("scope", "", "space-separated registered scopes")
+	secretEnv := fs.String("secret-env", "", "environment variable containing service client secret")
+	out := fs.String("out", "", "new private JSON token file outside Git")
+	redirect := fs.String("redirect-uri", "", "exact registered HTTP loopback callback (login only)")
+	if err := fs.Parse(args[1:]); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 || *id == "" || *out == "" || strings.TrimSpace(*scope) == "" {
+		return errors.New("client-id, scope and out are required; positional arguments are not accepted")
+	}
+	if *audience == "" {
+		*audience = *id
+	}
+	if mode == "login" && (*secretEnv != "" || !hasScope(*scope, "openid")) {
+		return errors.New("login requires openid scope and a public PKCE client")
+	}
+	if mode == "service-token" && (*secretEnv == "" || *redirect != "") {
+		return errors.New("service-token requires secret-env and does not accept redirect-uri")
+	}
+	c, err := New(*issuer)
+	if err != nil {
+		return err
+	}
+	file, err := reserveOutput(*out)
+	if err != nil {
+		return err
+	}
+	success := false
+	defer func() {
+		file.Close()
+		if !success {
+			os.Remove(file.Name())
+		}
+	}()
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Minute)
+	defer cancel()
+	d, err := c.Discover(ctx)
+	if err != nil {
+		return err
+	}
+	var tokens Tokens
+	if mode == "service-token" {
+		secret := os.Getenv(*secretEnv)
+		if secret == "" {
+			return errors.New("client secret environment variable is empty")
+		}
+		tokens, err = c.Exchange(ctx, d, url.Values{"grant_type": {"client_credentials"}, "scope": {*scope}}, *id, secret, *audience, "")
+	} else {
+		tokens, err = c.Login(ctx, d, *id, *audience, *scope, *redirect, stderr)
+	}
+	if err != nil {
+		return err
+	}
+	if err = json.NewEncoder(file).Encode(tokens); err != nil {
+		return errors.New("could not write token file")
+	}
+	if err = file.Sync(); err != nil {
+		return errors.New("could not sync token file")
+	}
+	if err = file.Close(); err != nil {
+		return errors.New("could not close token file")
+	}
+	success = true
+	fmt.Fprintln(stderr, "Verified tokens saved to the requested private file.")
+	return nil
+}
+
+func reserveOutput(path string) (*os.File, error) {
+	absolute, err := filepath.Abs(path)
+	if err != nil {
+		return nil, errors.New("invalid output path")
+	}
+	parent, err := filepath.EvalSymlinks(filepath.Dir(absolute))
+	if err != nil {
+		return nil, errors.New("output directory must already exist")
+	}
+	for dir := parent; ; dir = filepath.Dir(dir) {
+		marker := filepath.Join(dir, ".git")
+		info, statErr := os.Lstat(marker)
+		if statErr == nil {
+			// A worktree uses a .git file; normal repositories have .git/HEAD.
+			// An empty directory alone is not a Git repository.
+			if !info.IsDir() {
+				return nil, errors.New("token output must be outside Git worktrees")
+			}
+			if _, err := os.Lstat(filepath.Join(marker, "HEAD")); err == nil {
+				return nil, errors.New("token output must be outside Git worktrees")
+			} else if !os.IsNotExist(err) {
+				return nil, errors.New("could not inspect Git directory")
+			}
+		} else if !os.IsNotExist(statErr) {
+			return nil, errors.New("could not inspect output directory")
+		}
+		if filepath.Dir(dir) == dir {
+			break
+		}
+	}
+	file, err := os.OpenFile(filepath.Join(parent, filepath.Base(absolute)), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	if err != nil {
+		return nil, errors.New("output file must be new and writable")
+	}
+	return file, nil
+}
+
+// Login binds the exact registered IPv4/IPv6 loopback address before offering
+// the browser URL. State, nonce and PKCE are independently generated per attempt.
+func (c *Client) Login(ctx context.Context, d Discovery, id, audience, scope, redirect string, output io.Writer) (Tokens, error) {
+	callback, err := url.Parse(redirect)
+	if err != nil || callback.Scheme != "http" || callback.User != nil || callback.RawQuery != "" || callback.Fragment != "" || callback.Port() == "" || callback.Port() == "0" || callback.Path == "" {
+		return Tokens{}, errors.New("redirect-uri must be an exact HTTP loopback URL with a fixed port and path")
+	}
+	ip := net.ParseIP(callback.Hostname())
+	if ip == nil || !ip.IsLoopback() {
+		return Tokens{}, errors.New("callback must use a literal loopback IP address")
+	}
+	listener, err := net.Listen("tcp", callback.Host)
+	if err != nil {
+		return Tokens{}, errors.New("could not bind registered callback")
+	}
+	defer listener.Close()
+	state, err := randomValue()
+	if err != nil {
+		return Tokens{}, err
+	}
+	nonce, err := randomValue()
+	if err != nil {
+		return Tokens{}, err
+	}
+	verifier, err := randomValue()
+	if err != nil {
+		return Tokens{}, err
+	}
+	challenge := sha256.Sum256([]byte(verifier))
+	type callbackResult struct {
+		code string
+		err  error
+	}
+	result := make(chan callbackResult, 1)
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		if r.Method != http.MethodGet || r.URL.Path != callback.Path || r.Host != callback.Host {
+			http.Error(w, "Invalid callback", 400)
+			return
+		}
+		q, err := url.ParseQuery(r.URL.RawQuery)
+		if err != nil || len(q["state"]) != 1 || subtle.ConstantTimeCompare([]byte(q.Get("state")), []byte(state)) != 1 {
+			http.Error(w, "Invalid callback state", 400)
+			return
+		}
+		var value callbackResult
+		if q.Get("error") != "" {
+			value.err = errors.New("login was declined by the identity provider")
+		} else if len(q["code"]) != 1 || q.Get("code") == "" {
+			http.Error(w, "Missing authorization code", 400)
+			return
+		} else {
+			value.code = q.Get("code")
+		}
+		select {
+		case result <- value:
+			fmt.Fprintln(w, "Callback received. Return to the terminal.")
+		default:
+			http.Error(w, "Callback already received", 409)
+		}
+	})
+	server := &http.Server{Handler: handler, ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second, MaxHeaderBytes: 16384}
+	defer server.Close()
+	serveErrors := make(chan error, 1)
+	go func() { serveErrors <- server.Serve(listener) }()
+	authorize, err := url.Parse(d.Authorization)
+	if err != nil {
+		return Tokens{}, errors.New("invalid authorization endpoint")
+	}
+	q := authorize.Query()
+	for name, value := range map[string]string{"client_id": id, "redirect_uri": redirect, "response_type": "code", "scope": scope, "state": state, "nonce": nonce, "code_challenge": base64.RawURLEncoding.EncodeToString(challenge[:]), "code_challenge_method": "S256"} {
+		q.Set(name, value)
+	}
+	authorize.RawQuery = q.Encode()
+	fmt.Fprintf(output, "Open this URL in your browser to authenticate and complete MFA:\n%s\n", authorize.String())
+	select {
+	case <-ctx.Done():
+		return Tokens{}, errors.New("login timed out or was cancelled")
+	case <-serveErrors:
+		return Tokens{}, errors.New("callback listener stopped")
+	case value := <-result:
+		if value.err != nil {
+			return Tokens{}, value.err
+		}
+		return c.Exchange(ctx, d, url.Values{"grant_type": {"authorization_code"}, "client_id": {id}, "code": {value.code}, "code_verifier": {verifier}, "redirect_uri": {redirect}, "scope": {scope}}, id, "", audience, nonce)
+	}
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online.go
new file mode 100644
index 0000000..b845c0f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online.go
@@ -0,0 +1,379 @@
+package authclient
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"math"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"keycape/internal/jose"
+)
+
+var ErrOnlineToken = errors.New("current authenticated token refused")
+
+// OnlineAdmission is independently admitted owner configuration. The public
+// JWKS/CA and private client credential files are reread for every request.
+// It selects the owning confidential client, not a resource-server delegation.
+type OnlineAdmission struct {
+	Issuer      string `json:"issuer"`
+	Audience    string `json:"audience"`
+	ClientID    string `json:"client_id"`
+	CAFile      string `json:"ca_file"`
+	JWKSFile    string `json:"jwks_file"`
+	SecretFile  string `json:"secret_file"`
+	MaxTokenAge string `json:"max_token_age"`
+}
+
+type ExpectedIdentity struct {
+	Subject       string
+	Tenant        string
+	PrincipalType string
+}
+
+// CurrentToken contains signed identity facts joined to a current issuer
+// observation. It is never a permission, approval or portable execution receipt.
+type CurrentToken struct {
+	Issuer        string    `json:"issuer"`
+	Audience      string    `json:"audience"`
+	ClientID      string    `json:"client_id"`
+	Subject       string    `json:"subject"`
+	Tenant        string    `json:"tenant"`
+	PrincipalType string    `json:"principal_type"`
+	TokenID       string    `json:"jti"`
+	TokenDigest   string    `json:"token_sha256"`
+	IssuedAt      time.Time `json:"issued_at"`
+	NotAfter      time.Time `json:"not_after"`
+	CheckedAt     time.Time `json:"checked_at"`
+	claims        map[string]interface{}
+}
+
+// Claims returns a separate copy of the verified signed facts. Authentication
+// assurance/age, tenant provenance, current groups and resource/effect policy
+// remain the consumer's existing profile obligations, not a new client policy.
+func (t CurrentToken) Claims() map[string]interface{} {
+	if t.claims == nil {
+		return nil
+	}
+	raw, _ := json.Marshal(t.claims)
+	var out map[string]interface{}
+	_ = json.Unmarshal(raw, &out)
+	return out
+}
+
+// InactiveForClient proves only the issuer's current negative response for the
+// named client/token digest. An unknown/other-client token gives the same result;
+// original grant ownership is separately required before asserting cleanup.
+type InactiveForClient struct {
+	Issuer      string    `json:"issuer"`
+	ClientID    string    `json:"client_id"`
+	TokenDigest string    `json:"token_sha256"`
+	CheckedAt   time.Time `json:"checked_at"`
+}
+
+type OnlineClient struct {
+	admission OnlineAdmission
+	age       time.Duration
+	now       func() time.Time
+	// Nil uses the normal resolver/dialer. Tests route a certified DNS name to
+	// isolated loopback; the TLS name/CA and JWT trust checks remain unchanged.
+	dialContext func(context.Context, string, string) (net.Conn, error)
+}
+
+func NewOnlineClient(a OnlineAdmission) (*OnlineClient, error) {
+	u, err := url.Parse(a.Issuer)
+	if err != nil || u.Scheme != "https" || u.Hostname() == "" || u.User != nil || strings.ContainsAny(a.Issuer, "?#") || u.RawPath != "" || (u.Path != "" && path.Clean(u.Path) != u.Path) || strings.HasSuffix(a.Issuer, "/") {
+		return nil, ErrOnlineToken
+	}
+	if a.Audience == "" || a.ClientID == "" || !filepath.IsAbs(a.CAFile) || !filepath.IsAbs(a.JWKSFile) || !filepath.IsAbs(a.SecretFile) {
+		return nil, ErrOnlineToken
+	}
+	age, err := time.ParseDuration(a.MaxTokenAge)
+	if err != nil || age <= 0 || age > time.Hour {
+		return nil, ErrOnlineToken
+	}
+	return &OnlineClient{admission: a, age: age, now: time.Now}, nil
+}
+
+func readOnlineFile(path string, private bool) ([]byte, error) {
+	limit := int64(1 << 20)
+	if private {
+		limit = 16384
+	}
+	return readOnlineBoundedFile(path, private, limit)
+}
+
+func readOnlineBoundedFile(path string, private bool, limit int64) ([]byte, error) {
+	if limit <= 0 || limit > 1<<20 {
+		return nil, ErrOnlineToken
+	}
+	if !filepath.IsAbs(path) {
+		return nil, ErrOnlineToken
+	}
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, ErrOnlineToken
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0022 != 0 || (private && info.Mode().Perm()&0007 != 0) {
+		return nil, ErrOnlineToken
+	}
+	raw, err := io.ReadAll(io.LimitReader(f, limit+1))
+	if err != nil || len(raw) > int(limit) || len(raw) == 0 {
+		return nil, ErrOnlineToken
+	}
+	return raw, nil
+}
+
+func tokenDigest(raw string) string {
+	digest := sha256.Sum256([]byte(raw))
+	return "sha256:" + hex.EncodeToString(digest[:])
+}
+
+func exactUnix(value interface{}) (time.Time, bool) {
+	n, ok := value.(float64)
+	if !ok || n <= 0 || n > 9007199254740991 || math.Trunc(n) != n {
+		return time.Time{}, false
+	}
+	return time.Unix(int64(n), 0).UTC(), true
+}
+
+func (c *OnlineClient) verify(raw string, expected ExpectedIdentity, now time.Time) (CurrentToken, error) {
+	var out CurrentToken
+	if c == nil || len(raw) == 0 || len(raw) > 32768 || expected.Subject == "" || expected.Tenant == "" || (expected.PrincipalType != "human" && expected.PrincipalType != "service") {
+		return out, ErrOnlineToken
+	}
+	keysRaw, err := readOnlineFile(c.admission.JWKSFile, false)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	keys, err := jose.ParseJWKS(keysRaw)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	claims, err := jose.VerifyTyped(raw, keys, "JWT")
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	if claims["iss"] != c.admission.Issuer || claims["aud"] != c.admission.Audience || claims["sub"] != expected.Subject || claims["tenant"] != expected.Tenant || claims["principal_type"] != expected.PrincipalType {
+		return out, ErrOnlineToken
+	}
+	if azp, present := claims["azp"]; present && azp != c.admission.ClientID {
+		return out, ErrOnlineToken
+	}
+	_, scopeOK := claims["scope"].(string)
+	jti, jtiOK := claims["jti"].(string)
+	decodedID, idErr := base64.RawURLEncoding.Strict().DecodeString(jti)
+	issued, issuedOK := exactUnix(claims["iat"])
+	expires, expiresOK := exactUnix(claims["exp"])
+	if !scopeOK || !jtiOK || idErr != nil || len(decodedID) != 32 || !issuedOK || !expiresOK || issued.After(now) || !expires.After(issued) || !now.Before(expires) {
+		return out, ErrOnlineToken
+	}
+	if nbf, present := claims["nbf"]; present {
+		start, valid := exactUnix(nbf)
+		if !valid || start.After(now) {
+			return out, ErrOnlineToken
+		}
+	}
+	end := issued.Add(c.age)
+	if expires.Before(end) {
+		end = expires
+	}
+	if !now.Before(end) {
+		return out, ErrOnlineToken
+	}
+	return CurrentToken{Issuer: c.admission.Issuer, Audience: c.admission.Audience, ClientID: c.admission.ClientID,
+		Subject: expected.Subject, Tenant: expected.Tenant, PrincipalType: expected.PrincipalType,
+		TokenID: jti, TokenDigest: tokenDigest(raw), IssuedAt: issued, NotAfter: end, CheckedAt: now, claims: claims}, nil
+}
+
+type statusWire struct {
+	Active    *bool  `json:"active"`
+	ClientID  string `json:"client_id"`
+	TokenType string `json:"token_type"`
+	Issuer    string `json:"iss"`
+	Subject   string `json:"sub"`
+	Audience  string `json:"aud"`
+	Scope     string `json:"scope"`
+	IssuedAt  int64  `json:"iat"`
+	ExpiresAt int64  `json:"exp"`
+	TokenID   string `json:"jti"`
+}
+
+func decodeOnlineObject(raw []byte, out interface{}) (map[string]bool, error) {
+	d := json.NewDecoder(bytes.NewReader(raw))
+	first, err := d.Token()
+	if err != nil || first != json.Delim('{') {
+		return nil, ErrOnlineToken
+	}
+	seen := map[string]bool{}
+	for d.More() {
+		key, err := d.Token()
+		name, ok := key.(string)
+		if err != nil || !ok || seen[name] {
+			return nil, ErrOnlineToken
+		}
+		seen[name] = true
+		var value json.RawMessage
+		if d.Decode(&value) != nil || bytes.Equal(bytes.TrimSpace(value), []byte("null")) {
+			return nil, ErrOnlineToken
+		}
+	}
+	if last, err := d.Token(); err != nil || last != json.Delim('}') {
+		return nil, ErrOnlineToken
+	}
+	if _, err := d.Token(); err != io.EOF {
+		return nil, ErrOnlineToken
+	}
+	d = json.NewDecoder(bytes.NewReader(raw))
+	d.DisallowUnknownFields()
+	if d.Decode(out) != nil {
+		return nil, ErrOnlineToken
+	}
+	return seen, nil
+}
+
+func decodeOnlineStatus(raw []byte) (statusWire, error) {
+	var out statusWire
+	seen, err := decodeOnlineObject(raw, &out)
+	if err != nil || out.Active == nil || (!*out.Active && len(seen) != 1) {
+		return out, ErrOnlineToken
+	}
+	if *out.Active {
+		if len(seen) != 10 {
+			return out, ErrOnlineToken
+		}
+		for _, field := range []string{"active", "client_id", "token_type", "iss", "sub", "aud", "scope", "iat", "exp", "jti"} {
+			if !seen[field] {
+				return out, ErrOnlineToken
+			}
+		}
+	}
+	return out, nil
+}
+
+func (c *OnlineClient) request(ctx context.Context, endpoint, raw string) (statusWire, error) {
+	var out statusWire
+	if c == nil || ctx == nil || ctx.Err() != nil || len(raw) == 0 || len(raw) > 32768 || (endpoint != "/introspect" && endpoint != "/revoke") {
+		return out, ErrOnlineToken
+	}
+	ca, err := readOnlineFile(c.admission.CAFile, false)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(ca) {
+		return out, ErrOnlineToken
+	}
+	secretRaw, err := readOnlineFile(c.admission.SecretFile, true)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	secret := strings.TrimSuffix(strings.TrimSuffix(string(secretRaw), "\n"), "\r")
+	if secret == "" || strings.ContainsAny(secret, "\r\n\x00") {
+		return out, ErrOnlineToken
+	}
+	form := url.Values{"token": {raw}, "token_type_hint": {"access_token"}}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.admission.Issuer+endpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Cache-Control", "no-cache")
+	req.SetBasicAuth(url.QueryEscape(c.admission.ClientID), url.QueryEscape(secret))
+	transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true, DialContext: c.dialContext}
+	defer transport.CloseIdleConnections()
+	client := &http.Client{Transport: transport, Timeout: 5 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrOnlineToken }}
+	response, err := client.Do(req)
+	if err != nil {
+		return out, ErrOnlineToken
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK || response.Header.Get("Cache-Control") != "no-store" {
+		return out, ErrOnlineToken
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, 65537))
+	if err != nil || len(body) > 65536 {
+		return out, ErrOnlineToken
+	}
+	if endpoint == "/revoke" {
+		if len(body) != 0 {
+			return out, ErrOnlineToken
+		}
+		return out, nil
+	}
+	media, _, err := mime.ParseMediaType(response.Header.Get("Content-Type"))
+	if err != nil || media != "application/json" {
+		return out, ErrOnlineToken
+	}
+	return decodeOnlineStatus(body)
+}
+
+// Check verifies expected identity before accessing the private client credential,
+// sends a new authenticated introspection and rechecks lifetime after the network.
+func (c *OnlineClient) Check(ctx context.Context, raw string, expected ExpectedIdentity) (CurrentToken, error) {
+	if c == nil || ctx == nil || ctx.Err() != nil {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	identity, err := c.verify(raw, expected, c.now().UTC())
+	if err != nil {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	status, err := c.request(ctx, "/introspect", raw)
+	if err != nil || status.Active == nil || !*status.Active {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	expires, _ := exactUnix(identity.claims["exp"])
+	if status.ClientID != c.admission.ClientID || status.TokenType != "Bearer" || status.Issuer != identity.Issuer || status.Subject != identity.Subject || status.Audience != identity.Audience || status.TokenID != identity.TokenID || status.Scope != identity.claims["scope"] || status.IssuedAt != identity.IssuedAt.Unix() || status.ExpiresAt != expires.Unix() {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	end := c.now().UTC()
+	if end.Before(identity.CheckedAt) {
+		return CurrentToken{}, ErrOnlineToken
+	}
+	// A slow lookup cannot retain expired facts or a withdrawn JWT trust key.
+	return c.verify(raw, expected, end)
+}
+
+// Revoke performs cleanup only for the exact opaque token. An empty 200 is not
+// proof: a separate authenticated introspection must confirm inactive-for-client.
+// The caller retains original grant ownership and uncertainty/retry duties.
+func (c *OnlineClient) Revoke(ctx context.Context, raw string) (InactiveForClient, error) {
+	if c == nil {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	if _, err := c.request(ctx, "/revoke", raw); err != nil {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	return c.ObserveInactive(ctx, raw)
+}
+
+// ObserveInactive is read-only. Unavailability or a malformed response is never
+// interpreted as revocation; the negative result remains scoped to this client.
+func (c *OnlineClient) ObserveInactive(ctx context.Context, raw string) (InactiveForClient, error) {
+	if c == nil {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	status, err := c.request(ctx, "/introspect", raw)
+	if err != nil || status.Active == nil || *status.Active {
+		return InactiveForClient{}, ErrOnlineToken
+	}
+	return InactiveForClient{Issuer: c.admission.Issuer, ClientID: c.admission.ClientID, TokenDigest: tokenDigest(raw), CheckedAt: c.now().UTC()}, nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_cli.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_cli.go
new file mode 100644
index 0000000..c530547
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_cli.go
@@ -0,0 +1,160 @@
+package authclient
+
+import (
+	"context"
+	"encoding/hex"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// onlineObservation is a private producer-owned command result, not a signed
+// authority receipt. The invoking owner authenticates binary/config/custody and
+// binds its own case, descriptor, transaction, principal and exact effect.
+type onlineObservation struct {
+	Schema              string                 `json:"schema"`
+	Status              string                 `json:"status"`
+	Current             *CurrentToken          `json:"current,omitempty"`
+	AuthenticationFacts map[string]interface{} `json:"signed_authentication_facts,omitempty"`
+	Inactive            *InactiveForClient     `json:"inactive_for_client,omitempty"`
+}
+
+func validOnlineDigest(raw string) bool {
+	if !strings.HasPrefix(raw, "sha256:") || len(raw) != 71 || strings.ToLower(raw) != raw {
+		return false
+	}
+	_, err := hex.DecodeString(raw[7:])
+	return err == nil
+}
+
+func parseOnlineFlags(fs *flag.FlagSet, args []string) error {
+	seen := map[string]bool{}
+	for i := 0; i < len(args); i++ {
+		name := strings.TrimLeft(args[i], "-")
+		if name == args[i] || name == "" {
+			return ErrOnlineToken
+		}
+		name, _, inline := strings.Cut(name, "=")
+		if fs.Lookup(name) == nil || seen[name] {
+			return ErrOnlineToken
+		}
+		seen[name] = true
+		if !inline {
+			i++
+			if i >= len(args) {
+				return ErrOnlineToken
+			}
+		}
+	}
+	if fs.Parse(args) != nil || fs.NArg() != 0 {
+		return ErrOnlineToken
+	}
+	return nil
+}
+
+func currentOnlineOutput(file *os.File) bool {
+	opened, err := file.Stat()
+	if err != nil {
+		return false
+	}
+	current, err := os.Lstat(file.Name())
+	return err == nil && current.Mode().IsRegular() && os.SameFile(opened, current)
+}
+
+func runOnline(ctx context.Context, mode string, args []string, stderr io.Writer) error {
+	fs := flag.NewFlagSet(mode, flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	admissionFile := fs.String("admission-file", "", "independently admitted public profile")
+	tokenFile := fs.String("token-file", "", "private owner-acquired token JSON file")
+	digest := fs.String("token-sha256", "", "exact owner-bound access-token digest")
+	subject := fs.String("subject", "", "expected signed subject for current check")
+	tenant := fs.String("tenant", "", "expected signed tenant for current check")
+	principal := fs.String("principal-type", "", "human or service for current check")
+	out := fs.String("out", "", "new private observation file outside Git")
+	if parseOnlineFlags(fs, args) != nil || *admissionFile == "" || *tokenFile == "" || !filepath.IsAbs(*out) || !validOnlineDigest(*digest) {
+		return ErrOnlineToken
+	}
+	if mode == "check-current-token" && (*subject == "" || *tenant == "" || (*principal != "human" && *principal != "service")) {
+		return ErrOnlineToken
+	}
+	if (mode == "revoke-token" || mode == "check-inactive-token") && (*subject != "" || *tenant != "" || *principal != "") {
+		return ErrOnlineToken
+	}
+	raw, err := readOnlineFile(*admissionFile, false)
+	if err != nil {
+		return ErrOnlineToken
+	}
+	var admission OnlineAdmission
+	if _, err = decodeOnlineObject(raw, &admission); err != nil {
+		return ErrOnlineToken
+	}
+	client, err := NewOnlineClient(admission)
+	if err != nil {
+		return ErrOnlineToken
+	}
+	raw, err = readOnlineBoundedFile(*tokenFile, true, 131072)
+	if err != nil {
+		return ErrOnlineToken
+	}
+	var tokens Tokens
+	if _, err = decodeOnlineObject(raw, &tokens); err != nil || tokens.TokenType != "Bearer" || tokens.AccessToken == "" || tokenDigest(tokens.AccessToken) != *digest {
+		return ErrOnlineToken
+	}
+	parent, err := filepath.EvalSymlinks(filepath.Dir(*out))
+	if err != nil {
+		return ErrOnlineToken
+	}
+	info, err := os.Stat(parent)
+	if err != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
+		return ErrOnlineToken
+	}
+	file, err := reserveOutput(*out)
+	if err != nil {
+		return ErrOnlineToken
+	}
+	success := false
+	defer func() {
+		if !success && currentOnlineOutput(file) {
+			_ = os.Remove(file.Name())
+		}
+		_ = file.Close()
+	}()
+	observation := onlineObservation{Schema: "keycape.current-token-observation.v1"}
+	switch mode {
+	case "check-current-token":
+		current, err := client.Check(ctx, tokens.AccessToken, ExpectedIdentity{Subject: *subject, Tenant: *tenant, PrincipalType: *principal})
+		if err != nil {
+			return ErrOnlineToken
+		}
+		observation.Status = "current"
+		observation.Current = &current
+		facts := current.Claims()
+		observation.AuthenticationFacts = map[string]interface{}{"assurance": facts["assurance"], "tenant_source": facts["tenant_source"]}
+	case "revoke-token":
+		inactive, err := client.Revoke(ctx, tokens.AccessToken)
+		if err != nil {
+			return ErrOnlineToken
+		}
+		observation.Status = "inactive-for-client"
+		observation.Inactive = &inactive
+	case "check-inactive-token":
+		inactive, err := client.ObserveInactive(ctx, tokens.AccessToken)
+		if err != nil {
+			return ErrOnlineToken
+		}
+		observation.Status = "inactive-for-client"
+		observation.Inactive = &inactive
+	default:
+		return ErrOnlineToken
+	}
+	if json.NewEncoder(file).Encode(observation) != nil || file.Sync() != nil || !currentOnlineOutput(file) {
+		return ErrOnlineToken
+	}
+	success = true
+	_, _ = fmt.Fprintln(stderr, "PASS issuer token-status observation written; execution authority remains with its owner")
+	return nil
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_cli_test.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_cli_test.go
new file mode 100644
index 0000000..7c55994
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_cli_test.go
@@ -0,0 +1,166 @@
+package authclient
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func onlinePrivateDir(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	if os.Chmod(dir, 0700) != nil {
+		t.Fatal("private fixture directory failed")
+	}
+	return dir
+}
+
+func (f *onlineFixture) cliInput(raw string) (string, string, []string) {
+	f.t.Helper()
+	dir := f.t.TempDir()
+	admission, token := filepath.Join(dir, "admission.json"), filepath.Join(dir, "token.json")
+	a, _ := json.Marshal(f.client.admission)
+	b, _ := json.Marshal(Tokens{AccessToken: raw, TokenType: "Bearer", ExpiresIn: 900})
+	if os.WriteFile(admission, a, 0644) != nil || os.WriteFile(token, b, 0600) != nil {
+		f.t.Fatal("fixture input write failed")
+	}
+	return admission, token, []string{"--admission-file", admission, "--token-file", token, "--token-sha256", tokenDigest(raw)}
+}
+
+func TestOnlineCLIUsesActualProducerAndPrivateObservation(t *testing.T) {
+	f := onlineProvider(t)
+	raw := f.issue()
+	_, _, base := f.cliInput(raw)
+	dir := onlinePrivateDir(t)
+	out := filepath.Join(dir, "current.json")
+	args := append([]string{"check-current-token"}, base...)
+	args = append(args, "--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service", "--out", out)
+	var log bytes.Buffer
+	if Run(context.Background(), args, &log) != nil {
+		t.Fatal("current-token command failed")
+	}
+	data, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatal("observation unavailable")
+	}
+	var observation onlineObservation
+	if json.Unmarshal(data, &observation) != nil || observation.Schema != "keycape.current-token-observation.v1" || observation.Status != "current" || observation.Current == nil || observation.Current.TokenDigest != tokenDigest(raw) || observation.AuthenticationFacts["assurance"] == nil {
+		t.Fatal("wrong producer observation")
+	}
+	info, _ := os.Stat(out)
+	if info.Mode().Perm() != 0600 {
+		t.Fatal("observation is public")
+	}
+	if strings.Contains(string(data), raw) || strings.Contains(log.String(), raw) || strings.Contains(log.String(), onlineExpected.Subject) || strings.Contains(log.String(), f.issuer.ClientConfig["current-client"].ClientSecret) {
+		t.Fatal("command exposed private facts")
+	}
+	if Run(context.Background(), args, &log) == nil {
+		t.Fatal("existing observation overwritten")
+	}
+	currentBefore, _ := os.ReadFile(out)
+	if !bytes.Equal(currentBefore, data) {
+		t.Fatal("prior observation changed")
+	}
+	revokedOut := filepath.Join(dir, "inactive.json")
+	args = append([]string{"revoke-token"}, base...)
+	args = append(args, "--out", revokedOut)
+	if Run(context.Background(), args, &log) != nil {
+		t.Fatal("cleanup observation failed")
+	}
+	data, _ = os.ReadFile(revokedOut)
+	if json.Unmarshal(data, &observation) != nil || observation.Status != "inactive-for-client" || observation.Inactive == nil || observation.Inactive.TokenDigest != tokenDigest(raw) {
+		t.Fatal("cleanup scope not explicit")
+	}
+	failedOut := filepath.Join(dir, "failed.json")
+	args = append([]string{"check-current-token"}, base...)
+	args = append(args, "--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service", "--out", failedOut)
+	if Run(context.Background(), args, &log) == nil {
+		t.Fatal("revoked token accepted by actual command")
+	}
+	if _, err = os.Stat(failedOut); !os.IsNotExist(err) {
+		t.Fatal("failed command retained positive output")
+	}
+}
+
+func TestOnlineCLIRejectsChangedTokenAndUntrustedInput(t *testing.T) {
+	for _, kind := range []string{"wrong-hash", "duplicate-flag", "token-replaced", "duplicate-admission", "duplicate-token", "public-token", "shared-output-parent", "git-output", "output-symlink", "unknown-flag", "cleanup-identity-flags"} {
+		t.Run(kind, func(t *testing.T) {
+			f := onlineProvider(t)
+			raw := f.issue()
+			admission, token, base := f.cliInput(raw)
+			dir := onlinePrivateDir(t)
+			out := filepath.Join(dir, "result.json")
+			mode := "check-current-token"
+			extra := []string{"--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service"}
+			switch kind {
+			case "wrong-hash":
+				base[len(base)-1] = "sha256:" + strings.Repeat("0", 64)
+			case "duplicate-flag":
+				base = append(base, "--token-sha256", tokenDigest(raw))
+			case "token-replaced":
+				other := f.issue()
+				b, _ := json.Marshal(Tokens{AccessToken: other, TokenType: "Bearer"})
+				_ = os.WriteFile(token, b, 0600)
+			case "duplicate-admission":
+				b, _ := os.ReadFile(admission)
+				b = append([]byte(`{"issuer":"https://forged.invalid",`), b[1:]...)
+				_ = os.WriteFile(admission, b, 0644)
+			case "duplicate-token":
+				b, _ := os.ReadFile(token)
+				b = append([]byte(`{"token_type":"Bearer",`), b[1:]...)
+				_ = os.WriteFile(token, b, 0600)
+			case "public-token":
+				_ = os.Chmod(token, 0644)
+			case "shared-output-parent":
+				_ = os.Chmod(dir, 0755)
+			case "git-output":
+				_ = os.WriteFile(filepath.Join(dir, ".git"), []byte("gitdir: unused"), 0600)
+			case "output-symlink":
+				target := filepath.Join(t.TempDir(), "untouched")
+				_ = os.WriteFile(target, []byte("original"), 0600)
+				_ = os.Symlink(target, out)
+			case "unknown-flag":
+				extra = append(extra, "--secret-raw=must-not-echo-this")
+			case "cleanup-identity-flags":
+				mode = "revoke-token"
+			}
+			args := append([]string{mode}, base...)
+			args = append(args, extra...)
+			args = append(args, "--out", out)
+			var log bytes.Buffer
+			if Run(context.Background(), args, &log) == nil || f.introspections.Load() != 0 || f.revocations.Load() != 0 {
+				t.Fatal("untrusted command input reached issuer")
+			}
+			if strings.Contains(log.String(), "must-not-echo-this") || strings.Contains(log.String(), raw) {
+				t.Fatal("refusal echoed input")
+			}
+		})
+	}
+}
+
+func TestOnlineCLIFailureDoesNotDeleteReplacedObservation(t *testing.T) {
+	f := onlineProvider(t)
+	raw := f.issue()
+	_, _, base := f.cliInput(raw)
+	dir := onlinePrivateDir(t)
+	out := filepath.Join(dir, "result.json")
+	f.afterStatus.Store(func() {
+		if os.Remove(out) != nil || os.WriteFile(out, []byte("replacement owned by another attempt"), 0600) != nil {
+			t.Error("replacement fixture failed")
+		}
+	})
+	args := append([]string{"check-current-token"}, base...)
+	args = append(args, "--subject", onlineExpected.Subject, "--tenant", onlineExpected.Tenant, "--principal-type", "service", "--out", out)
+	var log bytes.Buffer
+	if Run(context.Background(), args, &log) == nil {
+		t.Fatal("replaced observation reported successful")
+	}
+	data, _ := os.ReadFile(out)
+	if string(data) != "replacement owned by another attempt" {
+		t.Fatal("another attempt's output removed")
+	}
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_export_test.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_export_test.go
new file mode 100644
index 0000000..56cdc52
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_export_test.go
@@ -0,0 +1,20 @@
+package authclient
+
+import (
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+)
+
+func TestOnlineExportMatchesItsSingleProducer(t *testing.T) {
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("producer source location unavailable")
+	}
+	root := filepath.Clean(filepath.Join(filepath.Dir(file), "../../.."))
+	cmd := exec.Command("python3", filepath.Join(root, "tools/export_tokenstatus_client.py"), "--check")
+	if err := cmd.Run(); err != nil {
+		t.Fatal("public adapter differs from the single producer source")
+	}
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_human_test.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_human_test.go
new file mode 100644
index 0000000..d7fa191
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_human_test.go
@@ -0,0 +1,78 @@
+package authclient
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"keycape/internal/domain"
+	"keycape/internal/server/oidc"
+)
+
+type onlineHumanDirectory struct{ user domain.User }
+
+func (d *onlineHumanDirectory) LookupUser(context.Context, string) (*domain.User, error) {
+	return &d.user, nil
+}
+func (d *onlineHumanDirectory) LookupGroups(context.Context, string) ([]domain.Group, error) {
+	return nil, nil
+}
+func (d *onlineHumanDirectory) ListUsers(context.Context) ([]domain.User, error) {
+	return []domain.User{d.user}, nil
+}
+func (d *onlineHumanDirectory) ValidatePassword(context.Context, string, string) (bool, error) {
+	return false, nil
+}
+
+func TestOnlineActualHumanPKCEFactsStayDistinctFromCurrentStatus(t *testing.T) {
+	f := onlineProvider(t)
+	directory := &onlineHumanDirectory{user: domain.User{ID: "uid=operator,ou=people,dc=fixture", Username: "operator", Enabled: true, Tenant: "tenant:fixture", Groups: []string{"fixture-allowed"}}}
+	client := f.issuer.ClientConfig["current-client"]
+	client.GrantTypes = []string{"authorization_code"}
+	client.ServiceSubject = ""
+	client.AllowedScopes = []string{"openid", "profile", "groups"}
+	client.RedirectURIs = []string{"https://owner.fixture.invalid/callback"}
+	f.issuer.Users = directory
+	f.status.Users = directory
+	verifier := strings.Repeat("v", 43)
+	hash := sha256.Sum256([]byte(verifier))
+	authenticated := time.Now().Add(-time.Minute).Truncate(time.Second)
+	code := f.issuer.Sessions.Create(&oidc.PKCESession{ClientID: client.ClientID, Username: directory.user.Username,
+		RedirectURI: client.RedirectURIs[0], PKCEChallengeMethod: "S256", PKCEChallenge: base64.RawURLEncoding.EncodeToString(hash[:]),
+		Scopes: client.AllowedScopes, MFAVerified: true, AuthTime: authenticated, ExpiresAt: time.Now().Add(time.Minute)})
+	form := url.Values{"grant_type": {"authorization_code"}, "client_id": {client.ClientID}, "code": {code}, "code_verifier": {verifier}, "redirect_uri": {client.RedirectURIs[0]}}
+	r := httptest.NewRequest(http.MethodPost, "/token", strings.NewReader(form.Encode()))
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	r.SetBasicAuth(url.QueryEscape(client.ClientID), url.QueryEscape(client.ClientSecret))
+	w := httptest.NewRecorder()
+	f.issuer.ServeHTTP(w, r)
+	var tokens Tokens
+	if w.Code != 200 || json.Unmarshal(w.Body.Bytes(), &tokens) != nil {
+		t.Fatal("actual human PKCE fixture failed")
+	}
+	expected := ExpectedIdentity{Subject: directory.user.ID, Tenant: directory.user.Tenant, PrincipalType: "human"}
+	current, err := f.client.Check(context.Background(), tokens.AccessToken, expected)
+	if err != nil {
+		t.Fatal("actual human current status failed")
+	}
+	facts := current.Claims()
+	assurance, ok := facts["assurance"].(map[string]interface{})
+	if !ok || assurance["level"] != "aal2" || assurance["mfa"] != true || assurance["at"] != float64(authenticated.Unix()) || facts["tenant_source"] != "directory" {
+		t.Fatal("signed authentication provenance changed or was upgraded to current time")
+	}
+	before := f.introspections.Load()
+	if _, err = f.client.Check(context.Background(), tokens.IDToken, expected); err == nil || f.introspections.Load() != before {
+		t.Fatal("ID token was substituted for access-token status")
+	}
+	directory.user.Groups = []string{"netkingdom-suspended"}
+	if _, err = f.client.Check(context.Background(), tokens.AccessToken, expected); err == nil {
+		t.Fatal("suspended human remained current")
+	}
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_test.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_test.go
new file mode 100644
index 0000000..f7ff909
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/authclient/online_test.go
@@ -0,0 +1,463 @@
+package authclient
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"time"
+
+	"keycape/internal/domain"
+	"keycape/internal/jose"
+	"keycape/internal/server/oidc"
+	"keycape/internal/server/telemetry"
+)
+
+type onlineFixture struct {
+	t              *testing.T
+	client         *OnlineClient
+	issuer         *oidc.TokenHandler
+	status         *oidc.TokenStatusHandler
+	server         *httptest.Server
+	mode           atomic.Value
+	introspections atomic.Int64
+	revocations    atomic.Int64
+	afterStatus    atomic.Value
+}
+
+func onlineProvider(t *testing.T) *onlineFixture {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal("fixture key creation failed")
+	}
+	store, _ := oidc.NewTokenStatusStore(128)
+	f := &onlineFixture{t: t}
+	f.mode.Store("")
+	f.afterStatus.Store(func() {})
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { f.serve(w, r) }))
+	t.Cleanup(server.Close)
+	f.server = server
+	clients := map[string]*domain.Client{
+		"current-client": {ClientID: "current-client", ClientType: "confidential", ClientSecret: "synthetic + % /: current", Audience: "resource:fixture", GrantTypes: []string{"client_credentials"}, AllowedScopes: []string{"fixture.read"}, ServiceSubject: "service:fixture", Tenant: "tenant:fixture"},
+		"other-client":   {ClientID: "other-client", ClientType: "confidential", ClientSecret: "synthetic other", Audience: "resource:fixture", GrantTypes: []string{"client_credentials"}, AllowedScopes: []string{"fixture.read"}, ServiceSubject: "service:fixture", Tenant: "tenant:fixture"},
+	}
+	f.issuer = &oidc.TokenHandler{ClientConfig: clients, Sessions: oidc.NewSessionStore(), SigningKey: key, Issuer: server.URL, TokenLifetime: 15 * time.Minute, Emitter: telemetry.NoopEmitter{}, Tokens: store}
+	f.status = &oidc.TokenStatusHandler{Tokens: store, ClientConfig: clients, SigningKey: &key.PublicKey, Issuer: server.URL}
+	dir := t.TempDir()
+	ca := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: server.Certificate().Raw})
+	caFile, keysFile, secretFile := filepath.Join(dir, "ca.pem"), filepath.Join(dir, "keys.json"), filepath.Join(dir, "caller")
+	if os.WriteFile(caFile, ca, 0644) != nil || os.WriteFile(secretFile, []byte(clients["current-client"].ClientSecret), 0600) != nil {
+		t.Fatal("fixture files failed")
+	}
+	keys := oidc.NewKeySet()
+	keys.AddKey("key-1", &key.PublicKey)
+	w := httptest.NewRecorder()
+	oidc.NewJWKSHandler(keys).ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/jwks", nil))
+	if os.WriteFile(keysFile, w.Body.Bytes(), 0644) != nil {
+		t.Fatal("fixture public keys failed")
+	}
+	f.client, err = NewOnlineClient(OnlineAdmission{Issuer: server.URL, Audience: "resource:fixture", ClientID: "current-client", CAFile: caFile, JWKSFile: keysFile, SecretFile: secretFile, MaxTokenAge: "5m"})
+	if err != nil {
+		t.Fatal("fixture admission failed")
+	}
+	return f
+}
+
+func (f *onlineFixture) serve(w http.ResponseWriter, r *http.Request) {
+	mode := f.mode.Load().(string)
+	switch r.URL.Path {
+	case "/token":
+		f.issuer.ServeHTTP(w, r)
+	case "/revoke":
+		f.revocations.Add(1)
+		if mode == "revoke-no-effect" {
+			w.Header().Set("Cache-Control", "no-store")
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		if mode == "revoke-body" {
+			w.Header().Set("Cache-Control", "no-store")
+			fmt.Fprint(w, "unexpected")
+			return
+		}
+		f.status.Revoke(w, r)
+	case "/introspect":
+		f.introspections.Add(1)
+		if mode == "redirect" {
+			http.Redirect(w, r, f.server.URL+"/sink", 307)
+			return
+		}
+		if mode == "unavailable" {
+			w.WriteHeader(503)
+			return
+		}
+		if mode == "oversize" {
+			w.Header().Set("Cache-Control", "no-store")
+			w.Header().Set("Content-Type", "application/json")
+			fmt.Fprint(w, strings.Repeat("x", 65537))
+			return
+		}
+		recorded := httptest.NewRecorder()
+		f.status.Introspect(recorded, r)
+		for key, values := range recorded.Header() {
+			for _, value := range values {
+				w.Header().Add(key, value)
+			}
+		}
+		if mode == "cached" {
+			w.Header().Set("Cache-Control", "max-age=30")
+		}
+		if mode == "wrong-content-type" {
+			w.Header().Set("Content-Type", "text/plain")
+		}
+		var body map[string]interface{}
+		if json.Unmarshal(recorded.Body.Bytes(), &body) != nil {
+			w.WriteHeader(recorded.Code)
+			_, _ = w.Write(recorded.Body.Bytes())
+			return
+		}
+		switch mode {
+		case "missing-active":
+			delete(body, "active")
+		case "wrong-active-type":
+			body["active"] = "true"
+		case "missing-scope":
+			delete(body, "scope")
+		case "null-scope":
+			body["scope"] = nil
+		case "wrong-client":
+			body["client_id"] = "other-client"
+		case "wrong-subject":
+			body["sub"] = "service:other"
+		case "wrong-issuer":
+			body["iss"] = "https://other.invalid"
+		case "wrong-audience":
+			body["aud"] = "resource:other"
+		case "wrong-jti":
+			body["jti"] = "different-token-id"
+		case "wrong-expiry":
+			body["exp"] = body["exp"].(float64) + 10
+		case "wrong-issued":
+			body["iat"] = body["iat"].(float64) - 1
+		case "wrong-scope":
+			body["scope"] = "different.scope"
+		case "wrong-token-type":
+			body["token_type"] = "Other"
+		case "unknown-field":
+			body["authority"] = true
+		}
+		f.afterStatus.Load().(func())()
+		w.WriteHeader(recorded.Code)
+		encoded, _ := json.Marshal(body)
+		if mode == "duplicate-active" {
+			encoded = append([]byte(`{"active":false,`), encoded[1:]...)
+		}
+		if mode == "trailing-json" {
+			encoded = append(encoded, []byte(`{}`)...)
+		}
+		_, _ = w.Write(encoded)
+	case "/sink":
+		f.t.Error("credential redirect followed")
+		w.WriteHeader(500)
+	default:
+		w.WriteHeader(404)
+	}
+}
+
+func (f *onlineFixture) issue() string {
+	f.t.Helper()
+	r := httptest.NewRequest(http.MethodPost, "/token", strings.NewReader(url.Values{"grant_type": {"client_credentials"}}.Encode()))
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	client := f.issuer.ClientConfig["current-client"]
+	r.SetBasicAuth(url.QueryEscape(client.ClientID), url.QueryEscape(client.ClientSecret))
+	w := httptest.NewRecorder()
+	f.issuer.ServeHTTP(w, r)
+	var token Tokens
+	if w.Code != http.StatusOK || json.Unmarshal(w.Body.Bytes(), &token) != nil || token.AccessToken == "" {
+		f.t.Fatal("actual fixture issuance failed")
+	}
+	return token.AccessToken
+}
+
+var onlineExpected = ExpectedIdentity{Subject: "service:fixture", Tenant: "tenant:fixture", PrincipalType: "service"}
+
+func TestOnlineActualIssuerCurrentRevocationAndFreshGrant(t *testing.T) {
+	f := onlineProvider(t)
+	first := f.issue()
+	ctx := context.Background()
+	identity, err := f.client.Check(ctx, first, onlineExpected)
+	if err != nil || identity.Subject != onlineExpected.Subject || identity.ClientID != "current-client" || identity.TokenDigest != tokenDigest(first) || identity.TokenID == "" || !identity.CheckedAt.Before(identity.NotAfter) {
+		t.Fatal("current exact identity not established")
+	}
+	claims := identity.Claims()
+	claims["sub"] = "changed"
+	if identity.Claims()["sub"] != onlineExpected.Subject {
+		t.Fatal("returned facts share mutable state")
+	}
+	if _, err = f.client.Check(ctx, first, onlineExpected); err != nil || f.introspections.Load() != 2 {
+		t.Fatal("current status was cached")
+	}
+	if _, err = f.client.ObserveInactive(ctx, first); err == nil || f.revocations.Load() != 0 {
+		t.Fatal("read-only negative check changed active authority")
+	}
+	closed, err := f.client.Revoke(ctx, first)
+	if err != nil || closed.ClientID != "current-client" || closed.TokenDigest != identity.TokenDigest {
+		t.Fatal("issuer negative cleanup readback failed")
+	}
+	if _, err = f.client.Check(ctx, first, onlineExpected); err == nil {
+		t.Fatal("revoked token accepted")
+	}
+	before := f.revocations.Load()
+	if _, err = f.client.ObserveInactive(ctx, first); err != nil || f.revocations.Load() != before {
+		t.Fatal("independent negative readback failed or mutated token")
+	}
+	second := f.issue()
+	current, err := f.client.Check(ctx, second, onlineExpected)
+	if err != nil || current.TokenID == identity.TokenID || current.TokenDigest == identity.TokenDigest {
+		t.Fatal("fresh grant did not establish distinct identity")
+	}
+}
+
+func TestOnlineIdentityMismatchRefusesBeforeNetwork(t *testing.T) {
+	for _, kind := range []string{"subject", "tenant", "principal", "audience", "issuer", "tamper", "key", "no-jti", "ID-token", "stale"} {
+		t.Run(kind, func(t *testing.T) {
+			f := onlineProvider(t)
+			raw := f.issue()
+			expect := onlineExpected
+			switch kind {
+			case "subject":
+				expect.Subject = "other"
+			case "tenant":
+				expect.Tenant = "other"
+			case "principal":
+				expect.PrincipalType = "human"
+			case "audience":
+				f.client.admission.Audience = "other"
+			case "issuer":
+				f.client.admission.Issuer = "https://different.invalid"
+			case "tamper":
+				raw += "changed"
+			case "key":
+				key, _ := rsa.GenerateKey(rand.Reader, 2048)
+				raw = signToken(t, key, "key-1", map[string]interface{}{"iss": f.server.URL})
+			case "no-jti":
+				f.issuer.Tokens = nil
+				raw = f.issue()
+			case "ID-token":
+				identity, err := f.client.verify(raw, expect, time.Now())
+				if err != nil {
+					t.Fatal("fixture identity failed")
+				}
+				claims := identity.Claims()
+				delete(claims, "scope")
+				raw, err = oidc.BuildJWT(claims, "key-1", f.issuer.SigningKey)
+				if err != nil {
+					t.Fatal("fixture purpose token failed")
+				}
+			case "stale":
+				f.client.now = func() time.Time { return time.Now().Add(10 * time.Minute) }
+			}
+			if _, err := f.client.Check(context.Background(), raw, expect); !errors.Is(err, ErrOnlineToken) || f.introspections.Load() != 0 {
+				t.Fatal("unbound identity reached credential-bearing endpoint")
+			}
+		})
+	}
+}
+
+func TestOnlineRefusesAmbiguousOrMismatchedCurrentStatus(t *testing.T) {
+	for _, mode := range []string{"missing-active", "wrong-active-type", "missing-scope", "null-scope", "wrong-client", "wrong-subject", "wrong-issuer", "wrong-audience", "wrong-jti", "wrong-expiry", "wrong-issued", "wrong-scope", "wrong-token-type", "unknown-field", "duplicate-active", "trailing-json", "redirect", "unavailable", "oversize", "cached", "wrong-content-type"} {
+		t.Run(mode, func(t *testing.T) {
+			f := onlineProvider(t)
+			raw := f.issue()
+			f.mode.Store(mode)
+			if _, err := f.client.Check(context.Background(), raw, onlineExpected); !errors.Is(err, ErrOnlineToken) || err.Error() != ErrOnlineToken.Error() {
+				t.Fatal("unsafe response accepted or disclosed detail")
+			}
+		})
+	}
+}
+
+func TestOnlineCleanupRequiresNegativeReadbackAndPreservesScope(t *testing.T) {
+	f := onlineProvider(t)
+	raw := f.issue()
+	f.mode.Store("revoke-no-effect")
+	if _, err := f.client.Revoke(context.Background(), raw); err == nil {
+		t.Fatal("empty 200 mistaken for confirmed inactive state")
+	}
+	f.mode.Store("revoke-body")
+	if _, err := f.client.Revoke(context.Background(), raw); err == nil {
+		t.Fatal("unexpected cleanup output accepted")
+	}
+	f.mode.Store("")
+	f.client.admission.ClientID = "other-client"
+	if os.WriteFile(f.client.admission.SecretFile, []byte("synthetic other"), 0600) != nil {
+		t.Fatal("fixture credential write failed")
+	}
+	result, err := f.client.Revoke(context.Background(), raw)
+	if err != nil || result.ClientID != "other-client" {
+		t.Fatal("wrong-client negative scope not explicit")
+	}
+	f.client.admission.ClientID = "current-client"
+	_ = os.WriteFile(f.client.admission.SecretFile, []byte("synthetic + % /: current"), 0600)
+	if _, err = f.client.Check(context.Background(), raw, onlineExpected); err != nil {
+		t.Fatal("another client acquired revocation authority")
+	}
+}
+
+func TestOnlineReloadsCredentialsKeysAndTrustFiles(t *testing.T) {
+	for _, kind := range []string{"secret", "keys", "ca", "secret-world-readable", "public-writable", "secret-fifo"} {
+		t.Run(kind, func(t *testing.T) {
+			f := onlineProvider(t)
+			raw := f.issue()
+			if _, err := f.client.Check(context.Background(), raw, onlineExpected); err != nil {
+				t.Fatal("fixture current check failed")
+			}
+			switch kind {
+			case "secret":
+				_ = os.WriteFile(f.client.admission.SecretFile, []byte("changed synthetic"), 0600)
+			case "keys":
+				_ = os.WriteFile(f.client.admission.JWKSFile, []byte(`{"keys":[]}`), 0644)
+			case "ca":
+				_ = os.WriteFile(f.client.admission.CAFile, []byte("not a certificate"), 0644)
+			case "secret-world-readable":
+				_ = os.Chmod(f.client.admission.SecretFile, 0644)
+			case "public-writable":
+				_ = os.Chmod(f.client.admission.JWKSFile, 0666)
+			case "secret-fifo":
+				_ = os.Remove(f.client.admission.SecretFile)
+				if syscall.Mkfifo(f.client.admission.SecretFile, 0600) != nil {
+					t.Fatal("FIFO fixture failed")
+				}
+			}
+			if _, err := f.client.Check(context.Background(), raw, onlineExpected); err == nil {
+				t.Fatal("withdrawn or unsafe input reused")
+			}
+		})
+	}
+}
+
+func TestOnlineRechecksExpiryClockAndKeyAfterStatus(t *testing.T) {
+	for _, kind := range []string{"expiry", "clock-backwards", "withdrawn-key"} {
+		t.Run(kind, func(t *testing.T) {
+			f := onlineProvider(t)
+			raw := f.issue()
+			now := time.Now()
+			calls := 0
+			f.client.now = func() time.Time {
+				calls++
+				if calls == 1 {
+					return now
+				}
+				if kind == "expiry" {
+					return now.Add(10 * time.Minute)
+				}
+				if kind == "clock-backwards" {
+					return now.Add(-time.Second)
+				}
+				return now
+			}
+			if kind == "withdrawn-key" {
+				f.afterStatus.Store(func() { _ = os.WriteFile(f.client.admission.JWKSFile, []byte(`{"keys":[]}`), 0644) })
+			}
+			if _, err := f.client.Check(context.Background(), raw, onlineExpected); err == nil || f.introspections.Load() != 1 {
+				t.Fatal("delayed status preserved withdrawn identity")
+			}
+		})
+	}
+}
+
+func TestOnlineCancellationAndAmbientProxyDoNotLeakInputs(t *testing.T) {
+	f := onlineProvider(t)
+	if f.server.Certificate().VerifyHostname("example.com") != nil {
+		t.Fatal("fixture certificate lacks test DNS identity")
+	}
+	original, _ := url.Parse(f.server.URL)
+	_, port, _ := net.SplitHostPort(original.Host)
+	dnsAddress := net.JoinHostPort("example.com", port)
+	f.client.admission.Issuer = "https://" + dnsAddress
+	f.issuer.Issuer = f.client.admission.Issuer
+	f.status.Issuer = f.client.admission.Issuer
+	f.client.dialContext = func(ctx context.Context, network, address string) (net.Conn, error) {
+		if address == dnsAddress {
+			address = original.Host
+		}
+		return (&net.Dialer{}).DialContext(ctx, network, address)
+	}
+	raw := f.issue()
+	proxyCalls := atomic.Int64{}
+	proxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { proxyCalls.Add(1); w.WriteHeader(500) }))
+	defer proxy.Close()
+	t.Setenv("HTTPS_PROXY", proxy.URL)
+	t.Setenv("HTTP_PROXY", proxy.URL)
+	t.Setenv("ALL_PROXY", proxy.URL)
+	t.Setenv("NO_PROXY", "")
+	if _, err := f.client.Check(context.Background(), raw, onlineExpected); err != nil || proxyCalls.Load() != 0 {
+		t.Fatal("ambient proxy affected explicit owner transport")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	before := f.introspections.Load()
+	if _, err := f.client.Check(ctx, raw, onlineExpected); err == nil || f.introspections.Load() != before {
+		t.Fatal("cancelled check reached provider")
+	}
+	if _, err := f.client.Revoke(ctx, raw); err == nil || f.revocations.Load() != 0 {
+		t.Fatal("cancelled cleanup reached provider")
+	}
+}
+
+func TestOnlineMalformedAdmissionAndNegativeStatus(t *testing.T) {
+	f := onlineProvider(t)
+	for _, issuer := range []string{"http://issuer.invalid", "https://user@issuer.invalid", "https://issuer.invalid?", "https://issuer.invalid#", "https://issuer.invalid/../other", "https://issuer.invalid/%2Fother", "https://issuer.invalid/"} {
+		a := f.client.admission
+		a.Issuer = issuer
+		if _, err := NewOnlineClient(a); err == nil {
+			t.Fatal("ambiguous issuer admitted")
+		}
+	}
+	for _, raw := range []string{`null`, `[]`, `{}`, `{"active":null}`, `{"active":false,"sub":"hidden"}`, `{"active":false,"active":false}`, `{"active":false}{}`} {
+		if _, err := decodeOnlineStatus([]byte(raw)); err == nil {
+			t.Fatal("ambiguous inactive response accepted")
+		}
+	}
+	if status, err := decodeOnlineStatus([]byte(`{"active":false}`)); err != nil || *status.Active {
+		t.Fatal("exact inactive response refused")
+	}
+}
+
+func TestOnlineUsesSharedTypedJOSEVerifier(t *testing.T) {
+	f := onlineProvider(t)
+	raw := f.issue()
+	data, err := os.ReadFile(f.client.admission.JWKSFile)
+	if err != nil {
+		t.Fatal("fixture public keys unavailable")
+	}
+	keys, err := jose.ParseJWKS(data)
+	if err != nil {
+		t.Fatal("fixture public keys invalid")
+	}
+	if _, err = jose.VerifyTyped(raw, keys, "JWT"); err != nil {
+		t.Fatal("actual producer token rejected")
+	}
+	for _, typ := range []string{"", "at+jwt", "other"} {
+		if _, err = jose.VerifyTyped(raw, keys, typ); err == nil {
+			t.Fatal("unadmitted JWT type accepted")
+		}
+	}
+	if _, err = jose.Verify(raw, keys); err != nil {
+		t.Fatal("legacy shared signature verifier changed")
+	}
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/jose/jose.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/jose/jose.go
new file mode 100644
index 0000000..6eef3d8
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/src/internal/jose/jose.go
@@ -0,0 +1,171 @@
+// Package jose provides strict RS256 JWT signature verification against a JWK
+// set. It is deliberately narrow: it establishes that a token was signed by a
+// key in the given set and returns its claims. It applies no claim policy —
+// issuer, audience, expiry and nonce rules differ per caller and belong with
+// the caller that knows them.
+//
+// The strictness here is the point. A verifier that accepts an unexpected
+// algorithm, an unbounded exponent or an undersized modulus is worse than no
+// verifier, because callers stop checking what it appears to guarantee.
+package jose
+
+import (
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"math/big"
+	"strings"
+)
+
+// ErrVerification is returned for every verification failure. The cause is
+// deliberately not distinguished: a caller acting on why a token failed tends to
+// leak that distinction to whoever supplied the token.
+var ErrVerification = errors.New("jose: token verification failed")
+
+// KeySet maps key IDs to RSA public keys.
+type KeySet map[string]*rsa.PublicKey
+
+// ParseJWKS parses a JWK set, keeping only RSA signing keys usable with RS256.
+// Keys that are malformed, too small, or carry an even or trivial exponent are
+// rejected rather than skipped, since a key set that is partly wrong is not
+// evidence of anything.
+func ParseJWKS(raw []byte) (KeySet, error) {
+	var document struct {
+		Keys []struct {
+			Kty string `json:"kty"`
+			Use string `json:"use"`
+			Alg string `json:"alg"`
+			Kid string `json:"kid"`
+			N   string `json:"n"`
+			E   string `json:"e"`
+		} `json:"keys"`
+	}
+	if err := json.Unmarshal(raw, &document); err != nil {
+		return nil, ErrVerification
+	}
+	keys := make(KeySet, len(document.Keys))
+	for _, key := range document.Keys {
+		// Ignore keys for other algorithms or purposes; they are not errors.
+		if key.Kty != "RSA" || (key.Use != "" && key.Use != "sig") || (key.Alg != "" && key.Alg != "RS256") {
+			continue
+		}
+		if key.Kid == "" {
+			return nil, ErrVerification
+		}
+		modulus, errN := decode(key.N)
+		exponent, errE := decode(key.E)
+		if errN != nil || errE != nil || len(exponent) == 0 || len(exponent) > 4 {
+			return nil, ErrVerification
+		}
+		public := &rsa.PublicKey{
+			N: new(big.Int).SetBytes(modulus),
+			E: int(new(big.Int).SetBytes(exponent).Int64()),
+		}
+		if public.N.BitLen() < 2048 || public.E < 3 || public.E%2 == 0 {
+			return nil, ErrVerification
+		}
+		if _, duplicate := keys[key.Kid]; duplicate {
+			return nil, ErrVerification
+		}
+		keys[key.Kid] = public
+	}
+	if len(keys) == 0 {
+		return nil, ErrVerification
+	}
+	return keys, nil
+}
+
+// KeyID returns the key ID from a token's JOSE header, after checking that the
+// header names RS256 and carries no critical extensions. Callers use it to
+// decide whether to refresh their key set before verifying.
+func KeyID(token string) (string, error) {
+	header, _, _, err := split(token)
+	if err != nil {
+		return "", err
+	}
+	return header.Kid, nil
+}
+
+// Verify checks a token's RS256 signature against the key set and returns its
+// claims. It does not inspect any claim.
+func Verify(token string, keys KeySet) (map[string]interface{}, error) {
+	return verify(token, keys, "")
+}
+
+// VerifyTyped applies the same signature verifier with an explicit JOSE type.
+// Existing Verify callers retain their claim/type policy; online access-token
+// consumers opt into the producer's exact JWT header contract here.
+func VerifyTyped(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
+	if expectedType == "" {
+		return nil, ErrVerification
+	}
+	return verify(token, keys, expectedType)
+}
+
+func verify(token string, keys KeySet, expectedType string) (map[string]interface{}, error) {
+	header, signingInput, signature, err := split(token)
+	if err != nil {
+		return nil, err
+	}
+	if expectedType != "" && header.Typ != expectedType {
+		return nil, ErrVerification
+	}
+	public, ok := keys[header.Kid]
+	if !ok {
+		return nil, ErrVerification
+	}
+	digest := sha256.Sum256([]byte(signingInput))
+	if rsa.VerifyPKCS1v15(public, crypto.SHA256, digest[:], signature) != nil {
+		return nil, ErrVerification
+	}
+	payload, err := decode(strings.Split(signingInput, ".")[1])
+	if err != nil {
+		return nil, ErrVerification
+	}
+	claims := map[string]interface{}{}
+	if json.Unmarshal(payload, &claims) != nil {
+		return nil, ErrVerification
+	}
+	return claims, nil
+}
+
+type joseHeader struct {
+	Alg  string   `json:"alg"`
+	Typ  string   `json:"typ"`
+	Kid  string   `json:"kid"`
+	Crit []string `json:"crit"`
+}
+
+// split validates the token's shape and header and returns the header, the
+// signing input, and the decoded signature.
+func split(token string) (joseHeader, string, []byte, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	raw, err := decode(parts[0])
+	if err != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	var header joseHeader
+	if json.Unmarshal(raw, &header) != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	// An unexpected algorithm must fail before any key is selected, so "none"
+	// and symmetric algorithms can never reach the RSA path.
+	if header.Alg != "RS256" || header.Kid == "" || len(header.Crit) != 0 {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	signature, err := decode(parts[2])
+	if err != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	return header, parts[0] + "." + parts[1], signature, nil
+}
+
+func decode(segment string) ([]byte, error) {
+	return base64.RawURLEncoding.DecodeString(segment)
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/tools/export_tokenstatus_client.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/tools/export_tokenstatus_client.py
new file mode 100644
index 0000000..d20b252
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/tools/export_tokenstatus_client.py
@@ -0,0 +1,43 @@
+"""Export the producer's one online client; never maintain a consumer fork."""
+from pathlib import Path
+import argparse
+import hashlib
+import json
+
+ROOT = Path(__file__).resolve().parent.parent
+DESTINATION = ROOT / 'adapters/go/tokenstatus'
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--check', action='store_true')
+    args = parser.parse_args()
+    client = (ROOT / 'src/internal/authclient/online.go').read_bytes()
+    assert client.startswith(b'package authclient\n')
+    output = {
+        'pkg/tokenstatus/client.go': client.replace(b'package authclient\n', b'package tokenstatus\n', 1),
+        'internal/jose/jose.go': (ROOT / 'src/internal/jose/jose.go').read_bytes(),
+        'LICENSE': (ROOT / 'LICENSE').read_bytes(),
+        'go.mod': b'module keycape\n\ngo 1.23.0\n',
+    }
+    metadata = {
+        'source_of_truth': 'key-cape source; generated by tools/export_tokenstatus_client.py',
+        'source_files': ['src/internal/authclient/online.go', 'src/internal/jose/jose.go', 'LICENSE'],
+        'transformation': 'replace only the first package declaration authclient with tokenstatus; all remaining client bytes and shared JOSE bytes exact',
+        'module': 'keycape', 'profile': 'issuer online access-token status; no policy evaluator or deployment',
+        'supported_file_boundary': 'Linux owner execution profile; POSIX mode checks; not a Windows ACL contract',
+        'sha256': {name: 'sha256:' + hashlib.sha256(raw).hexdigest() for name,raw in sorted(output.items())},
+    }
+    output['producer-source.json'] = (json.dumps(metadata, indent=2) + '\n').encode()
+    actual = {str(p.relative_to(DESTINATION)) for p in DESTINATION.rglob('*') if p.is_file()}
+    if actual - set(output):
+        raise SystemExit('unexpected generated adapter file; reconcile explicitly')
+    if args.check:
+        if any(not (DESTINATION / name).is_file() or (DESTINATION / name).read_bytes()!=raw for name,raw in output.items()):
+            raise SystemExit('producer/consumer token-status source drift')
+    else:
+        for name, raw in output.items():
+            path=DESTINATION/name;path.parent.mkdir(parents=True, exist_ok=True);path.write_bytes(raw)
+    print(json.dumps({'status':'verified' if args.check else 'exported','files':len(output)}))
+
+if __name__ == '__main__':
+    main()
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/workplans/KEY-WP-0042-online-access-token-status.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/workplans/KEY-WP-0042-online-access-token-status.md
new file mode 100644
index 0000000..7a5528f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/postimages/workplans/KEY-WP-0042-online-access-token-status.md
@@ -0,0 +1,116 @@
+---
+id: KEY-WP-0042
+type: workplan
+title: "Provide issuer-owned current access-token status and scoped revocation"
+domain: infotech
+repo: key-cape
+status: proposed
+owner: codex
+topic_slug: custodian
+created: "2026-10-18"
+updated: "2026-10-18"
+flavor: extension
+depends_on: []
+state_hub_workstream_id: "e2eecd1c-45c7-5a7c-bd1c-d31c845e3d38"
+---
+
+CUST-WP-0080's current-operation/inverse requirement exposed a concrete missing
+issuer facility. KEY-WP-0025-T03 truthfully documents the expiry-only limit;
+KEY-WP-0038 owns Forgejo's existing client, not a token-liveness API. This is an
+explicit proposed scope extension in the existing issuer, not a silent change
+to that completed limit record. No new service or duplicate session authority.
+Consumer binding/authorization and native case acceptance stay in
+NK-WP-0048-T34/T42/T43 and RAPPS-WP-0016-T08/T09; they are not copied here.
+
+## Review the bounded issuer/profile extension
+
+```task
+id: KEY-WP-0042-T01
+status: progress
+priority: high
+state_hub_task_id: "d8af8e77-f6e5-5d0d-8b44-794af3dee5cf"
+```
+
+The reviewable contract is `docs/online-token-status.md`: opt-in RFC 7662/7009
+access-token status; registered owning-client authentication; private hash-only
+bounded state; unique access-token jti; no ID-token change; singleton store-loss
+refusal; disabled legacy behavior explicit. Source preparation is authorized by
+the full Custodian implementation goal. Independent issuer/profile/consumer
+assent remains required before admission; no such assent is inferred here.
+
+## Implement and verify the actual issuer paths
+
+```task
+id: KEY-WP-0042-T02
+status: done
+priority: high
+state_hub_task_id: "2cade51f-d25a-5719-96b4-b57d50c1b97d"
+```
+
+Wire the same issuer store to both actual grant types, UserInfo, introspection,
+revocation, configuration validation and implemented discovery. Verify distinct
+grants, exact expiry, replay/tombstones, capacity, malformed/unauthenticated and
+cross-client refusals, current registration and human disposition, revocation
+during directory lookup, process-store loss and absence of secret output. Keep
+the complete existing source suite, disabled profile and build passing.
+
+## Admit and accept the issuer lifecycle at native scope
+
+```task
+id: KEY-WP-0042-T03
+status: todo
+priority: high
+state_hub_task_id: "a5539bb0-2501-5774-a7d8-acddfb0938ab"
+```
+
+After independent contract review, admit exact issuer image/config/profile,
+HTTPS ingress/client custody and measured capacity/headroom. Exercise real
+human PKCE and service tokens, actual endpoint authentication, revoked-token
+UserInfo refusal, expiry, unavailable dependency, restart/store loss and fresh
+reauthentication. Preserve old offline-token semantics and document every
+consumer's selected mode. Review disabling/rollback explicitly; never silently
+fall back to offline acceptance for online-profile consumers. Provide owner
+receipts to existing NK48/Apps consumer tasks and Audit source admission.
+
+2026-10-18 source verification: all 659 test/subtest results in the complete
+race suite pass, with six preexisting native/external skips. The standalone
+binary passes 26 isolated process checks, including actual main/router/config,
+service issuance, capacity, revocation, process restart, fresh issuance and
+disabled-profile behavior; fixture diagnostics omit synthetic private inputs.
+The HTTPS human PKCE flow and revocation during directory lookups also pass.
+An isolated control omitting the revoked-state predicate fails seven intended
+checks. This closes source task T02 only. T01 independent issuer/profile review,
+T03 native admission and all existing consumer operation/effect bindings remain
+open. Evidence is retained by CUST-WP-0080 under keycape-token-status-r1.
+
+## Provide the shared producer client and owner-private command observations
+
+```task
+id: KEY-WP-0042-T04
+status: done
+priority: high
+state_hub_task_id: "4c71c9f7-8e14-5fec-8491-d7a7995f97e2"
+```
+
+2026-10-18 source outcome: `internal/authclient/online.go` owns strict current
+token/status joining, explicit HTTPS/CA/JWKS/current-credential admission,
+identity-first credential access, per-check rereads, response/clock/lifetime
+rechecks and independent read-only inactive observation. The existing executable
+exposes `check-current-token`, `revoke-token`, `check-inactive-token`, with exact
+token digest binding and new private observation outputs outside Git. Negative
+output is explicitly inactive-for-client, never global revocation/ownership.
+The public five-file Go adapter is generated from the same client and JOSE bytes;
+ordinary source checks refuse drift. Source/contract: `docs/current-token-client.md`.
+
+The full source race suite passes 724 test/subtest results with the same six
+native/external skips. Human PKCE tests retain actual subject/assurance/auth-time/
+tenant provenance and refuse ID-token substitution. A separate source fixture
+uses the built CLI, generated Go consumer and actual Warden kernel across fresh
+owner processes, with real fixture HTTPS status and independent negative cleanup
+checks. Owner approvals/case/catalog and target are synthetic; there is no native
+admission or second real application acceptance. The first CLI fixture's directory
+permissions, archive-only Warden Git metadata failure and original API absence are
+retained as failures, not backfilled successes. Source/evidence:
+`the-custodian/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/`.
+T01 independent issuer/profile review, T03 native lifecycle, NK48/Apps actual
+operation/inverse/ongoing-resource bindings and all full target gates remain open.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/Makefile b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/Makefile
new file mode 100644
index 0000000..512fa11
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/Makefile
@@ -0,0 +1,35 @@
+IMAGE_REGISTRY ?= 92.205.130.254:32166
+IMAGE_REPO     ?= coulomb/key-cape
+IMAGE_TAG      ?= latest
+IMAGE          := $(IMAGE_REGISTRY)/$(IMAGE_REPO):$(IMAGE_TAG)
+
+.PHONY: dev seed build test lint contract-test image push image-tag
+
+PLAYBOOK_VALIDATOR ?= ../net-kingdom/tools/playbook-capability-contract/playbook_contract_validator.py
+
+dev:
+	docker compose -f docker-compose.dev.yml up
+
+seed:
+	docker compose -f docker-compose.dev.yml exec lldap /scripts/seed.sh
+
+build:
+	cd src && go build ./...
+
+test:
+	cd src && go test ./...
+
+lint:
+	cd src && go vet ./...
+
+contract-test:
+	python3 $(PLAYBOOK_VALIDATOR) capabilities/playbooks/*.yaml
+
+image:
+	docker build -t $(IMAGE) .
+
+push: image
+	docker push $(IMAGE)
+
+image-tag:
+	docker tag $(IMAGE) $(IMAGE_REGISTRY)/$(IMAGE_REPO):$(IMAGE_TAG)
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/docs/online-token-status.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/docs/online-token-status.md
new file mode 100644
index 0000000..331e6df
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/docs/online-token-status.md
@@ -0,0 +1,119 @@
+# Optional online access-token status
+
+Source proposal under KEY-WP-0042, driven by CUST-WP-0080 and existing
+NK-WP-0048-T34/T42/T43 and RAPPS-WP-0016-T08/T09. Independent issuer/consumer
+contract review and native admission remain required. Existing deployments are
+unchanged. This extends the bounded issuer; it does not introduce a broker,
+approval store, PDP, or a second application-local token registry.
+
+The legacy profile authenticates self-contained JWTs until expiry. That does
+not establish that an operation's initiating token is still unrevoked. The
+optional profile adds issuer-owned current access-token status using
+[RFC 7662](https://www.rfc-editor.org/rfc/rfc7662.html) introspection and
+[RFC 7009](https://www.rfc-editor.org/rfc/rfc7009.html) revocation. It supports
+access tokens only, without refresh tokens or token exchange.
+
+## Enablement and lifecycle
+
+Owner-admitted configuration opts in explicitly:
+
+```yaml
+tokenStatus:
+  enabled: true
+  maxEntries: 10000
+```
+
+The issuer must use HTTPS at its existing trusted ingress. The server's internal
+HTTP listener and reverse-proxy topology are unchanged; direct HTTP exposure is
+not admitted by an HTTPS issuer string. Omitted configuration keeps the existing
+expiry-only token/UserInfo contract and advertises no new endpoints. Enabling
+status registers `/introspect` and `/revoke`, advertises their implemented client
+authentication methods, and connects the same store to issuance and UserInfo.
+
+Human PKCE and service grants add a cryptographically random `jti` to each access
+token. ID-token claims and existing assurance/tenant provenance remain unchanged.
+Distinct grants in the same second have distinct bearer tokens: a new grant can
+never remint a revoked token. A successful response is emitted only after the
+token hash, expiry and current registration commitment have been recorded. No
+bearer, client secret or identity/group snapshot is retained in the status store.
+
+The store is bounded to the configured count (default 10000, maximum 1000000).
+Live records and revocation tombstones are never evicted to admit another grant;
+capacity exhaustion refuses issuance with a fixed 503. Expired entries are
+collected when admitting a new token. Capacity and per-client ingress rate limits
+need workload-representative admission: this is not a throughput/availability
+claim or protection against an authorized client filling the bound.
+
+This profile uses KeyCape's existing **single-instance topology**. Status is
+process-local. Restart, deployment, rollback or store loss makes every earlier
+token inactive at online endpoints, even if its JWT signature/expiry still
+validates offline. Consumers must reauthenticate; there is no recovery replay
+or token-state import that can resurrect revoked authority. Multiple replicas
+are unsupported. Native admission must include this interruption and the
+measured reauthentication/recovery procedure. A persisted/shared store is not
+introduced here.
+
+## Introspection and revocation
+
+Both endpoints accept POST form bodies only, bound to 64 KiB; token values are
+bound to 32 KiB. Query parameters, duplicate form or authentication fields,
+unsupported content types and malformed authentication refuse without echoing
+input. Responses use `Cache-Control: no-store` and `Pragma: no-cache`.
+
+Introspection requires the existing registered confidential client's
+`client_secret_basic` authentication. Only that client's own issued tokens can
+be inspected. A separate resource audience is returned as `aud`, not confused
+with the issuing `client_id`. Cross-client resource-server delegation needs a
+separately reviewed authorization contract and is not implicitly granted by a
+matching audience string. Public clients cannot enumerate token status.
+
+An active response means the exact access token was issued in this process,
+has not expired or been revoked, still matches its current complete registration,
+and passes current issuer/signature/purpose validation. For humans, directory
+lookup must succeed and the current account must be enabled and not suspended.
+Status is checked again after directory lookup. Service subjects remain bound
+to their current registration. Active output contains only standard access-token
+metadata; inactive output contains only `active: false`. Unknown tokens, ID
+tokens, altered tokens, another client's tokens and expired/revoked tokens all
+return that same inactive response to an authenticated introspector.
+
+Revocation authenticates confidential clients using the same method. A registered
+public client may revoke its own token using `client_id` plus possession of that
+bearer; public-client introspection remains unavailable. Revocation only affects
+the exact token issued to that client. Unknown, other-client, expired and already
+revoked tokens all produce the same empty 200. No token existence is disclosed.
+Token-type hints do not bypass the actual access-token lookup. Removal or changes
+to a registration invalidate online status; the commitment explicitly includes
+the secret digest and internal token lifetime omitted from public Client JSON.
+
+When enabled, actual UserInfo consults the same store before lookup and again
+after it. Revocation therefore affects that existing endpoint immediately on its
+next check. Ordinary login/logout and upstream Authelia sessions are distinct:
+neither browser logout nor deleting a local cookie is represented as global
+JWT revocation.
+
+## Consumer contract and remaining acceptance
+
+Online status establishes current access-token status, not permission
+for an application resource or privileged effect. Consumers still independently
+validate the actual signed token, admitted issuer/key/audience/type, subject,
+tenant, principal type, assurance and freshness. The authenticated introspection
+response must refer to that exact token/client. Obtain a new current response
+before each protected operation; unavailable, malformed, inactive or ambiguous
+responses refuse. A cached positive is not a current-session check.
+
+Access Engine retains resource/action decisions, Approval Engine exact one-shot
+approval, Warden admission and owner adapters execution. Bind their existing
+descriptor, case, transaction and exact effect before dispatch. A separate new
+operation/inverse token must be acquired and revoked on every terminal path;
+renewed authentication cannot revive a consumed approval or replay a mutation.
+This issuer capability alone implements none of those consumer bindings.
+
+Native completion still requires independent issuer/profile review, exact
+image/config/trust admission, bounded retained-token custody, real human/service
+issuance, private transport, current-token/revocation integration in each owner,
+all exit-path cleanup, restart/expiry/unavailable/refusal checks, ongoing
+HTTP/API/Git/SSH authorization and audit evidence. Offline consumers which never
+consult the endpoint retain their existing JWT validity; no estate-wide immediate
+revocation claim follows from source implementation. Disabling the feature is
+not an acceptable fallback for a consumer admitted under the online profile.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/cmd/keycape/main.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/cmd/keycape/main.go
new file mode 100644
index 0000000..a30559b
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/cmd/keycape/main.go
@@ -0,0 +1,488 @@
+// keycape is the main server binary for the KeyCape IAM profile service.
+// It orchestrates Authelia, LLDAP, and privacyIDEA to implement the
+// NetKingdom IAM Profile (OIDC/PKCE Authorization Code Flow).
+package main
+
+import (
+	"context"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"flag"
+	"fmt"
+	"keycape/internal/server/readiness"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"keycape/internal/adapters/authelia"
+	"keycape/internal/adapters/lldap"
+	"keycape/internal/adapters/privacyidea"
+	"keycape/internal/adapters/tenantengine"
+	"keycape/internal/authclient"
+	"keycape/internal/config"
+	"keycape/internal/domain"
+	servererrors "keycape/internal/server/errors"
+	"keycape/internal/server/oidc"
+	"keycape/internal/server/policy"
+	"keycape/internal/server/telemetry"
+)
+
+const version = "0.1.0"
+
+func main() {
+	if len(os.Args) > 1 && os.Args[1] == "check-config" {
+		os.Exit(runCheckConfig(os.Args[2:], os.Stdout))
+	}
+
+	if len(os.Args) > 1 && os.Args[1] == "probe-upstream-issuer" {
+		if err := authelia.RunIssuerProbe(context.Background(), os.Args[2:], os.Stdout); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		return
+	}
+
+	if len(os.Args) > 1 && (os.Args[1] == "login" || os.Args[1] == "service-token" || os.Args[1] == "verify-client") {
+		if err := authclient.Run(context.Background(), os.Args[1:], os.Stderr); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		return
+	}
+
+	log := zerolog.New(os.Stdout).With().Timestamp().Logger()
+
+	// -----------------------------------------------------------------
+	// 1. Parse flags and load config.
+	// -----------------------------------------------------------------
+	var cfgPath string
+	flag.StringVar(&cfgPath, "config", "", "path to YAML config file (env: KEYCAPE_CONFIG)")
+	flag.Parse()
+
+	cfg, err := config.Load(cfgPath)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to load config")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 2. Validate config.
+	// -----------------------------------------------------------------
+	errs := config.ValidateConfig(cfg)
+	if len(errs) > 0 {
+		log.Error().Strs("errors", errs).Msg("config validation failed")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 3. Load RSA private key.
+	// -----------------------------------------------------------------
+	privateKey, err := loadPrivateKey(cfg.PrivateKeyPEM)
+	if err != nil {
+		log.Error().Err(err).Str("path", cfg.PrivateKeyPEM).Msg("failed to load private key")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 4. Build JWKS from public key.
+	// -----------------------------------------------------------------
+	ks := oidc.NewKeySet()
+	ks.AddKey("key-1", &privateKey.PublicKey)
+
+	// -----------------------------------------------------------------
+	// 5. Build client registry.
+	// -----------------------------------------------------------------
+	clients, err := buildClientRegistry(cfg.Clients)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to build client registry")
+		os.Exit(1)
+	}
+
+	// -----------------------------------------------------------------
+	// 6. Create adapters.
+	// -----------------------------------------------------------------
+	lldapAdapter := lldap.New(cfg.LLDAP)
+	autheliaAdapter := authelia.New(cfg.Authelia, nil)
+	privacyIDEAAdapter := privacyidea.New(cfg.PrivacyIDEA, nil)
+
+	// -----------------------------------------------------------------
+	// 7. Create telemetry emitter.
+	// -----------------------------------------------------------------
+	emitter := telemetry.NewLogEmitter(log)
+
+	// -----------------------------------------------------------------
+	// 8. Create enforcement registry.
+	// -----------------------------------------------------------------
+	enforcement := servererrors.DefaultRegistry()
+
+	// -----------------------------------------------------------------
+	// 9. Create session store.
+	// -----------------------------------------------------------------
+	sessions := oidc.NewSessionStore()
+
+	// -----------------------------------------------------------------
+	// 10. Parse token lifetime.
+	// -----------------------------------------------------------------
+	tokenLifetime := 15 * time.Minute
+	if cfg.TokenLifetime != "" {
+		d, err := time.ParseDuration(cfg.TokenLifetime)
+		if err != nil {
+			log.Error().Err(err).Str("tokenLifetime", cfg.TokenLifetime).Msg("invalid tokenLifetime")
+			os.Exit(1)
+		}
+		tokenLifetime = d
+	}
+
+	// -----------------------------------------------------------------
+	// 11. Build issuer base URL.
+	// -----------------------------------------------------------------
+	issuer := strings.TrimRight(cfg.Issuer, "/")
+
+	// -----------------------------------------------------------------
+	// 12. Register HTTP handlers.
+	// -----------------------------------------------------------------
+	mux := http.NewServeMux()
+	var tokenStatus *oidc.TokenStatusStore
+	var introspectionEndpoint, revocationEndpoint string
+	if cfg.TokenStatus.Enabled {
+		limit := cfg.TokenStatus.MaxEntries
+		if limit == 0 {
+			limit = 10000
+		}
+		var err error
+		tokenStatus, err = oidc.NewTokenStatusStore(limit)
+		if err != nil {
+			log.Error().Msg("invalid token-status configuration")
+			os.Exit(1)
+		}
+		status := &oidc.TokenStatusHandler{Tokens: tokenStatus, ClientConfig: clients, Users: lldapAdapter, SigningKey: &privateKey.PublicKey, Issuer: issuer}
+		mux.HandleFunc("/introspect", status.Introspect)
+		mux.HandleFunc("/revoke", status.Revoke)
+		introspectionEndpoint, revocationEndpoint = issuer+"/introspect", issuer+"/revoke"
+	}
+
+	// Discovery.
+	mux.Handle("/.well-known/openid-configuration", oidc.NewDiscoveryHandler(oidc.DiscoveryConfig{
+		Issuer:                issuer,
+		AuthorizationEndpoint: issuer + "/authorize",
+		TokenEndpoint:         issuer + "/token",
+		JWKSUri:               issuer + "/jwks",
+		UserinfoEndpoint:      issuer + "/userinfo",
+		EndSessionEndpoint:    issuer + "/logout",
+		IntrospectionEndpoint: introspectionEndpoint,
+		RevocationEndpoint:    revocationEndpoint,
+		Clients:               clients,
+	}))
+
+	// JWKS.
+	mux.Handle("/jwks", oidc.NewJWKSHandler(ks))
+
+	// Authorize handler (with enforcement middleware).
+	logins := oidc.NewLoginSessionStore()
+	authorizeHandler := &oidc.AuthorizeHandler{
+		AccountPortalURL: cfg.AccountPortalURL,
+		ClientConfig:     clients,
+		Auth:             autheliaAdapter,
+		MFA:              privacyIDEAAdapter,
+		Sessions:         sessions,
+		Logins:           logins,
+		Handoffs:         oidc.NewHandoffStore(),
+		Issuer:           issuer,
+		Emitter:          emitter,
+		Users:            lldapAdapter,
+	}
+	if path := os.Getenv("KEYCAPE_POLICY_PATH"); path != "" {
+		policies, err := policy.Open(path, clients)
+		if err != nil {
+			log.Error().Msg("authentication policy store unavailable")
+			os.Exit(1)
+		}
+		authorizeHandler.EffectivePolicy = policies.Effective
+		mux.Handle("/platform/authentication-policy", policy.Handler(policies, issuer, &privateKey.PublicKey))
+	}
+	mux.Handle("/authorize", enforcement.Middleware(authorizeHandler))
+	mux.Handle("/authorize/callback", authorizeHandler)
+	mux.Handle("/authorize/return", authorizeHandler)
+	mux.Handle("/authorize/register", authorizeHandler)
+	mux.Handle("/logout", &oidc.LogoutHandler{
+		ClientConfig: clients,
+		Logins:       logins,
+		SecureCookie: strings.HasPrefix(strings.ToLower(issuer), "https://"),
+	})
+
+	if cfg.AccountPortalURL != "" {
+		mux.Handle("/account/logout", &oidc.AccountLogoutHandler{
+			PortalURL: cfg.AccountPortalURL, UpstreamLogoutURL: cfg.BrowserLogoutURL,
+			Logins: logins, Issuer: issuer,
+		})
+	}
+
+	// Token handler (with enforcement middleware).
+	tokenHandler := &oidc.TokenHandler{
+		ClientConfig:  clients,
+		Sessions:      sessions,
+		Users:         lldapAdapter,
+		SigningKey:    privateKey,
+		Issuer:        issuer,
+		TokenLifetime: tokenLifetime,
+		Emitter:       emitter,
+		// Opt-in: nil unless tenantEngine.baseURL is configured, which is what
+		// leaves tenant_roles off the stock server (KEY-WP-0024). The adapter
+		// fails open, so a configured-but-unreachable cache omits the claim
+		// rather than failing issuance.
+		TenantEngine: buildTenantEngine(cfg.TenantEngine),
+		Tokens:       tokenStatus,
+	}
+	mux.Handle("/token", enforcement.Middleware(tokenHandler))
+
+	// Userinfo handler.
+	mux.Handle("/userinfo", &oidc.UserinfoHandler{
+		Users:        lldapAdapter,
+		SigningKey:   &privateKey.PublicKey,
+		Issuer:       issuer,
+		Emitter:      emitter,
+		Tokens:       tokenStatus,
+		ClientConfig: clients,
+	})
+
+	// Healthz.
+	// /readyz gates traffic on the dependencies a login needs; /healthz stays a
+	// liveness signal (KEY-WP-0025). Restarting KeyCape because LLDAP blinked
+	// would convert a dependency blip into an outage of our own, so the two must
+	// not be the same endpoint.
+	mux.Handle("/readyz", readiness.New(2*time.Second, 3*time.Second,
+		readiness.Check{Name: "lldap", Probe: func(ctx context.Context) error {
+			return lldapAdapter.Ping(ctx)
+		}},
+		readiness.Check{Name: "authelia", Probe: httpReachable(cfg.Authelia.TokenBaseURL, cfg.Authelia.BaseURL)},
+		readiness.Check{Name: "privacyidea", Probe: httpReachable(cfg.PrivacyIDEA.BaseURL)},
+		readiness.Check{Name: "factor_reader", Probe: privacyIDEAAdapter.Probe},
+	))
+
+	// Liveness only: this says the process is up, and deliberately probes
+	// nothing. See /readyz.
+	mux.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(map[string]string{
+			"status":  "ok",
+			"version": version,
+		})
+	})
+
+	// Inject emitter into request context.
+	handler := withEmitter(mux, emitter)
+
+	// -----------------------------------------------------------------
+	// 13. Start HTTP server.
+	// -----------------------------------------------------------------
+	addr := fmt.Sprintf(":%d", cfg.Port)
+	if cfg.Port == 0 {
+		addr = ":8080"
+	}
+
+	log.Info().
+		Str("issuer", issuer).
+		Str("addr", addr).
+		Str("environment", cfg.Environment).
+		Str("version", version).
+		Msg("starting keycape server")
+
+	srv := &http.Server{
+		Addr:         addr,
+		Handler:      handler,
+		ReadTimeout:  30 * time.Second,
+		WriteTimeout: 30 * time.Second,
+		IdleTimeout:  120 * time.Second,
+	}
+
+	// Serve in the background so shutdown can be driven by a signal. Without
+	// this the process died on SIGTERM mid-request, so every rolling restart
+	// returned errors to whoever was logging in at that moment.
+	serveErr := make(chan error, 1)
+	go func() {
+		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			serveErr <- err
+			return
+		}
+		serveErr <- nil
+	}()
+
+	signals := make(chan os.Signal, 1)
+	signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
+
+	select {
+	case err := <-serveErr:
+		if err != nil {
+			log.Error().Err(err).Msg("server error")
+			os.Exit(1)
+		}
+	case sig := <-signals:
+		log.Info().Str("signal", sig.String()).Msg("shutting down")
+		// In-flight requests get a bounded window to finish. In-memory login and
+		// authorization state does not survive this and is not meant to: a
+		// browser mid-login must start again after a restart. That is a
+		// documented limit of the single-replica topology, not a bug to paper
+		// over here -- see docs/operations.md.
+		ctx, cancel := context.WithTimeout(context.Background(), shutdownGrace)
+		defer cancel()
+		if err := srv.Shutdown(ctx); err != nil {
+			log.Error().Err(err).Msg("graceful shutdown failed; exiting anyway")
+			os.Exit(1)
+		}
+		log.Info().Msg("shutdown complete")
+	}
+}
+
+// shutdownGrace bounds how long in-flight requests may finish after a signal.
+// Kept under the 30s read/write timeouts so a stuck request cannot outlive the
+// window an orchestrator typically allows before sending SIGKILL.
+const shutdownGrace = 15 * time.Second
+
+// httpReachable probes the first non-empty URL with a GET, reporting whether the
+// dependency answered at all. It is a reachability check, not a functional one:
+// any HTTP response means something is listening and speaking HTTP there.
+func httpReachable(candidates ...string) func(context.Context) error {
+	target := ""
+	for _, candidate := range candidates {
+		if candidate != "" {
+			target = candidate
+			break
+		}
+	}
+	return func(ctx context.Context) error {
+		if target == "" {
+			return fmt.Errorf("no endpoint configured")
+		}
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, target, nil)
+		if err != nil {
+			return err
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return err
+		}
+		defer resp.Body.Close()
+		return nil
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+// loadPrivateKey reads a PEM file and parses the RSA private key.
+// Supports both PKCS#1 ("RSA PRIVATE KEY") and PKCS#8 ("PRIVATE KEY") PEM blocks.
+func loadPrivateKey(path string) (*rsa.PrivateKey, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read key file: %w", err)
+	}
+
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, fmt.Errorf("no PEM block found in %q", path)
+	}
+
+	switch block.Type {
+	case "RSA PRIVATE KEY":
+		key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("parse PKCS1 private key: %w", err)
+		}
+		return key, nil
+	case "PRIVATE KEY":
+		key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("parse PKCS8 private key: %w", err)
+		}
+		rsaKey, ok := key.(*rsa.PrivateKey)
+		if !ok {
+			return nil, fmt.Errorf("private key is not an RSA key")
+		}
+		return rsaKey, nil
+	default:
+		return nil, fmt.Errorf("unexpected PEM block type %q; expected RSA PRIVATE KEY or PRIVATE KEY", block.Type)
+	}
+}
+
+// buildClientRegistry converts []ClientConfig into the map used by handlers.
+func buildClientRegistry(cfgClients []config.ClientConfig) (map[string]*domain.Client, error) {
+	return buildClientRegistryWith(cfgClients, os.Getenv)
+}
+
+// buildClientRegistryWith resolves env: secretRefs through getenv, so
+// check-config can build the registry without any secret value.
+func buildClientRegistryWith(cfgClients []config.ClientConfig, getenv func(string) string) (map[string]*domain.Client, error) {
+	m := make(map[string]*domain.Client, len(cfgClients))
+	for i := range cfgClients {
+		c := &cfgClients[i]
+		clientSecret := ""
+		var clientTokenLifetime time.Duration
+		if strings.HasPrefix(c.SecretRef, "env:") {
+			envName := strings.TrimPrefix(c.SecretRef, "env:")
+			clientSecret = getenv(envName)
+			if clientSecret == "" {
+				return nil, fmt.Errorf("client %q secret environment variable %q is empty", c.ClientID, envName)
+			}
+		}
+		if c.TokenLifetime != "" {
+			parsedLifetime, parseErr := time.ParseDuration(c.TokenLifetime)
+			if parseErr != nil {
+				return nil, fmt.Errorf("client %q tokenLifetime is invalid: %w", c.ClientID, parseErr)
+			}
+			clientTokenLifetime = parsedLifetime
+		}
+		m[c.ClientID] = &domain.Client{
+			ClientID:        c.ClientID,
+			DisplayName:     c.DisplayName,
+			RedirectURIs:    c.RedirectURIs,
+			AllowedScopes:   c.AllowedScopes,
+			GrantTypes:      c.GrantTypes,
+			ClientType:      c.ClientType,
+			SecretRef:       c.SecretRef,
+			ClientSecret:    clientSecret,
+			Audience:        c.Audience,
+			ServiceSubject:  c.ServiceSubject,
+			Tenant:          c.Tenant,
+			Roles:           c.Roles,
+			TokenLifetime:   clientTokenLifetime,
+			MFARequired:     c.MFARequired,
+			MFAOptional:     c.MFAOptional,
+			RegistrationURL: c.RegistrationURL,
+			EnrollmentURL:   c.EnrollmentURL,
+			SignInDiagnosis: c.SignInDiagnosis,
+		}
+	}
+	return m, nil
+}
+
+// withEmitter wraps a handler to inject the telemetry emitter into every request context.
+func withEmitter(next http.Handler, e telemetry.Emitter) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := telemetry.WithEmitter(context.Background(), e)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// buildTenantEngine returns the tenant_roles cache client, or nil when the
+// claim is not configured. Validation has already accepted the URL and timeout.
+func buildTenantEngine(cfg config.TenantEngineConfig) *tenantengine.Client {
+	if cfg.BaseURL == "" {
+		return nil
+	}
+	var httpClient *http.Client
+	if cfg.Timeout != "" {
+		if timeout, err := time.ParseDuration(cfg.Timeout); err == nil {
+			httpClient = &http.Client{Timeout: timeout}
+		}
+	}
+	return tenantengine.New(cfg.BaseURL, httpClient)
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/internal/authclient/cli.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/internal/authclient/cli.go
new file mode 100644
index 0000000..2b0417e
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/internal/authclient/cli.go
@@ -0,0 +1,230 @@
+package authclient
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// Run executes a caller command. Output contains only instructions or status.
+func Run(ctx context.Context, args []string, stderr io.Writer) error {
+	if len(args) == 0 {
+		return errors.New("expected login, service-token or verify-client")
+	}
+	mode := args[0]
+	if mode == "verify-client" {
+		return verifyClient(ctx, args[1:], stderr)
+	}
+	if mode != "login" && mode != "service-token" {
+		return errors.New("unknown authentication command")
+	}
+	fs := flag.NewFlagSet(mode, flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	issuer := fs.String("issuer", "", "HTTPS issuer")
+	id := fs.String("client-id", "", "registered client ID")
+	audience := fs.String("audience", "", "expected access audience (defaults to client ID)")
+	scope := fs.String("scope", "", "space-separated registered scopes")
+	secretEnv := fs.String("secret-env", "", "environment variable containing service client secret")
+	out := fs.String("out", "", "new private JSON token file outside Git")
+	redirect := fs.String("redirect-uri", "", "exact registered HTTP loopback callback (login only)")
+	if err := fs.Parse(args[1:]); err != nil {
+		return err
+	}
+	if fs.NArg() != 0 || *id == "" || *out == "" || strings.TrimSpace(*scope) == "" {
+		return errors.New("client-id, scope and out are required; positional arguments are not accepted")
+	}
+	if *audience == "" {
+		*audience = *id
+	}
+	if mode == "login" && (*secretEnv != "" || !hasScope(*scope, "openid")) {
+		return errors.New("login requires openid scope and a public PKCE client")
+	}
+	if mode == "service-token" && (*secretEnv == "" || *redirect != "") {
+		return errors.New("service-token requires secret-env and does not accept redirect-uri")
+	}
+	c, err := New(*issuer)
+	if err != nil {
+		return err
+	}
+	file, err := reserveOutput(*out)
+	if err != nil {
+		return err
+	}
+	success := false
+	defer func() {
+		file.Close()
+		if !success {
+			os.Remove(file.Name())
+		}
+	}()
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Minute)
+	defer cancel()
+	d, err := c.Discover(ctx)
+	if err != nil {
+		return err
+	}
+	var tokens Tokens
+	if mode == "service-token" {
+		secret := os.Getenv(*secretEnv)
+		if secret == "" {
+			return errors.New("client secret environment variable is empty")
+		}
+		tokens, err = c.Exchange(ctx, d, url.Values{"grant_type": {"client_credentials"}, "scope": {*scope}}, *id, secret, *audience, "")
+	} else {
+		tokens, err = c.Login(ctx, d, *id, *audience, *scope, *redirect, stderr)
+	}
+	if err != nil {
+		return err
+	}
+	if err = json.NewEncoder(file).Encode(tokens); err != nil {
+		return errors.New("could not write token file")
+	}
+	if err = file.Sync(); err != nil {
+		return errors.New("could not sync token file")
+	}
+	if err = file.Close(); err != nil {
+		return errors.New("could not close token file")
+	}
+	success = true
+	fmt.Fprintln(stderr, "Verified tokens saved to the requested private file.")
+	return nil
+}
+
+func reserveOutput(path string) (*os.File, error) {
+	absolute, err := filepath.Abs(path)
+	if err != nil {
+		return nil, errors.New("invalid output path")
+	}
+	parent, err := filepath.EvalSymlinks(filepath.Dir(absolute))
+	if err != nil {
+		return nil, errors.New("output directory must already exist")
+	}
+	for dir := parent; ; dir = filepath.Dir(dir) {
+		marker := filepath.Join(dir, ".git")
+		info, statErr := os.Lstat(marker)
+		if statErr == nil {
+			// A worktree uses a .git file; normal repositories have .git/HEAD.
+			// An empty directory alone is not a Git repository.
+			if !info.IsDir() {
+				return nil, errors.New("token output must be outside Git worktrees")
+			}
+			if _, err := os.Lstat(filepath.Join(marker, "HEAD")); err == nil {
+				return nil, errors.New("token output must be outside Git worktrees")
+			} else if !os.IsNotExist(err) {
+				return nil, errors.New("could not inspect Git directory")
+			}
+		} else if !os.IsNotExist(statErr) {
+			return nil, errors.New("could not inspect output directory")
+		}
+		if filepath.Dir(dir) == dir {
+			break
+		}
+	}
+	file, err := os.OpenFile(filepath.Join(parent, filepath.Base(absolute)), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	if err != nil {
+		return nil, errors.New("output file must be new and writable")
+	}
+	return file, nil
+}
+
+// Login binds the exact registered IPv4/IPv6 loopback address before offering
+// the browser URL. State, nonce and PKCE are independently generated per attempt.
+func (c *Client) Login(ctx context.Context, d Discovery, id, audience, scope, redirect string, output io.Writer) (Tokens, error) {
+	callback, err := url.Parse(redirect)
+	if err != nil || callback.Scheme != "http" || callback.User != nil || callback.RawQuery != "" || callback.Fragment != "" || callback.Port() == "" || callback.Port() == "0" || callback.Path == "" {
+		return Tokens{}, errors.New("redirect-uri must be an exact HTTP loopback URL with a fixed port and path")
+	}
+	ip := net.ParseIP(callback.Hostname())
+	if ip == nil || !ip.IsLoopback() {
+		return Tokens{}, errors.New("callback must use a literal loopback IP address")
+	}
+	listener, err := net.Listen("tcp", callback.Host)
+	if err != nil {
+		return Tokens{}, errors.New("could not bind registered callback")
+	}
+	defer listener.Close()
+	state, err := randomValue()
+	if err != nil {
+		return Tokens{}, err
+	}
+	nonce, err := randomValue()
+	if err != nil {
+		return Tokens{}, err
+	}
+	verifier, err := randomValue()
+	if err != nil {
+		return Tokens{}, err
+	}
+	challenge := sha256.Sum256([]byte(verifier))
+	type callbackResult struct {
+		code string
+		err  error
+	}
+	result := make(chan callbackResult, 1)
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		if r.Method != http.MethodGet || r.URL.Path != callback.Path || r.Host != callback.Host {
+			http.Error(w, "Invalid callback", 400)
+			return
+		}
+		q, err := url.ParseQuery(r.URL.RawQuery)
+		if err != nil || len(q["state"]) != 1 || subtle.ConstantTimeCompare([]byte(q.Get("state")), []byte(state)) != 1 {
+			http.Error(w, "Invalid callback state", 400)
+			return
+		}
+		var value callbackResult
+		if q.Get("error") != "" {
+			value.err = errors.New("login was declined by the identity provider")
+		} else if len(q["code"]) != 1 || q.Get("code") == "" {
+			http.Error(w, "Missing authorization code", 400)
+			return
+		} else {
+			value.code = q.Get("code")
+		}
+		select {
+		case result <- value:
+			fmt.Fprintln(w, "Callback received. Return to the terminal.")
+		default:
+			http.Error(w, "Callback already received", 409)
+		}
+	})
+	server := &http.Server{Handler: handler, ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second, MaxHeaderBytes: 16384}
+	defer server.Close()
+	serveErrors := make(chan error, 1)
+	go func() { serveErrors <- server.Serve(listener) }()
+	authorize, err := url.Parse(d.Authorization)
+	if err != nil {
+		return Tokens{}, errors.New("invalid authorization endpoint")
+	}
+	q := authorize.Query()
+	for name, value := range map[string]string{"client_id": id, "redirect_uri": redirect, "response_type": "code", "scope": scope, "state": state, "nonce": nonce, "code_challenge": base64.RawURLEncoding.EncodeToString(challenge[:]), "code_challenge_method": "S256"} {
+		q.Set(name, value)
+	}
+	authorize.RawQuery = q.Encode()
+	fmt.Fprintf(output, "Open this URL in your browser to authenticate and complete MFA:\n%s\n", authorize.String())
+	select {
+	case <-ctx.Done():
+		return Tokens{}, errors.New("login timed out or was cancelled")
+	case <-serveErrors:
+		return Tokens{}, errors.New("callback listener stopped")
+	case value := <-result:
+		if value.err != nil {
+			return Tokens{}, value.err
+		}
+		return c.Exchange(ctx, d, url.Values{"grant_type": {"authorization_code"}, "client_id": {id}, "code": {value.code}, "code_verifier": {verifier}, "redirect_uri": {redirect}, "scope": {scope}}, id, "", audience, nonce)
+	}
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/internal/jose/jose.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/internal/jose/jose.go
new file mode 100644
index 0000000..14769bb
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/src/internal/jose/jose.go
@@ -0,0 +1,153 @@
+// Package jose provides strict RS256 JWT signature verification against a JWK
+// set. It is deliberately narrow: it establishes that a token was signed by a
+// key in the given set and returns its claims. It applies no claim policy —
+// issuer, audience, expiry and nonce rules differ per caller and belong with
+// the caller that knows them.
+//
+// The strictness here is the point. A verifier that accepts an unexpected
+// algorithm, an unbounded exponent or an undersized modulus is worse than no
+// verifier, because callers stop checking what it appears to guarantee.
+package jose
+
+import (
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"math/big"
+	"strings"
+)
+
+// ErrVerification is returned for every verification failure. The cause is
+// deliberately not distinguished: a caller acting on why a token failed tends to
+// leak that distinction to whoever supplied the token.
+var ErrVerification = errors.New("jose: token verification failed")
+
+// KeySet maps key IDs to RSA public keys.
+type KeySet map[string]*rsa.PublicKey
+
+// ParseJWKS parses a JWK set, keeping only RSA signing keys usable with RS256.
+// Keys that are malformed, too small, or carry an even or trivial exponent are
+// rejected rather than skipped, since a key set that is partly wrong is not
+// evidence of anything.
+func ParseJWKS(raw []byte) (KeySet, error) {
+	var document struct {
+		Keys []struct {
+			Kty string `json:"kty"`
+			Use string `json:"use"`
+			Alg string `json:"alg"`
+			Kid string `json:"kid"`
+			N   string `json:"n"`
+			E   string `json:"e"`
+		} `json:"keys"`
+	}
+	if err := json.Unmarshal(raw, &document); err != nil {
+		return nil, ErrVerification
+	}
+	keys := make(KeySet, len(document.Keys))
+	for _, key := range document.Keys {
+		// Ignore keys for other algorithms or purposes; they are not errors.
+		if key.Kty != "RSA" || (key.Use != "" && key.Use != "sig") || (key.Alg != "" && key.Alg != "RS256") {
+			continue
+		}
+		if key.Kid == "" {
+			return nil, ErrVerification
+		}
+		modulus, errN := decode(key.N)
+		exponent, errE := decode(key.E)
+		if errN != nil || errE != nil || len(exponent) == 0 || len(exponent) > 4 {
+			return nil, ErrVerification
+		}
+		public := &rsa.PublicKey{
+			N: new(big.Int).SetBytes(modulus),
+			E: int(new(big.Int).SetBytes(exponent).Int64()),
+		}
+		if public.N.BitLen() < 2048 || public.E < 3 || public.E%2 == 0 {
+			return nil, ErrVerification
+		}
+		if _, duplicate := keys[key.Kid]; duplicate {
+			return nil, ErrVerification
+		}
+		keys[key.Kid] = public
+	}
+	if len(keys) == 0 {
+		return nil, ErrVerification
+	}
+	return keys, nil
+}
+
+// KeyID returns the key ID from a token's JOSE header, after checking that the
+// header names RS256 and carries no critical extensions. Callers use it to
+// decide whether to refresh their key set before verifying.
+func KeyID(token string) (string, error) {
+	header, _, _, err := split(token)
+	if err != nil {
+		return "", err
+	}
+	return header.Kid, nil
+}
+
+// Verify checks a token's RS256 signature against the key set and returns its
+// claims. It does not inspect any claim.
+func Verify(token string, keys KeySet) (map[string]interface{}, error) {
+	header, signingInput, signature, err := split(token)
+	if err != nil {
+		return nil, err
+	}
+	public, ok := keys[header.Kid]
+	if !ok {
+		return nil, ErrVerification
+	}
+	digest := sha256.Sum256([]byte(signingInput))
+	if rsa.VerifyPKCS1v15(public, crypto.SHA256, digest[:], signature) != nil {
+		return nil, ErrVerification
+	}
+	payload, err := decode(strings.Split(signingInput, ".")[1])
+	if err != nil {
+		return nil, ErrVerification
+	}
+	claims := map[string]interface{}{}
+	if json.Unmarshal(payload, &claims) != nil {
+		return nil, ErrVerification
+	}
+	return claims, nil
+}
+
+type joseHeader struct {
+	Alg  string   `json:"alg"`
+	Kid  string   `json:"kid"`
+	Crit []string `json:"crit"`
+}
+
+// split validates the token's shape and header and returns the header, the
+// signing input, and the decoded signature.
+func split(token string) (joseHeader, string, []byte, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	raw, err := decode(parts[0])
+	if err != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	var header joseHeader
+	if json.Unmarshal(raw, &header) != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	// An unexpected algorithm must fail before any key is selected, so "none"
+	// and symmetric algorithms can never reach the RSA path.
+	if header.Alg != "RS256" || header.Kid == "" || len(header.Crit) != 0 {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	signature, err := decode(parts[2])
+	if err != nil {
+		return joseHeader{}, "", nil, ErrVerification
+	}
+	return header, parts[0] + "." + parts[1], signature, nil
+}
+
+func decode(segment string) ([]byte, error) {
+	return base64.RawURLEncoding.DecodeString(segment)
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/workplans/KEY-WP-0042-online-access-token-status.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/workplans/KEY-WP-0042-online-access-token-status.md
new file mode 100644
index 0000000..66f9094
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/preimages/workplans/KEY-WP-0042-online-access-token-status.md
@@ -0,0 +1,84 @@
+---
+id: KEY-WP-0042
+type: workplan
+title: "Provide issuer-owned current access-token status and scoped revocation"
+domain: infotech
+repo: key-cape
+status: proposed
+owner: codex
+topic_slug: custodian
+created: "2026-10-18"
+updated: "2026-10-18"
+flavor: extension
+depends_on: []
+state_hub_workstream_id: "e2eecd1c-45c7-5a7c-bd1c-d31c845e3d38"
+---
+
+CUST-WP-0080's current-operation/inverse requirement exposed a concrete missing
+issuer facility. KEY-WP-0025-T03 truthfully documents the expiry-only limit;
+KEY-WP-0038 owns Forgejo's existing client, not a token-liveness API. This is an
+explicit proposed scope extension in the existing issuer, not a silent change
+to that completed limit record. No new service or duplicate session authority.
+Consumer binding/authorization and native case acceptance stay in
+NK-WP-0048-T34/T42/T43 and RAPPS-WP-0016-T08/T09; they are not copied here.
+
+## Review the bounded issuer/profile extension
+
+```task
+id: KEY-WP-0042-T01
+status: progress
+priority: high
+state_hub_task_id: "d8af8e77-f6e5-5d0d-8b44-794af3dee5cf"
+```
+
+The reviewable contract is `docs/online-token-status.md`: opt-in RFC 7662/7009
+access-token status; registered owning-client authentication; private hash-only
+bounded state; unique access-token jti; no ID-token change; singleton store-loss
+refusal; disabled legacy behavior explicit. Source preparation is authorized by
+the full Custodian implementation goal. Independent issuer/profile/consumer
+assent remains required before admission; no such assent is inferred here.
+
+## Implement and verify the actual issuer paths
+
+```task
+id: KEY-WP-0042-T02
+status: done
+priority: high
+state_hub_task_id: "2cade51f-d25a-5719-96b4-b57d50c1b97d"
+```
+
+Wire the same issuer store to both actual grant types, UserInfo, introspection,
+revocation, configuration validation and implemented discovery. Verify distinct
+grants, exact expiry, replay/tombstones, capacity, malformed/unauthenticated and
+cross-client refusals, current registration and human disposition, revocation
+during directory lookup, process-store loss and absence of secret output. Keep
+the complete existing source suite, disabled profile and build passing.
+
+## Admit and accept the issuer lifecycle at native scope
+
+```task
+id: KEY-WP-0042-T03
+status: todo
+priority: high
+state_hub_task_id: "a5539bb0-2501-5774-a7d8-acddfb0938ab"
+```
+
+After independent contract review, admit exact issuer image/config/profile,
+HTTPS ingress/client custody and measured capacity/headroom. Exercise real
+human PKCE and service tokens, actual endpoint authentication, revoked-token
+UserInfo refusal, expiry, unavailable dependency, restart/store loss and fresh
+reauthentication. Preserve old offline-token semantics and document every
+consumer's selected mode. Review disabling/rollback explicitly; never silently
+fall back to offline acceptance for online-profile consumers. Provide owner
+receipts to existing NK48/Apps consumer tasks and Audit source admission.
+
+2026-10-18 source verification: all 659 test/subtest results in the complete
+race suite pass, with six preexisting native/external skips. The standalone
+binary passes 26 isolated process checks, including actual main/router/config,
+service issuance, capacity, revocation, process restart, fresh issuance and
+disabled-profile behavior; fixture diagnostics omit synthetic private inputs.
+The HTTPS human PKCE flow and revocation during directory lookups also pass.
+An isolated control omitting the revoked-state predicate fails seven intended
+checks. This closes source task T02 only. T01 independent issuer/profile review,
+T03 native admission and all existing consumer operation/effect bindings remain
+open. Evidence is retained by CUST-WP-0080 under keycape-token-status-r1.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/source-manifest.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/source-manifest.json
new file mode 100644
index 0000000..6f9e25c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/key-cape-source/source-manifest.json
@@ -0,0 +1,112 @@
+{
+  "owner": "key-cape",
+  "base_revision": "git:67a0869c1ee40c9e00a60cb7c1d828734d5d3d32",
+  "files": [
+    {
+      "path": "Makefile",
+      "before_sha256": "sha256:184547fdd0fb7d62ce48c6f7cd904bca2cf62a7dddc78697faa18c6b2dabd59e",
+      "sha256": "sha256:fb7c057286017e18c5a10ce7752f09336becffba3e30d9fb9b6a2467e53dcb50"
+    },
+    {
+      "path": "adapters/go/tokenstatus/LICENSE",
+      "before_sha256": null,
+      "sha256": "sha256:ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
+    },
+    {
+      "path": "adapters/go/tokenstatus/go.mod",
+      "before_sha256": null,
+      "sha256": "sha256:e8b028e1002e63a76dba78a4abbd67882307ad198e4783bad631652061aa0f54"
+    },
+    {
+      "path": "adapters/go/tokenstatus/internal/jose/jose.go",
+      "before_sha256": null,
+      "sha256": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
+    },
+    {
+      "path": "adapters/go/tokenstatus/pkg/tokenstatus/client.go",
+      "before_sha256": null,
+      "sha256": "sha256:f34626a85d67590b9c61474f19ce1021f8afd17093f8f522b3f98e9cef34e575"
+    },
+    {
+      "path": "adapters/go/tokenstatus/producer-source.json",
+      "before_sha256": null,
+      "sha256": "sha256:3bd9b25b912e7c17b331997ca5fee9da8a7c314f336e09e3c116885954799b73"
+    },
+    {
+      "path": "docs/current-token-client.md",
+      "before_sha256": null,
+      "sha256": "sha256:69db63087c752bba0b07b41aa7784484703aacc064181782d15de62310751c4e"
+    },
+    {
+      "path": "docs/online-token-status.md",
+      "before_sha256": "sha256:f5e41b47500b15c80b2da6cbe37a9e64bcbde1c072750934cf74464a19488925",
+      "sha256": "sha256:56064b1c0df5ff9a20d5c205396e7b1b2d0d70785ea7945c999d34b4de3aa1b8"
+    },
+    {
+      "path": "src/cmd/keycape/main.go",
+      "before_sha256": "sha256:2f81ea0b0b33f38298e028d5610625e3834fdf1aa12f6f392579d6207bcf6f1d",
+      "sha256": "sha256:553094de91cfafb021b7607eac1263fa155fedeb32c1e99e7c71e8d86e20ffd0"
+    },
+    {
+      "path": "src/internal/authclient/cli.go",
+      "before_sha256": "sha256:376a8e0d1d60825a8b3ef21d371e3fc353c0a34e461712a6899e264278edbe7f",
+      "sha256": "sha256:009c9ce900524b62483cf4955f3cbacc0dcb9027b8da77924b51b22e3fa5170c"
+    },
+    {
+      "path": "src/internal/authclient/online.go",
+      "before_sha256": null,
+      "sha256": "sha256:182ec3971ded3a7f3923aab7a23b7317de3ec0f657b8da6d9d882a43bcb0961a"
+    },
+    {
+      "path": "src/internal/authclient/online_cli.go",
+      "before_sha256": null,
+      "sha256": "sha256:6763c1e85396726b044067e77179ee2220e397bbd3888ec8de071c2826c6c7f2"
+    },
+    {
+      "path": "src/internal/authclient/online_cli_test.go",
+      "before_sha256": null,
+      "sha256": "sha256:5408a183beda6a885ebae00d3fa420d3fb0d51e4aeb72965fef535d822270c4f"
+    },
+    {
+      "path": "src/internal/authclient/online_export_test.go",
+      "before_sha256": null,
+      "sha256": "sha256:5695f233e4caf581e494087cb203a74613d39a5626bbcc323b9f2d553a96b7ba"
+    },
+    {
+      "path": "src/internal/authclient/online_human_test.go",
+      "before_sha256": null,
+      "sha256": "sha256:e501c30b6d710a6dea89559ccf8b98de68502c2ee58d1778a56e97f1b7f3b6e0"
+    },
+    {
+      "path": "src/internal/authclient/online_test.go",
+      "before_sha256": null,
+      "sha256": "sha256:6288329ca2576f72a361256050c94f9d1995e9fbe53b2a6318da2954bcbc7c6a"
+    },
+    {
+      "path": "src/internal/jose/jose.go",
+      "before_sha256": "sha256:bcfc30d2175735f37e7ea6f58451e122fbdfe02c562805e5a018c863fb677fab",
+      "sha256": "sha256:a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
+    },
+    {
+      "path": "tools/export_tokenstatus_client.py",
+      "before_sha256": null,
+      "sha256": "sha256:c05cc75de87c9d7bd9d184c012c4ab8d273da36934c8908c05d7c72192db218e"
+    },
+    {
+      "path": "workplans/KEY-WP-0042-online-access-token-status.md",
+      "before_sha256": "sha256:6d7ff6dea31b251e261195fff97a2061d56579b5786629d95014f6d1cbe0f55e",
+      "sha256": "sha256:e8b0d15d7461ea34075b4a7f8047af380d96e521f42a0dae6136f6cfdd052b0f"
+    }
+  ],
+  "archive_sha256": "sha256:c1d5701e59068d30e53db22cbf4fcf5ec021371c515ba31efd0aeb5daa23f4b0",
+  "patch_sha256": "sha256:8a5521b8d72c16e3f1397a29a5ce239823f7b15f27604276dd94f412df003508",
+  "replay": {
+    "fuzz": 0,
+    "all_postimages_exact": true,
+    "all_unrelated_archive_files_unchanged": true,
+    "stdout": "patching file Makefile\npatching file adapters/go/tokenstatus/LICENSE\npatching file adapters/go/tokenstatus/go.mod\npatching file adapters/go/tokenstatus/internal/jose/jose.go\npatching file adapters/go/tokenstatus/pkg/tokenstatus/client.go\npatching file adapters/go/tokenstatus/producer-source.json\npatching file docs/current-token-client.md\npatching file docs/online-token-status.md\npatching file src/cmd/keycape/main.go\npatching file src/internal/authclient/cli.go\npatching file src/internal/authclient/online.go\npatching file src/internal/authclient/online_cli.go\npatching file src/internal/authclient/online_cli_test.go\npatching file src/internal/authclient/online_export_test.go\npatching file src/internal/authclient/online_human_test.go\npatching file src/internal/authclient/online_test.go\npatching file src/internal/jose/jose.go\npatching file tools/export_tokenstatus_client.py\npatching file workplans/KEY-WP-0042-online-access-token-status.md\n",
+    "stderr": ""
+  },
+  "independent_owner_assent": false,
+  "native_admission": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-identifiers-assigned.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-identifiers-assigned.json
new file mode 100644
index 0000000..df6e07a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-identifiers-assigned.json
@@ -0,0 +1,20 @@
+{
+  "schema": "repo-manager.identifier-assignment.v1",
+  "ok": true,
+  "executed": true,
+  "repo": "source",
+  "namespace": "helixforge",
+  "assignments": [
+    {
+      "kind": "task",
+      "record_id": "KEY-WP-0042-T04",
+      "uuid": "4c71c9f7-8e14-5fec-8491-d7a7995f97e2",
+      "path": "workplans/KEY-WP-0042-online-access-token-status.md"
+    }
+  ],
+  "historical_invalid_identifiers": [],
+  "historical_identity_collisions": [],
+  "files_changed": [
+    "workplans/KEY-WP-0042-online-access-token-status.md"
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-identifiers-preview.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-identifiers-preview.json
new file mode 100644
index 0000000..5261d09
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-identifiers-preview.json
@@ -0,0 +1,20 @@
+{
+  "schema": "repo-manager.identifier-assignment.v1",
+  "ok": true,
+  "executed": false,
+  "repo": "source",
+  "namespace": "helixforge",
+  "assignments": [
+    {
+      "kind": "task",
+      "record_id": "KEY-WP-0042-T04",
+      "uuid": "4c71c9f7-8e14-5fec-8491-d7a7995f97e2",
+      "path": "workplans/KEY-WP-0042-online-access-token-status.md"
+    }
+  ],
+  "historical_invalid_identifiers": [],
+  "historical_identity_collisions": [],
+  "files_changed": [
+    "workplans/KEY-WP-0042-online-access-token-status.md"
+  ]
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-progress-receipt.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-progress-receipt.json
new file mode 100644
index 0000000..ec9171a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-progress-receipt.json
@@ -0,0 +1,14 @@
+{
+  "workplan_id": "e2eecd1c-45c7-5a7c-bd1c-d31c845e3d38",
+  "id": "c3a2e283-ef41-42e0-bda7-996f38de9434",
+  "topic_id": null,
+  "task_id": "4c71c9f7-8e14-5fec-8491-d7a7995f97e2",
+  "decision_id": null,
+  "event_type": "note",
+  "summary": "Published KeyCape 08c083ba: one current-token client, five-file generated Go adapter with ordinary parity check, and exact-token private current/revoke/inactive CLI observations. 724 full source race test/subtest passes with six existing native/external skips; 45 actual Warden-kernel/HTTPS fixture assertions across fresh processes plus four public Go consumer processes. All 19 source postimages replay exactly; deliberate consumer-only drift refuses. Primary projection/remote main and all four task UUID/status bindings verified. T04 source done; T01 independent review and T03 native admission open. No native gates or second real consumer claimed. Packet keycape-current-client-r1 retains failures and source limits.",
+  "detail": null,
+  "author": "codex",
+  "session_id": null,
+  "created_at": "2026-10-18T09:39:20.641970Z",
+  "workstream_id": "e2eecd1c-45c7-5a7c-bd1c-d31c845e3d38"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-progress-request.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-progress-request.json
new file mode 100644
index 0000000..a35a803
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/keycape-progress-request.json
@@ -0,0 +1,7 @@
+{
+  "summary": "Published KeyCape 08c083ba: one current-token client, five-file generated Go adapter with ordinary parity check, and exact-token private current/revoke/inactive CLI observations. 724 full source race test/subtest passes with six existing native/external skips; 45 actual Warden-kernel/HTTPS fixture assertions across fresh processes plus four public Go consumer processes. All 19 source postimages replay exactly; deliberate consumer-only drift refuses. Primary projection/remote main and all four task UUID/status bindings verified. T04 source done; T01 independent review and T03 native admission open. No native gates or second real consumer claimed. Packet keycape-current-client-r1 retains failures and source limits.",
+  "event_type": "note",
+  "author": "codex",
+  "workplan_id": "e2eecd1c-45c7-5a7c-bd1c-d31c845e3d38",
+  "task_id": "4c71c9f7-8e14-5fec-8491-d7a7995f97e2"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/netkingdom-unit-source.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/netkingdom-unit-source.json
new file mode 100644
index 0000000..ccf1f07
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/netkingdom-unit-source.json
@@ -0,0 +1,4 @@
+{
+  "commit": "git:b3f31d9f26b98a3b92690e0be34a205e49fa3956",
+  "scope": "public committed source for ordinary Warden unit tests; not native authority"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/owner-source.patch b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/owner-source.patch
new file mode 100644
index 0000000..624b9f1
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/owner-source.patch
@@ -0,0 +1,227 @@
+diff --git a/docs/security-case-execution-kernel-v1.md b/docs/security-case-execution-kernel-v1.md
+--- a/docs/security-case-execution-kernel-v1.md
++++ b/docs/security-case-execution-kernel-v1.md
+@@ -152,3 +152,41 @@
+ NetKingdom's current registration adapter still has no reconciliation callback;
+ source tests do not authorize its post-restart undo, replay or a changed caller/
+ session/run-sheet migration. WARDEN-WP-0044-T03 remains a native acceptance gate.
++
++## Current caller versus original session reference — 2026-10-18 source
++
++`Executor.admit` now accepts the optional `original_session_reference` for an
++exact existing original-run continuation. It is metadata, never current
++authentication. The normal `session_evidence` is independently verified as the
++current caller's principal/actor/lane proof, including after restart, and remains
++the evidence rechecked immediately before every journal write/owner callback.
++
++The optional reference preserves the original run-sheet digest rather than
++replacing immutable provenance with the new login. Before admitting it, under
++the existing journal lock, the kernel requires an existing matching step journal
++and `Journal.original_intent` correspondence: the original running receipt,
++attempt, owner/target/principal/actor/lane, all six pins and exact adapter source.
++Missing/orphan/legacy context, a changed reference or caller and a stale current
++session refuse. The reference must differ from the current evidence identifier;
++the actual session owner must additionally establish distinct authenticated
++token/session identity, not just two labels. No new original context is created,
++no completed operation can replay, and uncertainty is not cleared by readmission.
++
++Omitting this option retains the old admission/pin semantics. Supplying a fresh
++session alone still creates a different run sheet and cannot reuse a previous
++journal. No existing descriptor, Invocation, Pins or receipt schema changes.
++The new source seam does not implement changed-source/catalog/caller migration
++or loss of rollback result; those still require the existing owner reconciliation
++and recovery evidence. It is not general session management or another issuer.
++
++A source integration fixture runs the actual producer-owned KeyCape status CLI
++over HTTPS, the actual Warden kernel and a separately compiled generated Go
++consumer. It verifies revoked-parent refusal before writes, distinct inverse
++authentication in another Python process, original journal pin retention,
++no business replay, exact synthetic target restore and independent read-only
++negative cleanup observation. Case/type/catalog/owner attestations and the
++target are synthetic; this is not Forgejo/browser/native acceptance or a real
++approval. KeyCape's proposed online profile remains unadmitted. The private
++unsigned CLI observation is not portable execution authority; actual owner
++custody and original grant ownership are still mandatory before an inactive
++response can establish revocation. No native verifier or adapter is installed.
+diff --git a/src/warden/case_run.py b/src/warden/case_run.py
+--- a/src/warden/case_run.py
++++ b/src/warden/case_run.py
+@@ -663,7 +663,20 @@
+         materialization_evidence: str,
+         descriptor_evidence: str,
+         session_evidence: str,
++        original_session_reference: str | None = None,
+     ) -> tuple[Descriptor, Invocation, StepState]:
++        # Current authentication is distinct from an immutable original receipt
++        # reference. The latter can only resume an exact existing journal intent;
++        # it is never passed to the current-session verifier as authority.
++        receipt_session = session_evidence
++        if original_session_reference is not None:
++            if (
++                type(original_session_reference) is not str
++                or not IDENTIFIER.fullmatch(original_session_reference)
++                or original_session_reference == session_evidence
++            ):
++                raise Refused("distinct original session reference required")
++            receipt_session = original_session_reference
+         for source in (case_source, type_source, descriptor_source, catalog_source):
+             bounded_source(source)
+         descriptor = Descriptor.decode(descriptor_source)
+@@ -781,7 +794,7 @@
+                 acceptance_evidence,
+                 materialization_evidence,
+                 descriptor_evidence,
+-                session_evidence,
++                receipt_session,
+             ],
+             separators=(",", ":"),
+         ).encode()
+@@ -803,6 +816,13 @@
+             descriptor.allowed_created,
+             descriptor.retry_safe,
+         )
++        if original_session_reference is not None:
++            with self.journal.locked():
++                binding = f"{invocation.step}:{invocation.target}"
++                existing = self.journal.load(binding, initial)
++                if not existing.last:
++                    raise Refused("original dispatch journal required; no backfill")
++                self.journal.original_intent(binding, invocation, adapter.source)
+         # Keep the mode and exact authenticated catalog bytes with this admission;
+         # dispatch must not substitute a later ambient catalog or lose its mode.
+         self._admitted[invocation] = (
+diff --git a/tests/test_case_current_session_reference.py b/tests/test_case_current_session_reference.py
+--- /dev/null
++++ b/tests/test_case_current_session_reference.py
+@@ -0,0 +1,105 @@
++"""Current caller authentication never replaces historical dispatch provenance."""
++from dataclasses import replace
++
++import pytest
++
++from tests.test_case_run import make_rig
++from warden.case_receipt_state import Outcome, Refused
++from warden.case_run import Executor, Journal
++
++
++def fresh_verifier(executor, *, allow=True):
++    original = executor.evidence_verifier
++    def verify(purpose, source, evidence):
++        if purpose.startswith("caller-session:") and evidence == "fresh-session":
++            return allow
++        return original(purpose, source, evidence)
++    executor.evidence_verifier = verify
++    return verify
++
++
++def rows(executor):
++    return tuple(executor.journal.db.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0]
++                 for table in ("receipts", "intents"))
++
++
++def readmit(executor, sources, kwargs, reference="session"):
++    return executor.admit(*sources, **{**kwargs, "session_evidence": "fresh-session",
++                                      "original_session_reference": reference})
++
++
++def test_normal_new_session_cannot_rewrite_original_journal_pins(tmp_path):
++    executor, admitted, _, sources, kwargs = make_rig(tmp_path)
++    executor.run(*admitted)
++    fresh_verifier(executor)
++    before = rows(executor)
++    changed = executor.admit(*sources, **{**kwargs,"session_evidence":"fresh-session"})
++    assert changed[1].pins != admitted[1].pins
++    with pytest.raises(Refused,match="journal pins changed"):
++        executor.rollback(*changed)
++    assert rows(executor) == before
++
++
++def test_fresh_process_inverse_retains_original_pins_without_replay(tmp_path):
++    executor, admitted, calls, sources, kwargs = make_rig(tmp_path)
++    assert executor.run(*admitted).last.outcome is Outcome.SUCCESS
++    before = rows(executor)
++    fresh = Executor(Journal(executor.journal.directory), executor.adapters,
++                     fresh_verifier(executor))
++    renewed = readmit(fresh, sources, kwargs)
++    assert renewed[1].pins == admitted[1].pins
++    assert rows(fresh) == before
++    with pytest.raises(Refused):
++        fresh.run(*renewed)
++    assert len(calls) == 1
++    assert fresh.rollback(*renewed).last.outcome is Outcome.ROLLED_BACK
++
++
++@pytest.mark.parametrize("kind", ["missing-intent", "orphan-intent", "wrong-principal", "wrong-reference", "same-as-current", "invalid-reference", "inactive-current"])
++def test_original_reference_is_never_authentication_or_new_intent(tmp_path, kind):
++    executor, admitted, calls, sources, kwargs = make_rig(tmp_path)
++    if kind != "missing-intent":
++        executor.run(*admitted)
++    if kind == "orphan-intent":
++        executor.journal.db.execute("DELETE FROM intents")
++    if kind == "wrong-principal":
++        kwargs = {**kwargs,"principal":"another-operator"}
++    fresh_verifier(executor, allow=kind != "inactive-current")
++    before = rows(executor)
++    reference = {"wrong-reference": "unrelated-session", "same-as-current": "fresh-session",
++                 "invalid-reference": "not valid"}.get(kind, "session")
++    with pytest.raises(Refused):
++        readmit(executor, sources, kwargs, reference)
++    assert rows(executor) == before
++
++
++def test_unknown_effect_stays_unknown_after_current_readmission(tmp_path):
++    executor, admitted, calls, sources, kwargs = make_rig(tmp_path)
++    old = executor.adapters[admitted[0].adapter]
++    def interrupted(inv):
++        calls.append(inv)
++        raise KeyboardInterrupt
++    executor.adapters[old.reference] = replace(old, invoke=interrupted)
++    with pytest.raises(KeyboardInterrupt):
++        executor.run(*admitted)
++    fresh_verifier(executor)
++    before = rows(executor)
++    renewed = readmit(executor, sources, kwargs)
++    assert rows(executor) == before
++    with pytest.raises(Refused):
++        executor.run(*renewed, retry=True)
++    state = executor.journal.load("mint-secret:fixture-client", renewed[2])
++    assert state.last.outcome is Outcome.UNCERTAIN
++    assert len(calls) == 1
++
++
++def test_current_session_revalidated_after_readmission_before_journal_write(tmp_path):
++    executor, admitted, _, sources, kwargs = make_rig(tmp_path)
++    executor.run(*admitted)
++    fresh_verifier(executor)
++    renewed = readmit(executor, sources, kwargs)
++    executor.evidence_verifier = lambda *_: False
++    before = rows(executor)
++    with pytest.raises(Refused, match="caller session no longer verified"):
++        executor.rollback(*renewed)
++    assert rows(executor) == before
+diff --git a/workplans/WARDEN-WP-0044-security-case-follow-through.md b/workplans/WARDEN-WP-0044-security-case-follow-through.md
+--- a/workplans/WARDEN-WP-0044-security-case-follow-through.md
++++ b/workplans/WARDEN-WP-0044-security-case-follow-through.md
+@@ -151,6 +151,22 @@
+ 
+ ### T03 — Run and verify a case
+ 
++2026-10-18 current-session continuation: the new optional
++`Executor.admit(original_session_reference=...)` separates immutable original
++run-sheet provenance from fresh independently verified current session evidence.
++It requires the exact existing journal and original running intent under the
++normal lock, refuses missing/orphan/changed context and retains all original
++pins. Current authority is rechecked before every subsequent write/callback;
++neither the original reference nor a fresh login can replay a completed effect
++or clear uncertainty. No descriptor/Invocation/receipt schema or default
++admission behavior changes. Source integration uses the actual KeyCape CLI over
++HTTPS, a fresh Python owner process and actual Warden SQLite, with synthetic
++case/catalog/owner/effect attestations only. Exact source/proof is retained by
++CUST-WP-0080 under `keycape-current-client-r1`. Native owner mappings, current
++operation/effect authority, credential custody, case/type/descriptor refreeze,
++Forgejo inverse semantics and first native acceptance remain open; no lane,
++adapter, runtime or caller scope is activated by this source change.
++
+ `warden case run <case.yaml>` executes the plan. Owner entry points run through
+ the existing proxy as the caller; steps that need an attended login use the
+ existing contained login envelope (silent command, session revoked afterwards),
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/docs/security-case-execution-kernel-v1.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/docs/security-case-execution-kernel-v1.md
new file mode 100644
index 0000000..b9b87d2
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/docs/security-case-execution-kernel-v1.md
@@ -0,0 +1,192 @@
+# Closed case execution kernel v1 — 2026-10-11
+
+Owner implementation record for WARDEN-WP-0044-T03. The architectural proposal
+at SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
+was accepted through memo `infd-20261010-security-case-execution`, version 1,
+approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca, confirmed disposition
+disp-cf44dacb-2117-4de7-8f90-cfa99f84f325 at 2026-10-10T23:23:31Z. The original
+approved proposal remains byte-identical. That decision accepts source design;
+it grants no execution session, credential or deployment authority.
+
+`src/warden/case_run.py` advances the pure reducer into an executable injected
+owner harness with private durable receipts. Descriptor version
+`warden.case.execution.v1` is a closed local implementation seam, not an accepted
+NetKingdom type schema. It contains fixed owner/adapter/source digest, actor,
+lane, target parameter, effect, reviewed created-object identifiers declared
+retry safety and explicit required revocation scopes (parent-session and broker-grant).
+A mint descriptor cannot omit either scope. Unknown fields, free shell text and secret parameters are refused.
+An acknowledged type must additionally pin the descriptor bytes under its
+`execution_descriptors` map and independent owner evidence must authenticate
+that exact machine-seam revision. Existing descriptive types lack this map and
+remain plan-only. Their acknowledged labels do not authorize this new seam.
+
+There are no installed owner adapters, native provenance verifier or dispatch CLI
+in this change. Callables are injected only through a fixed adapter registry,
+with immutable owner reference/source pins. A real integration must supply
+independent owner/native verification or explicit attended manual evidence;
+a bare JSON receipt identifier is insufficient. Fixture verifiers in tests
+are deliberately fake and attest no native case. Caller sessions are independently
+verified for exact principal/actor/lane at admission and again before dispatch;
+input actor labels alone are never sufficient. Agent mint is refused, including
+when WARDEN_AGENT_ID appears after initial human admission.
+
+Each admission pins exact case/type/descriptor/catalog bytes, acceptance reference
+and run-sheet identity. Actual ops-mason materialization evidence is required
+against the case source, separately from its status label. Case parameters supply
+an exact metadata target. Source/session changes cannot inherit journal success.
+Owner results have a closed metadata shape, result evidence fingerprint and
+separate independently authenticated grant/parent-session revocation evidence
+fingerprints. An aggregate revoked boolean alone cannot satisfy either scope. Unknown result payloads, unverified evidence, absent revocation and
+created objects outside the reviewed scope become uncertain, never success.
+Python and OS stdout/stderr, including inherited child-process output, are
+discarded without buffering or retention under a serialized fd containment
+context. Independent provenance verification uses the same containment and
+sanitizes exceptions. All source inputs are capped at 256 KiB before parsing.
+Error text is not copied to the journal. KeyboardInterrupt/SystemExit and other
+owner interruptions are rethrown with a fixed message while retaining running
+intent for crash recovery.
+
+The journal uses an owner-private 0700 directory and 0600 files, refuses symlinks
+and insecure modes, uses SQLite FULL synchronization and commits running intent
+before calling the adapter. A separate process lock prevents concurrent mutation.
+A crash between dispatch and final receipt leaves running; the next lock holder
+persists uncertain before refusing replay. Both intent and outcome remain in
+history. Each persisted attempt has a unique identity bound to all exact pins,
+operation (run/reconcile/rollback), sequence and nonce. Adapter results and both
+revocation proof purposes carry that identity. Prior-attempt evidence cannot
+verify a safe retry, even if a caller rewrites result labels. Descriptor-created
+objects are capped at 32 and histories at 128 transitions, with dispatch stopped
+before archival is required. A throw or lost response is not failed-before-change. A safe retry needs
+verified failed-before-change, unchanged pins, descriptor retry-safe and explicit
+retry. Success and no-change cannot replay.
+
+Reconciliation is an explicit fixed owner callback, never the mutation callback.
+It may verify an already-present native CAS result as no-change/success, or prove
+failed-before-change; it never tells Warden to regenerate a credential. Uncertain
+or failed-after-change requires this owner-native inspection before any retry.
+Owner proof and revocation remain mandatory. Rollback visits only objects in a
+verified creation receipt, in reverse order; no-change has no undo and shared
+objects are excluded. Unknown/lost undo blocks another rollback.
+
+The kernel operates individual admitted steps. Full ordered run-sheet orchestration,
+verification inventory, contained login integration, native owner adapters and
+CLI activation remain WARDEN-WP-0044-T03; no overall native-complete result is
+implemented. Current Forgejo source is not materialized and has no acknowledged
+machine descriptors. Its first native run remains an acceptance requirement,
+with real materialization, separately authenticated broker-grant and parent-session
+revocation receipts, session/owner receipts and consumer enforcement. This
+implementation neither promotes a type nor changes any case status.
+
+Validation: 37 new kernel tests plus 14 reducer tests pass (51 total). Tests open
+an independent SQLite connection inside dispatch to prove running was committed,
+crash after mutation and reopen a fresh journal to prove no duplicate invocation,
+lose a response then reconcile without mint, require explicit retry, check exact
+pins/session expiry, withhold malicious output and unconfirmed revocation, and
+prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and
+checks pass. No live token or target action occurred.
+
+## Browser input projection — 2026-10-16 source preparation
+
+An explicitly configured `BrowserInputs(netkingdom_root)` now validates browser
+cases before admission. It calls the real NetKingdom type/case validator over
+verified producer bytes in a disposable Python process (`-I`, empty environment,
+timeout, no inherited output). The validator, composer, capability contract and lazy evidence
+modules have exact source pins; missing or changed code refuses. There is no
+automatic discovery or download. A producer upgrade needs reviewed pin changes.
+
+Only the exact reviewed 1.1/1.2 browser parameter definitions qualify. A digest
+of each complete parameter definition list prevents reclassifying secrets as
+metadata, loosening constraints, or adding fields under a recognized version.
+The complete case passes producer validation, including required fields,
+constraints and credential-shape checks. Explicit fixed/default overrides,
+unknown fields and secret references refuse. Security-sensitive browser metadata
+can therefore be present without being passed to an owner adapter: the only
+projection is its descriptor's exact public/operational target identifier.
+No raw parameter values are added to invocations or persisted receipts.
+
+`require_implemented=False` validates the acknowledged type's source, not its
+execution authority. Existing descriptor/type/source/catalog/caller provenance
+gates stay mandatory. Neither historical browser type contains the required
+exact machine-descriptor map, and neither is promoted by this change. There are
+still no installed native owner adapters, authenticated provenance verifier,
+contained session/ordered run orchestration or live CLI dispatch. A journal digest
+is a fingerprint and cannot authenticate native evidence. Completion still needs
+owner-admitted descriptors and actual structural, mint/delivery, consumer and
+revocation/rollback evidence. Local fixture success is not native acceptance.
+
+Tests use the actual producer checkout (override sibling location with
+`WARDEN_TEST_NETKINGDOM_ROOT`), the real Executor, SQLite journal and injected
+test-only owner adapter/evidence verifier. Their descriptor extensions and case
+materialized labels exist only in memory. Canonical case/type bytes stay intact.
+
+Producer integration refinement: the accepted NetKingdom browser-case patch
+`d32a7f51cbf3012bee3e4bb329f4259dea867eff1c59a2b01a65d72774488d05`
+is now the tested producer revision. Its evidence module is imported lazily only
+by `check-evidence`, outside this admission path; Warden nevertheless pins and
+copies it with the complete reviewed producer set. Missing or modified bytes in
+any of the four modules refuse admission. The test covers every dependency.
+
+
+## Original-intent consistency boundary — 2026-10-17
+
+`OriginalIntent` and the optional additive
+`reconcile_original(ReconcileContext(original, attempt))` callback retain the
+original run separately from a fresh reconciliation attempt. Existing one-argument
+reconcile adapters remain source-compatible. Intent and pre-dispatch receipt are
+committed in one SQLite transaction; lookup now requires their exact attempt,
+actor, step/owner/target, source and pin correspondence. Missing legacy context,
+an orphan receipt, changed context or an invalid bounded field contract refuses;
+there is no backfill or new runtime holder.
+
+Original intent serialization accepts only the fixed reviewed Invocation/Pins
+field contract and bounded operational identifiers. Duplicate, oversized and
+malformed original records refuse. Current Executor.admit leaves tenant and realm
+empty: those reserved fields are not admitted tenant/realm provenance, and future
+nonempty coordinates need an authoritative owner contract. Raw owner payloads,
+credentials, parameters and caller output are not part of this context contract.
+
+Local dispatch correspondence is not independent owner proof. A real owner must
+still authenticate the exact original created-only result and original revocation,
+current native revision and the fresh attempt's session/grant evidence before
+recovery can count. No actual original holder/verifier or native adapter is added.
+NetKingdom's current registration adapter still has no reconciliation callback;
+source tests do not authorize its post-restart undo, replay or a changed caller/
+session/run-sheet migration. WARDEN-WP-0044-T03 remains a native acceptance gate.
+
+## Current caller versus original session reference — 2026-10-18 source
+
+`Executor.admit` now accepts the optional `original_session_reference` for an
+exact existing original-run continuation. It is metadata, never current
+authentication. The normal `session_evidence` is independently verified as the
+current caller's principal/actor/lane proof, including after restart, and remains
+the evidence rechecked immediately before every journal write/owner callback.
+
+The optional reference preserves the original run-sheet digest rather than
+replacing immutable provenance with the new login. Before admitting it, under
+the existing journal lock, the kernel requires an existing matching step journal
+and `Journal.original_intent` correspondence: the original running receipt,
+attempt, owner/target/principal/actor/lane, all six pins and exact adapter source.
+Missing/orphan/legacy context, a changed reference or caller and a stale current
+session refuse. The reference must differ from the current evidence identifier;
+the actual session owner must additionally establish distinct authenticated
+token/session identity, not just two labels. No new original context is created,
+no completed operation can replay, and uncertainty is not cleared by readmission.
+
+Omitting this option retains the old admission/pin semantics. Supplying a fresh
+session alone still creates a different run sheet and cannot reuse a previous
+journal. No existing descriptor, Invocation, Pins or receipt schema changes.
+The new source seam does not implement changed-source/catalog/caller migration
+or loss of rollback result; those still require the existing owner reconciliation
+and recovery evidence. It is not general session management or another issuer.
+
+A source integration fixture runs the actual producer-owned KeyCape status CLI
+over HTTPS, the actual Warden kernel and a separately compiled generated Go
+consumer. It verifies revoked-parent refusal before writes, distinct inverse
+authentication in another Python process, original journal pin retention,
+no business replay, exact synthetic target restore and independent read-only
+negative cleanup observation. Case/type/catalog/owner attestations and the
+target are synthetic; this is not Forgejo/browser/native acceptance or a real
+approval. KeyCape's proposed online profile remains unadmitted. The private
+unsigned CLI observation is not portable execution authority; actual owner
+custody and original grant ownership are still mandatory before an inactive
+response can establish revocation. No native verifier or adapter is installed.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/src/warden/case_run.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/src/warden/case_run.py
new file mode 100644
index 0000000..7d84bfb
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/src/warden/case_run.py
@@ -0,0 +1,1092 @@
+"""Closed local execution kernel v1; no installed adapters or live CLI dispatch.
+
+An owner must acknowledge each descriptor and provide an independent provenance
+verifier. Descriptive case types remain plan-only. Nothing executes shell prose.
+"""
+
+from __future__ import annotations
+
+from contextlib import contextmanager, redirect_stderr, redirect_stdout
+from dataclasses import asdict, dataclass, replace
+import fcntl
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import sqlite3
+import threading
+import uuid
+from typing import Callable
+
+import yaml
+from .case_inputs import BrowserInputs
+from .case_receipt_state import (
+    Outcome,
+    Pins,
+    Receipt,
+    Refused,
+    StepState,
+    begin,
+    finish,
+    recover,
+    begin_rollback,
+    finish_rollback,
+)
+
+IDENTIFIER = re.compile(r"[a-zA-Z0-9][a-zA-Z0-9_.:/@-]{0,191}\Z")
+MAX_SOURCE_BYTES = 262144
+MAX_HISTORY = 128
+OUTPUT_LOCK = threading.RLock()
+
+
+def bounded_source(value: bytes):
+    if type(value) is not bytes or len(value) > MAX_SOURCE_BYTES:
+        raise Refused("source exceeds bounded input contract")
+
+
+@contextmanager
+def contained_output():
+    """Discard Python and inherited OS stdout/stderr; serialize process fd changes."""
+    with OUTPUT_LOCK:
+        saved = []
+        null = os.open(os.devnull, os.O_WRONLY)
+        try:
+            for target in (1, 2):
+                saved.append((target, os.dup(target)))
+                os.dup2(null, target)
+            with redirect_stdout(_Discard()), redirect_stderr(_Discard()):
+                try:
+                    yield
+                except Exception:
+                    raise Refused("owner callback failed") from None
+                except BaseException:
+                    raise OwnerInterrupted() from None
+        finally:
+            for target, original in saved:
+                os.dup2(original, target)
+                os.close(original)
+            os.close(null)
+
+
+DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
+
+
+def digest(value: bytes) -> str:
+    return "sha256:" + hashlib.sha256(value).hexdigest()
+
+
+@dataclass(frozen=True, slots=True)
+class Descriptor:
+    version: str
+    step: str
+    owner: str
+    adapter: str
+    adapter_source: str
+    actor: str
+    lane: str
+    target_parameter: str
+    effect: str
+    allowed_created: tuple[str, ...]
+    retry_safe: bool
+    revocation_scopes: tuple[str, ...]
+
+    @classmethod
+    def decode(cls, source: bytes) -> Descriptor:
+        bounded_source(source)
+        try:
+            obj = json.loads(source)
+            if set(obj) != set(cls.__dataclass_fields__):
+                raise ValueError
+            if not isinstance(obj["allowed_created"], list):
+                raise ValueError
+            obj["allowed_created"] = tuple(obj["allowed_created"])
+            if not isinstance(obj["revocation_scopes"], list):
+                raise ValueError
+            obj["revocation_scopes"] = tuple(obj["revocation_scopes"])
+            result = cls(**obj)
+            identifiers = (
+                result.step,
+                result.owner,
+                result.adapter,
+                result.lane,
+                result.target_parameter,
+                *result.allowed_created,
+            )
+            if result.version != "warden.case.execution.v1" or not all(
+                isinstance(v, str) and IDENTIFIER.fullmatch(v) for v in identifiers
+            ):
+                raise ValueError
+            if not DIGEST.fullmatch(result.adapter_source) or result.actor not in (
+                "human",
+                "agent",
+            ):
+                raise ValueError
+            if (
+                result.effect not in ("read", "change", "mint")
+                or type(result.retry_safe) is not bool
+            ):
+                raise ValueError
+            scopes = set(result.revocation_scopes)
+            if (
+                len(scopes) != len(result.revocation_scopes)
+                or not scopes <= {"parent-session", "broker-grant"}
+                or "parent-session" not in scopes
+            ):
+                raise ValueError
+            if result.effect == "mint" and "broker-grant" not in scopes:
+                raise ValueError
+            if len(result.allowed_created) > 32:
+                raise ValueError
+            if len(set(result.allowed_created)) != len(result.allowed_created):
+                raise ValueError
+            return result
+        except (ValueError, TypeError, KeyError):
+            raise Refused("invalid closed execution descriptor") from None
+
+
+@dataclass(frozen=True, slots=True)
+class OwnerResult:
+    outcome: Outcome
+    evidence: str
+    created: tuple[str, ...] = ()
+    revoked: bool = False
+    session_revocation_evidence: str | None = None
+    grant_revocation_evidence: str | None = None
+    attempt_id: str = ""
+    operation: str = ""
+
+
+@dataclass(frozen=True, slots=True)
+class Invocation:
+    step: str
+    owner: str
+    target: str
+    actor: str
+    principal: str
+    lane: str
+    pins: Pins
+    attempt_id: str = ""
+    operation: str = "admission"
+    tenant: str = ""
+    realm: str = ""
+
+
+INTENT_SCHEMA = "warden.case.original-intent.v1"
+
+
+@dataclass(frozen=True, slots=True)
+class OriginalIntent:
+    """Durable record of the original mutating dispatch, written before dispatch.
+
+    Binds the original Invocation (attempt, step, owner, target, actor, principal,
+    lane), all pins and the admitted adapter source. Current admit leaves tenant
+    and realm empty; their reserved fields are not admitted provenance. This is
+    local dispatch correspondence, not owner proof of creation. Owners still
+    authenticate original created-only provenance independently.
+    """
+
+    binding: str
+    invocation: Invocation
+    source: str
+
+    def validate(self) -> None:
+        """Fixed bounded metadata only; tenant/realm are not authority claims.
+
+        Current admit leaves tenant/realm empty. Nonempty future coordinates need
+        separate owner provenance; serializability alone must never supply it.
+        """
+        if (
+            type(self.invocation) is not Invocation
+            or type(self.invocation.pins) is not Pins
+        ):
+            raise Refused("exact original invocation required")
+        i = self.invocation
+        fields = (i.step, i.owner, i.target, i.principal, i.lane, i.attempt_id)
+        if (
+            not all(
+                type(value) is str and IDENTIFIER.fullmatch(value) for value in fields
+            )
+            or type(i.actor) is not str
+            or i.actor not in ("human", "agent")
+            or type(i.operation) is not str
+            or i.operation not in ("run", "rollback")
+            or not all(
+                type(value) is str and (not value or IDENTIFIER.fullmatch(value))
+                for value in (i.tenant, i.realm)
+            )
+            or type(self.source) is not str
+            or not DIGEST.fullmatch(self.source)
+            or type(self.binding) is not str
+            or self.binding != f"{i.step}:{i.target}"
+        ):
+            raise Refused("invalid original intent metadata")
+        if set(Invocation.__dataclass_fields__) != {
+            "step",
+            "owner",
+            "target",
+            "actor",
+            "principal",
+            "lane",
+            "pins",
+            "attempt_id",
+            "operation",
+            "tenant",
+            "realm",
+        }:
+            raise Refused("original invocation field contract changed")
+        if not all(
+            type(v) is str and DIGEST.fullmatch(v)
+            for v in (
+                i.pins.case,
+                i.pins.case_type,
+                i.pins.adapter,
+                i.pins.catalog,
+                i.pins.acceptance,
+                i.pins.run_sheet,
+            )
+        ):
+            raise Refused("invalid original intent pins")
+
+    def payload(self) -> str:
+        self.validate()
+        return json.dumps(
+            {"schema": INTENT_SCHEMA, "binding": self.binding, "source": self.source}
+            | asdict(self.invocation),
+            separators=(",", ":"),
+            sort_keys=True,
+        )
+
+    @classmethod
+    def decode(cls, raw: str) -> OriginalIntent:
+        def unique(pairs):
+            result = {}
+            for key, value in pairs:
+                if key in result:
+                    raise Refused("duplicate original intent field")
+                result[key] = value
+            return result
+
+        try:
+            if type(raw) is not str or len(raw.encode()) > MAX_SOURCE_BYTES:
+                raise Refused("original intent input exceeds bound")
+            obj = json.loads(raw, object_pairs_hook=unique)
+            fields = {
+                "step",
+                "owner",
+                "target",
+                "actor",
+                "principal",
+                "lane",
+                "pins",
+                "attempt_id",
+                "operation",
+                "tenant",
+                "realm",
+            }
+            if (
+                type(obj) is not dict
+                or set(obj) != fields | {"schema", "binding", "source"}
+                or obj["schema"] != INTENT_SCHEMA
+            ):
+                raise Refused("unknown original intent schema")
+            inv = {k: obj[k] for k in fields}
+            inv["pins"] = Pins(**inv["pins"])
+            result = cls(obj["binding"], Invocation(**inv), obj["source"])
+            result.validate()
+            return result
+        except (TypeError, ValueError, KeyError):
+            raise Refused("invalid original intent record") from None
+
+
+@dataclass(frozen=True, slots=True)
+class ReconcileContext:
+    """Original intent and the new reconciliation attempt, kept separate."""
+
+    original: OriginalIntent
+    attempt: Invocation
+
+
+@dataclass(frozen=True, slots=True)
+class Adapter:
+    reference: str
+    source: str
+    invoke: Callable[[Invocation], OwnerResult]
+    verify: Callable[[Invocation, OwnerResult], bool]
+    rollback: Callable[[Invocation, tuple[str, ...]], OwnerResult] | None = None
+    reconcile: Callable[[Invocation], OwnerResult] | None = None
+    reconcile_original: Callable[[ReconcileContext], OwnerResult] | None = None
+
+
+class Journal:
+    """Private SQLite journal plus process lock; transaction commits before dispatch."""
+
+    def __init__(self, directory: Path):
+        directory.mkdir(mode=0o700, parents=True, exist_ok=True)
+        if (
+            directory.is_symlink()
+            or directory.stat().st_uid != os.getuid()
+            or directory.stat().st_mode & 0o077
+        ):
+            raise Refused("journal directory is not private")
+        self.directory = directory
+        for name in ("journal.sqlite", "execution.lock"):
+            path = directory / name
+            fd = os.open(path, os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
+            try:
+                if os.fstat(fd).st_uid != os.getuid() or os.fstat(fd).st_mode & 0o077:
+                    raise Refused("journal file is not private")
+            finally:
+                os.close(fd)
+        self.db = sqlite3.connect(directory / "journal.sqlite", isolation_level=None)
+        self.db.execute("PRAGMA synchronous=FULL")
+        self.db.execute(
+            "CREATE TABLE IF NOT EXISTS receipts (seq INTEGER PRIMARY KEY, binding TEXT NOT NULL, payload TEXT NOT NULL)"
+        )
+        self.db.execute(
+            "CREATE TABLE IF NOT EXISTS intents (seq INTEGER PRIMARY KEY, attempt_id TEXT NOT NULL UNIQUE, binding TEXT NOT NULL, payload TEXT NOT NULL)"
+        )
+
+    def original_intent(
+        self, binding: str, current: Invocation, source: str
+    ) -> OriginalIntent:
+        """Latest original run intent for binding, refused unless it matches exactly.
+
+        Missing or mismatched records refuse; the step stays uncertain.
+        """
+        row = self.db.execute(
+            "SELECT attempt_id,payload FROM intents WHERE binding=? ORDER BY seq DESC LIMIT 1",
+            (binding,),
+        ).fetchone()
+        if row is None:
+            raise Refused("original intent record missing; step stays uncertain")
+        intent = OriginalIntent.decode(row[1])
+        o = intent.invocation
+        if row[0] != o.attempt_id:
+            raise Refused("original intent attempt identity differs")
+        if intent.binding != binding or o.operation != "run":
+            raise Refused("original intent binding mismatch")
+        if o.pins != current.pins:
+            raise Refused("original intent pins mismatch")
+        if intent.source != source:
+            raise Refused("original intent source mismatch")
+        for name in (
+            "step",
+            "owner",
+            "target",
+            "actor",
+            "principal",
+            "lane",
+            "tenant",
+            "realm",
+        ):
+            if getattr(o, name) != getattr(current, name):
+                raise Refused(f"original intent {name} mismatch")
+        # Match the persisted original running receipt. An orphan context or a
+        # payload from another attempt cannot become the current lookup key.
+        receipts = self.db.execute(
+            "SELECT payload FROM receipts WHERE binding=? ORDER BY seq DESC LIMIT ?",
+            (binding, MAX_HISTORY + 1),
+        ).fetchall()
+        if len(receipts) > MAX_HISTORY:
+            raise Refused("original intent receipt history exceeds bound")
+        matched = False
+        try:
+            for (raw,) in receipts:
+                if type(raw) is not str or len(raw.encode()) > MAX_SOURCE_BYTES:
+                    raise Refused("original receipt input exceeds bound")
+                payload = json.loads(raw)
+                if (
+                    payload.get("attempt_id") != o.attempt_id
+                    or payload.get("operation") != "run"
+                ):
+                    continue
+                last = payload.get("receipts", [])[-1]
+                if last.get("outcome") != "running":
+                    continue
+                if (
+                    payload.get("journal_schema") != "warden.case.step-journal.v1"
+                    or payload.get("step_id") != o.step
+                    or payload.get("owner") != o.owner
+                    or payload.get("pins") != asdict(o.pins)
+                ):
+                    raise Refused("original running receipt binding differs")
+                matched = True
+                break
+        except (TypeError, ValueError, KeyError, IndexError, AttributeError):
+            raise Refused("invalid original running receipt") from None
+        if not matched:
+            raise Refused("original running receipt missing; no backfill")
+        return intent
+
+    @contextmanager
+    def locked(self):
+        with (self.directory / "execution.lock").open("rb") as fh:
+            try:
+                fcntl.flock(fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                raise Refused("case execution already active") from None
+            try:
+                yield
+            finally:
+                fcntl.flock(fh, fcntl.LOCK_UN)
+
+    def load(self, binding: str, initial: StepState) -> StepState:
+        row = self.db.execute(
+            "SELECT payload FROM receipts WHERE binding=? ORDER BY seq DESC LIMIT 1",
+            (binding,),
+        ).fetchone()
+        if row is None:
+            return initial
+        obj = json.loads(row[0])
+        expected = {
+            "step_id",
+            "owner",
+            "pins",
+            "allowed_created",
+            "retry_safe",
+            "receipts",
+            "journal_schema",
+            "evidence_digest",
+            "session_revoked",
+            "session_revocation_digest",
+            "grant_revocation_digest",
+            "attempt_id",
+            "operation",
+        }
+        if (
+            set(obj) != expected
+            or obj["journal_schema"] != "warden.case.step-journal.v1"
+        ):
+            raise Refused("unknown journal receipt schema")
+        state = StepState(
+            obj["step_id"],
+            obj["owner"],
+            Pins(**obj["pins"]),
+            tuple(obj["allowed_created"]),
+            obj["retry_safe"],
+            tuple(
+                Receipt(r["attempt"], Outcome(r["outcome"]), tuple(r["created"]))
+                for r in obj["receipts"]
+            ),
+        )
+        if (
+            state.step_id,
+            state.owner,
+            state.pins,
+            state.allowed_created,
+            state.retry_safe,
+        ) != (
+            initial.step_id,
+            initial.owner,
+            initial.pins,
+            initial.allowed_created,
+            initial.retry_safe,
+        ):
+            raise Refused("journal pins changed")
+        return state
+
+    def save(
+        self,
+        binding: str,
+        state: StepState,
+        evidence: OwnerResult | None = None,
+        invocation: Invocation | None = None,
+        intent: OriginalIntent | None = None,
+    ):
+        if intent is not None:
+            if type(intent) is not OriginalIntent:
+                raise Refused("exact original intent required")
+            intent.validate()
+            expected = (
+                Outcome.RUNNING
+                if intent.invocation.operation == "run"
+                else Outcome.ROLLBACK_RUNNING
+            )
+            if (
+                intent.binding != binding
+                or intent.invocation != invocation
+                or intent.invocation.pins != state.pins
+                or not state.last
+                or state.last.outcome is not expected
+            ):
+                raise Refused("original intent and running receipt differ")
+        self.db.execute("BEGIN IMMEDIATE")
+        try:
+            if intent is not None:
+                self.db.execute(
+                    "INSERT INTO intents(attempt_id,binding,payload) VALUES (?,?,?)",
+                    (intent.invocation.attempt_id, binding, intent.payload()),
+                )
+            self.db.execute(
+                "INSERT INTO receipts(binding,payload) VALUES (?,?)",
+                (
+                    binding,
+                    json.dumps(
+                        asdict(state)
+                        | {
+                            "journal_schema": "warden.case.step-journal.v1",
+                            "attempt_id": invocation.attempt_id if invocation else None,
+                            "operation": invocation.operation if invocation else None,
+                            "evidence_digest": digest(evidence.evidence.encode())
+                            if evidence
+                            else None,
+                            "session_revoked": evidence.revoked if evidence else None,
+                            "session_revocation_digest": digest(
+                                evidence.session_revocation_evidence.encode()
+                            )
+                            if evidence and evidence.session_revocation_evidence
+                            else None,
+                            "grant_revocation_digest": digest(
+                                evidence.grant_revocation_evidence.encode()
+                            )
+                            if evidence and evidence.grant_revocation_evidence
+                            else None,
+                        },
+                        separators=(",", ":"),
+                    ),
+                ),
+            )
+            self.db.execute("COMMIT")
+        except BaseException:
+            self.db.execute("ROLLBACK")
+            raise
+
+
+def _catalog_lane(catalog_source: bytes, descriptor: Descriptor):
+    """KERNEL-2: the descriptor's lane must be an active, fitting catalog entry.
+
+    catalog-routing-acceptance still covers the whole catalog digest; this
+    ties the one lane the descriptor names to an entry inside that digest.
+    """
+    from .routing.catalog import CatalogError, _parse_entry
+
+    try:
+        raw = yaml.safe_load(catalog_source)
+        items = raw["entries"]
+        if not isinstance(items, list):
+            raise TypeError
+        entries = {}
+        for index, item in enumerate(items):
+            parsed = _parse_entry(item, index)
+            if parsed.id in entries:
+                raise ValueError
+            entries[parsed.id] = parsed
+    except (yaml.YAMLError, CatalogError, KeyError, TypeError, ValueError):
+        raise Refused("invalid catalog source shape") from None
+    entry = entries.get(descriptor.lane)
+    if entry is None:
+        raise Refused("descriptor lane is not in the catalog")
+    if not entry.is_active:
+        raise Refused("descriptor lane is not active in the catalog")
+    if entry.delegation is None:
+        raise Refused("descriptor lane has no catalog delegation record")
+    if not entry.is_graded:
+        raise Refused("descriptor lane carries no risk grade")
+    if descriptor.owner not in entry.owner_repo.split("/"):
+        raise Refused("descriptor owner does not fit catalog lane owner_repo")
+    if descriptor.effect in ("mint", "change") and entry.risk != "high":
+        raise Refused("catalog lane risk does not cover the descriptor effect")
+    return entry, entries
+
+
+def _attended_admission(descriptor, actor, entry, entries):
+    from .routing.models import attended_lane_issue
+
+    if (actor != "human" or "WARDEN_AGENT_ID" in os.environ
+            or "parent-session" not in descriptor.revocation_scopes):
+        raise Refused("attended step requires a human parent session")
+    issue = attended_lane_issue(entry, entries.get)
+    if issue:
+        raise Refused(issue[1])
+
+
+def _step_mode(case_type: dict, case: dict, descriptor: Descriptor) -> str:
+    """KERNEL-3: warden, attended or owner, from the type step's own text."""
+    steps = [
+        step
+        for step in case_type.get("follow_through") or []
+        if isinstance(step, dict) and step.get("id") == descriptor.step
+    ]
+    step = steps[0] if len(steps) == 1 else {}
+    executes, attended = step.get("warden_executes"), step.get("attended")
+    if (
+        type(executes) is not bool
+        or type(attended) is not bool
+        or (executes and attended)
+        or not isinstance(step.get("lane"), str)
+    ):
+        raise Refused("type step does not declare how the kernel dispatches it")
+    owner = step.get("owner")
+    if isinstance(owner, str) and re.fullmatch(r"\{[a-z_]+\}", owner):
+        owner = (case.get("parameters") or {}).get(owner[1:-1])
+    if step["lane"] != descriptor.lane or owner != descriptor.owner:
+        raise Refused("type step lane or owner disagrees with descriptor")
+    return "warden" if executes else "attended" if attended else "owner"
+
+
+class Executor:
+    """Injected fixed owner adapters and provenance verifier; none ship by default.
+
+    evidence verifier must authenticate owner custody/provenance or explicitly
+    attest attended manual evidence; a bare JSON reference is never sufficient.
+    It receives purpose, exact source digest, and named evidence reference.
+    """
+
+    def __init__(
+        self,
+        journal: Journal,
+        adapters: dict[str, Adapter],
+        evidence_verifier: Callable[[str, str, str], bool],
+        *,
+        browser_inputs: BrowserInputs | None = None,
+    ):
+        self.journal, self.adapters, self.evidence_verifier = (
+            journal,
+            dict(adapters),
+            evidence_verifier,
+        )
+        self._admitted = {}
+        self.browser_inputs = browser_inputs
+
+    def admit(
+        self,
+        case_source: bytes,
+        type_source: bytes,
+        descriptor_source: bytes,
+        catalog_source: bytes,
+        *,
+        principal: str,
+        actor: str,
+        lane: str,
+        acceptance_evidence: str,
+        materialization_evidence: str,
+        descriptor_evidence: str,
+        session_evidence: str,
+        original_session_reference: str | None = None,
+    ) -> tuple[Descriptor, Invocation, StepState]:
+        # Current authentication is distinct from an immutable original receipt
+        # reference. The latter can only resume an exact existing journal intent;
+        # it is never passed to the current-session verifier as authority.
+        receipt_session = session_evidence
+        if original_session_reference is not None:
+            if (
+                type(original_session_reference) is not str
+                or not IDENTIFIER.fullmatch(original_session_reference)
+                or original_session_reference == session_evidence
+            ):
+                raise Refused("distinct original session reference required")
+            receipt_session = original_session_reference
+        for source in (case_source, type_source, descriptor_source, catalog_source):
+            bounded_source(source)
+        descriptor = Descriptor.decode(descriptor_source)
+        try:
+            case = yaml.safe_load(case_source)["spec"]
+            case_type = yaml.safe_load(type_source)["spec"]
+            if not isinstance(case, dict) or not isinstance(case_type, dict):
+                raise ValueError
+        except (yaml.YAMLError, KeyError, TypeError, ValueError):
+            raise Refused("invalid case or type source shape") from None
+        if case.get("status") != "materialized" or not case.get("acceptance"):
+            raise Refused("case is not accepted and structurally materialized")
+        if case_type.get("status") not in ("acknowledged", "implemented"):
+            raise Refused("type is not acknowledged")
+        if case.get("type") != f"{case_type['id']}@{case_type['version']}":
+            raise Refused("case type pin mismatch")
+        if case_type.get("execution_descriptors", {}).get(descriptor.step) != digest(
+            descriptor_source
+        ):
+            raise Refused(
+                "type has no exact acknowledged machine descriptor; plan only"
+            )
+        for purpose, source, evidence in (
+            ("case-acceptance", digest(case_source), acceptance_evidence),
+            (
+                "ops-mason-materialization",
+                digest(case_source),
+                materialization_evidence,
+            ),
+            (
+                "owner-descriptor-acceptance:" + descriptor.owner,
+                digest(descriptor_source),
+                descriptor_evidence,
+            ),
+            ("type-machine-seam-acceptance", digest(type_source), descriptor_evidence),
+            ("catalog-routing-acceptance", digest(catalog_source), descriptor_evidence),
+            (
+                f"caller-session:{actor}:{principal}:{lane}",
+                digest(case_source),
+                session_evidence,
+            ),
+        ):
+            if (
+                not isinstance(evidence, str)
+                or not IDENTIFIER.fullmatch(evidence)
+                or self._verify_evidence(purpose, source, evidence) is not True
+            ):
+                raise Refused("independent owner evidence not verified")
+        if (
+            not IDENTIFIER.fullmatch(principal)
+            or actor != descriptor.actor
+            or lane != descriptor.lane
+        ):
+            raise Refused("principal actor or lane mismatch")
+        if descriptor.effect == "mint" and (
+            actor != "human" or os.getenv("WARDEN_AGENT_ID")
+        ):
+            raise Refused("agent mint is forbidden")
+        entry, entries = _catalog_lane(catalog_source, descriptor)
+        mode = _step_mode(case_type, case, descriptor)
+        if mode == "attended":
+            _attended_admission(descriptor, actor, entry, entries)
+        if mode == "owner" and (
+            entry.effective_delegation.mode != "native"
+            or entry.owner_repo != descriptor.owner
+            or entry.warden_executes
+            or descriptor.effect == "mint"
+        ):
+            raise Refused("owner step lane is not the owner's native path")
+        parameters = case.get("parameters", {})
+        declared = {
+            item["name"]: item
+            for item in case_type.get("parameters", [])
+            if isinstance(item, dict) and isinstance(item.get("name"), str)
+        }
+        if (
+            not isinstance(parameters, dict)
+            or descriptor.target_parameter not in declared
+        ):
+            raise Refused("target parameter is not declared by acknowledged type")
+        if case_type.get("id") == "oidc-browser-relying-party":
+            if type(self.browser_inputs) is not BrowserInputs:
+                raise Refused("browser metadata validator is not configured")
+            target = self.browser_inputs.target(
+                yaml.safe_load(case_source),
+                yaml.safe_load(type_source),
+                descriptor.target_parameter,
+            )
+        else:
+            for name in parameters:
+                definition = declared.get(name)
+                if (
+                    definition is None
+                    or definition.get("sensitivity") not in ("public", "operational")
+                    or definition.get("case_settable") is False
+                ):
+                    raise Refused("unknown, fixed or secret-sensitivity case parameter")
+            target = parameters.get(descriptor.target_parameter)
+        if not isinstance(target, str) or not IDENTIFIER.fullmatch(target):
+            raise Refused("target must be exact case metadata")
+        adapter = self.adapters.get(descriptor.adapter)
+        if adapter is None or (adapter.reference, adapter.source) != (
+            descriptor.adapter,
+            descriptor.adapter_source,
+        ):
+            raise Refused("unknown adapter or owner source pin")
+        sheet = json.dumps(
+            [
+                descriptor.step,
+                descriptor.owner,
+                target,
+                actor,
+                principal,
+                lane,
+                acceptance_evidence,
+                materialization_evidence,
+                descriptor_evidence,
+                receipt_session,
+            ],
+            separators=(",", ":"),
+        ).encode()
+        pins = Pins(
+            digest(case_source),
+            digest(type_source),
+            digest(descriptor_source),
+            digest(catalog_source),
+            digest(acceptance_evidence.encode()),
+            digest(sheet),
+        )
+        invocation = Invocation(
+            descriptor.step, descriptor.owner, target, actor, principal, lane, pins
+        )
+        initial = StepState(
+            descriptor.step,
+            descriptor.owner,
+            pins,
+            descriptor.allowed_created,
+            descriptor.retry_safe,
+        )
+        if original_session_reference is not None:
+            with self.journal.locked():
+                binding = f"{invocation.step}:{invocation.target}"
+                existing = self.journal.load(binding, initial)
+                if not existing.last:
+                    raise Refused("original dispatch journal required; no backfill")
+                self.journal.original_intent(binding, invocation, adapter.source)
+        # Keep the mode and exact authenticated catalog bytes with this admission;
+        # dispatch must not substitute a later ambient catalog or lose its mode.
+        self._admitted[invocation] = (
+            descriptor, initial, session_evidence, mode, catalog_source
+        )
+        return descriptor, invocation, initial
+
+    def _result(
+        self, adapter: Adapter, invocation: Invocation, result: OwnerResult
+    ) -> OwnerResult:
+        if type(result) is not OwnerResult or not isinstance(result.outcome, Outcome):
+            raise Refused("unknown owner result shape")
+        if type(result.created) is not tuple or not all(
+            isinstance(v, str) and IDENTIFIER.fullmatch(v) for v in result.created
+        ):
+            raise Refused("owner created-object result invalid")
+        if not isinstance(result.evidence, str) or not IDENTIFIER.fullmatch(
+            result.evidence
+        ):
+            raise Refused("owner evidence identifier invalid")
+        if adapter.verify(invocation, result) is not True or result.revoked is not True:
+            raise Refused("owner result or session revocation unverified")
+        if (result.attempt_id, result.operation) != (
+            invocation.attempt_id,
+            invocation.operation,
+        ):
+            raise Refused("owner receipt belongs to another attempt")
+        descriptor = self._admitted[
+            replace(invocation, attempt_id="", operation="admission")
+        ][0]
+        proof_fields = {
+            "parent-session": (
+                f"session-revocation:{invocation.lane}:{invocation.operation}:{invocation.attempt_id}",
+                result.session_revocation_evidence,
+            ),
+            "broker-grant": (
+                f"grant-revocation:{invocation.lane}:{invocation.operation}:{invocation.attempt_id}",
+                result.grant_revocation_evidence,
+            ),
+        }
+        proofs = [proof_fields[scope] for scope in descriptor.revocation_scopes]
+        for purpose, evidence in proofs:
+            if (
+                not isinstance(evidence, str)
+                or not IDENTIFIER.fullmatch(evidence)
+                or self._verify_evidence(purpose, invocation.pins.case, evidence)
+                is not True
+            ):
+                raise Refused("independent grant or parent-session revocation absent")
+        return result
+
+    def _verify_evidence(self, purpose, source, evidence):
+        try:
+            with contained_output():
+                return self.evidence_verifier(purpose, source, evidence) is True
+        except Exception:
+            raise Refused("independent evidence verification failed") from None
+
+    def _admission(
+        self, descriptor: Descriptor, invocation: Invocation, initial: StepState
+    ):
+        if self._admitted.get(invocation, ())[:2] != (descriptor, initial):
+            raise Refused("execution requires verified admission on this executor")
+        adapter = self.adapters.get(descriptor.adapter)
+        if adapter is None or (adapter.reference, adapter.source) != (
+            descriptor.adapter,
+            descriptor.adapter_source,
+        ):
+            raise Refused("adapter changed after admission")
+        _, _, session, mode, catalog_source = self._admitted[invocation]
+        if (
+            self._verify_evidence(
+                f"caller-session:{invocation.actor}:{invocation.principal}:{invocation.lane}",
+                invocation.pins.case,
+                session,
+            )
+            is not True
+        ):
+            raise Refused("caller session no longer verified")
+        if descriptor.effect == "mint" and os.getenv("WARDEN_AGENT_ID"):
+            raise Refused("agent mint is forbidden")
+        if mode == "attended":
+            entry, entries = _catalog_lane(catalog_source, descriptor)
+            _attended_admission(descriptor, invocation.actor, entry, entries)
+        return adapter
+
+    def _attempt(self, invocation: Invocation, state: StepState, operation: str):
+        identity = json.dumps(
+            [asdict(invocation.pins), operation, state.last.attempt, uuid.uuid4().hex],
+            separators=(",", ":"),
+        ).encode()
+        return replace(
+            invocation,
+            attempt_id="attempt-" + hashlib.sha256(identity).hexdigest(),
+            operation=operation,
+        )
+
+    def run(
+        self,
+        descriptor: Descriptor,
+        invocation: Invocation,
+        initial: StepState,
+        *,
+        retry=False,
+    ) -> StepState:
+        adapter = self._admission(descriptor, invocation, initial)
+        with self.journal.locked():
+            binding = f"{invocation.step}:{invocation.target}"
+            state = self.journal.load(binding, initial)
+            recovered = recover(state)
+            if recovered != state:
+                self.journal.save(binding, recovered)
+                state = recovered
+            if len(state.receipts) > MAX_HISTORY - 4:
+                raise Refused("bounded journal history requires owner archival")
+            running = begin(state, invocation.pins, retry=retry)
+            dispatched = self._attempt(invocation, running, "run")
+            self.journal.save(
+                binding,
+                running,
+                invocation=dispatched,
+                intent=OriginalIntent(binding, dispatched, adapter.source),
+            )
+            evidence = None
+            try:
+                with contained_output():
+                    result = self._result(
+                        adapter, dispatched, adapter.invoke(dispatched)
+                    )
+                completed = finish(
+                    running, invocation.pins, result.outcome, created=result.created
+                )
+                evidence = result
+            except Exception:
+                completed = finish(running, invocation.pins, Outcome.UNCERTAIN)
+            self.journal.save(binding, completed, evidence, dispatched)
+            return completed
+
+    def rollback(
+        self, descriptor: Descriptor, invocation: Invocation, initial: StepState
+    ) -> StepState:
+        adapter = self._admission(descriptor, invocation, initial)
+        with self.journal.locked():
+            binding = f"{invocation.step}:{invocation.target}"
+            state = self.journal.load(binding, initial)
+            if recover(state) != state:
+                self.journal.save(binding, recover(state))
+                raise Refused("lost rollback result requires owner reconciliation")
+            if adapter.rollback is None:
+                raise Refused("owner has no reviewed undo adapter")
+            if len(state.receipts) > MAX_HISTORY - 4:
+                raise Refused("bounded journal history requires owner archival")
+            running = begin_rollback(state, invocation.pins)
+            dispatched = self._attempt(invocation, running, "rollback")
+            self.journal.save(
+                binding,
+                running,
+                invocation=dispatched,
+                intent=OriginalIntent(binding, dispatched, adapter.source),
+            )
+            evidence = None
+            try:
+                with contained_output():
+                    result = self._result(
+                        adapter,
+                        dispatched,
+                        adapter.rollback(dispatched, running.last.created),
+                    )
+                verified = result.outcome is Outcome.ROLLED_BACK and not result.created
+                evidence = result if verified else None
+            except Exception:
+                verified = False
+            completed = finish_rollback(running, invocation.pins, verified=verified)
+            self.journal.save(binding, completed, evidence, dispatched)
+            return completed
+
+    def reconcile(
+        self, descriptor: Descriptor, invocation: Invocation, initial: StepState
+    ) -> StepState:
+        """Explicit owner-native state inspection; never redispatches the mutation."""
+        adapter = self._admission(descriptor, invocation, initial)
+        if adapter.reconcile is None and adapter.reconcile_original is None:
+            raise Refused("owner reconciliation adapter absent")
+        with self.journal.locked():
+            binding = f"{invocation.step}:{invocation.target}"
+            state = recover(self.journal.load(binding, initial))
+            if not state.last or state.last.outcome not in (
+                Outcome.UNCERTAIN,
+                Outcome.FAILED_AFTER,
+            ):
+                raise Refused("no uncertain mutation to reconcile")
+            if len(state.receipts) > MAX_HISTORY - 4:
+                raise Refused("bounded journal history requires owner archival")
+            state = replace(
+                state,
+                receipts=(
+                    *state.receipts,
+                    Receipt(len(state.receipts) + 1, Outcome.UNCERTAIN),
+                ),
+            )
+            original = (
+                self.journal.original_intent(binding, invocation, adapter.source)
+                if adapter.reconcile_original is not None
+                else None
+            )
+            dispatched = self._attempt(invocation, state, "reconcile")
+            self.journal.save(binding, state, invocation=dispatched)
+            with contained_output():
+                result = self._result(
+                    adapter,
+                    dispatched,
+                    adapter.reconcile_original(ReconcileContext(original, dispatched))
+                    if original is not None
+                    else adapter.reconcile(dispatched),
+                )
+            if result.outcome not in (
+                Outcome.NO_CHANGE,
+                Outcome.SUCCESS,
+                Outcome.FAILED_BEFORE,
+            ):
+                raise Refused("owner did not reconcile target state")
+            # Validate created-object scope using the same closed result reducer.
+            finish(
+                begin(
+                    StepState(
+                        state.step_id,
+                        state.owner,
+                        state.pins,
+                        state.allowed_created,
+                        state.retry_safe,
+                    ),
+                    state.pins,
+                ),
+                state.pins,
+                result.outcome,
+                created=result.created,
+            )
+            reconciled = StepState(
+                state.step_id,
+                state.owner,
+                state.pins,
+                state.allowed_created,
+                state.retry_safe,
+                (
+                    *state.receipts,
+                    Receipt(len(state.receipts) + 1, result.outcome, result.created),
+                ),
+            )
+            self.journal.save(binding, reconciled, result, dispatched)
+            return reconciled
+
+
+class OwnerInterrupted(KeyboardInterrupt):
+    """Sanitized interruption preserves persisted running/crash recovery semantics."""
+
+    def __init__(self):
+        super().__init__("owner execution interrupted")
+
+
+class _Discard:
+    """Never retain or forward adapter output, including unbounded malicious text."""
+
+    def write(self, text):
+        return len(text)
+
+    def flush(self):
+        pass
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/tests/test_case_current_session_reference.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/tests/test_case_current_session_reference.py
new file mode 100644
index 0000000..8a474a3
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/tests/test_case_current_session_reference.py
@@ -0,0 +1,105 @@
+"""Current caller authentication never replaces historical dispatch provenance."""
+from dataclasses import replace
+
+import pytest
+
+from tests.test_case_run import make_rig
+from warden.case_receipt_state import Outcome, Refused
+from warden.case_run import Executor, Journal
+
+
+def fresh_verifier(executor, *, allow=True):
+    original = executor.evidence_verifier
+    def verify(purpose, source, evidence):
+        if purpose.startswith("caller-session:") and evidence == "fresh-session":
+            return allow
+        return original(purpose, source, evidence)
+    executor.evidence_verifier = verify
+    return verify
+
+
+def rows(executor):
+    return tuple(executor.journal.db.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0]
+                 for table in ("receipts", "intents"))
+
+
+def readmit(executor, sources, kwargs, reference="session"):
+    return executor.admit(*sources, **{**kwargs, "session_evidence": "fresh-session",
+                                      "original_session_reference": reference})
+
+
+def test_normal_new_session_cannot_rewrite_original_journal_pins(tmp_path):
+    executor, admitted, _, sources, kwargs = make_rig(tmp_path)
+    executor.run(*admitted)
+    fresh_verifier(executor)
+    before = rows(executor)
+    changed = executor.admit(*sources, **{**kwargs,"session_evidence":"fresh-session"})
+    assert changed[1].pins != admitted[1].pins
+    with pytest.raises(Refused,match="journal pins changed"):
+        executor.rollback(*changed)
+    assert rows(executor) == before
+
+
+def test_fresh_process_inverse_retains_original_pins_without_replay(tmp_path):
+    executor, admitted, calls, sources, kwargs = make_rig(tmp_path)
+    assert executor.run(*admitted).last.outcome is Outcome.SUCCESS
+    before = rows(executor)
+    fresh = Executor(Journal(executor.journal.directory), executor.adapters,
+                     fresh_verifier(executor))
+    renewed = readmit(fresh, sources, kwargs)
+    assert renewed[1].pins == admitted[1].pins
+    assert rows(fresh) == before
+    with pytest.raises(Refused):
+        fresh.run(*renewed)
+    assert len(calls) == 1
+    assert fresh.rollback(*renewed).last.outcome is Outcome.ROLLED_BACK
+
+
+@pytest.mark.parametrize("kind", ["missing-intent", "orphan-intent", "wrong-principal", "wrong-reference", "same-as-current", "invalid-reference", "inactive-current"])
+def test_original_reference_is_never_authentication_or_new_intent(tmp_path, kind):
+    executor, admitted, calls, sources, kwargs = make_rig(tmp_path)
+    if kind != "missing-intent":
+        executor.run(*admitted)
+    if kind == "orphan-intent":
+        executor.journal.db.execute("DELETE FROM intents")
+    if kind == "wrong-principal":
+        kwargs = {**kwargs,"principal":"another-operator"}
+    fresh_verifier(executor, allow=kind != "inactive-current")
+    before = rows(executor)
+    reference = {"wrong-reference": "unrelated-session", "same-as-current": "fresh-session",
+                 "invalid-reference": "not valid"}.get(kind, "session")
+    with pytest.raises(Refused):
+        readmit(executor, sources, kwargs, reference)
+    assert rows(executor) == before
+
+
+def test_unknown_effect_stays_unknown_after_current_readmission(tmp_path):
+    executor, admitted, calls, sources, kwargs = make_rig(tmp_path)
+    old = executor.adapters[admitted[0].adapter]
+    def interrupted(inv):
+        calls.append(inv)
+        raise KeyboardInterrupt
+    executor.adapters[old.reference] = replace(old, invoke=interrupted)
+    with pytest.raises(KeyboardInterrupt):
+        executor.run(*admitted)
+    fresh_verifier(executor)
+    before = rows(executor)
+    renewed = readmit(executor, sources, kwargs)
+    assert rows(executor) == before
+    with pytest.raises(Refused):
+        executor.run(*renewed, retry=True)
+    state = executor.journal.load("mint-secret:fixture-client", renewed[2])
+    assert state.last.outcome is Outcome.UNCERTAIN
+    assert len(calls) == 1
+
+
+def test_current_session_revalidated_after_readmission_before_journal_write(tmp_path):
+    executor, admitted, _, sources, kwargs = make_rig(tmp_path)
+    executor.run(*admitted)
+    fresh_verifier(executor)
+    renewed = readmit(executor, sources, kwargs)
+    executor.evidence_verifier = lambda *_: False
+    before = rows(executor)
+    with pytest.raises(Refused, match="caller session no longer verified"):
+        executor.rollback(*renewed)
+    assert rows(executor) == before
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/workplans/WARDEN-WP-0044-security-case-follow-through.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/workplans/WARDEN-WP-0044-security-case-follow-through.md
new file mode 100644
index 0000000..6c09ae9
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/postimages/workplans/WARDEN-WP-0044-security-case-follow-through.md
@@ -0,0 +1,410 @@
+---
+id: WARDEN-WP-0044
+type: workplan
+title: "Follow through on KnownSecurityCases along their type's route"
+domain: infotech
+repo: ops-warden
+status: active
+flavor: implementation
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-08"
+updated: "2026-10-11"
+depends_on: []
+related_repos:
+  - net-kingdom
+  - ops-mason
+  - key-cape
+  - railiance-platform
+state_hub_workstream_id: "f7e81013-6868-5d99-8528-ba75a442eca9"
+---
+
+# WARDEN-WP-0044 — Follow through on KnownSecurityCases along their type's route
+
+## Why
+
+NetKingdom is introducing SecurityCaseTypes (net-kingdom `NK-WP-0048`, canon
+`security-case-types_v0.1`, proposed). Once a case of an implemented type is
+accepted and ops-mason has materialized its structure (`MASON-WP-0010`),
+ops-warden carries out the remaining steps. These are the owners' declared entry
+points, run on the authentication path the type defines, followed by the type's
+verification.
+
+Today ops-warden routes needs and, for `exec_capable` lanes, proxies fetches as
+the caller. It does not yet know about cases, and each new integration ends with
+a founder running a hand-written script (for example the proposed KEY-WP-0038-T02
+rollout). This plan gives ops-warden the follow-through role, without widening
+what it may do: each step still runs under its owner's entry point and the
+caller's identity.
+
+## Tasks
+
+```task
+id: WARDEN-WP-0044-T01
+status: done
+depends_on: [NK-WP-0048-T03]
+priority: high
+state_hub_task_id: "ef0920fc-418e-52cb-acff-9a5c0c728bf5"
+```
+
+### T01 — Define the type's follow-through section
+
+Propose the `follow_through` part of the SecurityCaseType schema together with
+net-kingdom. For each step it names the owner entry point, `warden_executes`,
+the auth method and lane, whether an attended human login is unavoidable (with
+the type's justification), and the verification command. Write it for the first
+type, `oidc-browser-relying-party`, covering key-cape client registration,
+custody minting and LLDAP group membership.
+
+2026-10-08: NK-WP-0048-T03/T04 landed with a drafted section. Review is in
+`history/2026-10-08-oidc-rp-follow-through-review.md`. It requires three
+changes before T02: a per-step `lane`, a narrow `warden_executes`, and
+`value_handling`. It also lists four refinements. This task is done when
+net-kingdom acknowledges the review (NK-WP-0048-T05).
+
+2026-10-09: R4 was withdrawn in favour of ops-mason's per-case
+`{consuming_service}-keycape-client`, with the entry body templated in the type
+(R4′, see the addendum in the review).
+
+2026-10-09: the revised 1.0 type and canon now carry R1–R3, R4′, R5–R7.
+`warden case check-type <type.yaml>` (`src/warden/case_type.py`, tests in
+`tests/test_case_type.py`) checks a type's follow-through mechanically: the
+live type is schema-conformant, with one attended session
+(`key-cape-oidc-login`). It is not yet plannable, because two lanes are not
+in the catalog: `identity-provisioner-groups` (net-kingdom) and
+`keycape-client-secret-generate` (railiance-platform). These gate T02, not
+T01. T01 still closes on net-kingdom's acknowledgement (NK-WP-0048-T05).
+
+2026-10-09: ops-warden cannot add `identity-provisioner-groups` as the type
+declares it. The provisioner accepts only user-engine's runtime token and
+admits only user-engine pods, so no caller-identity path exists. R8 (review
+addendum) asks net-kingdom either to move `ensure-groups` into the existing
+attended session (recommended) or to give the provisioner an operator
+credential. `keycape-client-secret-generate` needs a generate-in-custody entry
+point from railiance-platform, and the broker does not have one yet. Both were
+sent to their owners.
+
+2026-10-09: done. net-kingdom took R8 option 1, so `ensure-groups` runs attended
+in the `register-client` session and `identity-provisioner-groups` is dropped
+(net-kingdom `0e86f95`). The founder acknowledged the type with memo r4 (hub
+decision `e418263e`, NK-WP-0048-T05 done).
+
+```task
+id: WARDEN-WP-0044-T02
+status: done
+depends_on: [WARDEN-WP-0044-T01]
+priority: high
+state_hub_task_id: "5f68c991-f490-58f8-a121-92f74073d272"
+```
+
+### T02 — Plan a case run
+
+`warden case plan <case.yaml>` checks that the case is accepted and materialized,
+resolves each step to its catalog entry and entry point, and prints the run:
+which steps warden executes, which run as the attended caller, what the
+verification is. No secret values; no execution.
+
+Tests: refuse an unaccepted or unmaterialized case; refuse a step whose catalog
+entry is missing or not reviewed; show attended steps explicitly.
+
+2026-10-09: done. `warden case plan <case.yaml> [--type] [--json]`
+(`src/warden/case_plan.py`, 14 tests in `tests/test_case_plan.py`). It refuses:
+- a case that is not `materialized`, or has no acceptance record
+- a type that is mismatched or not acknowledged
+- any `case check-type` finding, including a missing or unreviewed lane
+- undeclared, type-fixed or secret-sensitivity parameters
+- a placeholder the case does not set, or an unsupported `when`
+
+It fills type defaults (`issuer`), evaluates `<param> == <value>` conditions,
+renders owner, entry point, auth and ready_check, groups attended steps per
+lane, and lists the applicable verification.
+
+The live Forgejo case is correctly refused: it is `accepted`, not
+materialized. A materialized copy, with a stand-in lane for
+`keycape-client-secret-generate`, renders six steps: two attended steps plus
+`register-client` in one `key-cape-oidc-login` session, one warden step
+(`mint-secret`), and two owner steps. Seven checks follow.
+
+Observation for net-kingdom (not blocking): `bind-env` runs before
+`register-client`, in type order. Its entry carries a literal
+`KEYCAPE_<CLIENT_ID>_CLIENT_SECRET`, which is not a `{param}` placeholder, so it
+reaches the plan unrendered.
+
+2026-10-09 follow-up:
+- **Format specs.** `_render` supports net-kingdom's `{param:env}` spec (upper
+  case, `-` as `_`, the same as `keycape-client.py env_name`) and refuses any
+  other spec or `!conversion`.
+- **Case reference.** The plan prints `case-ref: <case_id>@sha256:<hex>` over the
+  case file's exact bytes. This is the reference proposed to railiance-platform
+  for `credential.py generate --case-ref` (RPF-WP-0054-T01); the broker
+  re-derives it from the file.
+- 18 tests now.
+
+```task
+id: WARDEN-WP-0044-T03
+status: progress
+depends_on: [WARDEN-WP-0044-T02, MASON-WP-0010-T03]
+blocking_reason: "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run."
+priority: high
+state_hub_task_id: "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
+```
+
+### T03 — Run and verify a case
+
+2026-10-18 current-session continuation: the new optional
+`Executor.admit(original_session_reference=...)` separates immutable original
+run-sheet provenance from fresh independently verified current session evidence.
+It requires the exact existing journal and original running intent under the
+normal lock, refuses missing/orphan/changed context and retains all original
+pins. Current authority is rechecked before every subsequent write/callback;
+neither the original reference nor a fresh login can replay a completed effect
+or clear uncertainty. No descriptor/Invocation/receipt schema or default
+admission behavior changes. Source integration uses the actual KeyCape CLI over
+HTTPS, a fresh Python owner process and actual Warden SQLite, with synthetic
+case/catalog/owner/effect attestations only. Exact source/proof is retained by
+CUST-WP-0080 under `keycape-current-client-r1`. Native owner mappings, current
+operation/effect authority, credential custody, case/type/descriptor refreeze,
+Forgejo inverse semantics and first native acceptance remain open; no lane,
+adapter, runtime or caller scope is activated by this source change.
+
+`warden case run <case.yaml>` executes the plan. Owner entry points run through
+the existing proxy as the caller; steps that need an attended login use the
+existing contained login envelope (silent command, session revoked afterwards),
+grouped into as few attended sessions as possible. Then it runs the type's
+verification and writes a receipt without values. `warden case rollback`
+reverses exactly this case's steps.
+
+Acceptance: the Forgejo reference case (NK-WP-0048-T06) reaches `live` through
+this path, with no case-specific script.
+
+2026-10-17: original-intent lookup/context interface for NK-WP-0048-T15, source
+and synthetic tests only. `src/warden/case_run.py`: `Executor.run` writes an
+`OriginalIntent` (schema `warden.case.original-intent.v1`: the dispatched run
+Invocation — attempt, step, owner, target, actor, principal, lane, all six pins,
+tenant, realm — plus admitted adapter source) in the same SQLite transaction as
+the pre-dispatch journal row. `Journal.original_intent(binding, current, source)`
+returns it after restart and refuses on a missing record or any
+pins/source/step/owner/target/actor/principal/lane/tenant/realm mismatch, before any
+journal write, so the step stays uncertain. An adapter's
+`reconcile_original(ReconcileContext(original, attempt))` receives the original
+intent separately from the new reconcile attempt. This is Warden's record of what
+it dispatched, not owner created-only provenance. Current Executor.admit leaves
+tenant/realm empty; the reserved coordinates establish no admitted provenance.
+Owner descriptors/adapters, contained session integration, Forgejo
+materialization and the native run remain open.
+
+2026-10-17 source consistency follow-through: retained the additive intents table
+and reconcile_original callback and fixed four reproduced local defects: original
+actor mismatch, payload/SQL attempt-ID mismatch, orphan intent without its
+matching original running receipt, and arbitrary nonmetadata values accepted by
+the original-intent serializer. Exact bounded field validation, duplicate-free
+bounded decode and save-time intent/invocation/running-state equality now preserve
+the original receipt linkage before owner lookup. No new context store, native
+verifier, trust root, adapter activation or authority migration was introduced.
+
+The actual canonical focused kernel and new consistency suite passes 54 checks;
+owner-installed Ruff check/format passes. The existing generated-data/synthetic
+owner fixture and a distinct interpreter prove source correspondence/refusal,
+not independent native custody or creation. Earlier comparison probes and failed
+preparation are retained. Current caller and fresh session/grant revocation checks
+remain required; original owner payload/revocation, exact native readback and
+created-only provenance still need independent authenticated owner admission.
+No JSON/SQL context, unknown tenant/realm, changed run-sheet or legacy missing
+intent supplies recovery, replay or undo authority. T03 remains progress and all
+native acceptance gates/statuses/dependencies/UUIDs remain unchanged. Evidence:
+Custodian original-context-compare-r2 and original-context-owner-followthrough-r3
+under docs/changes/netkingdom-target-2026-10-17/; publication/projection is separate.
+
+Agreed with railiance-platform (RPF-WP-0054-T01, 2026-10-09):
+- `mint-secret` runs `credential.py generate --grant keycape/client-secret-generate
+  --client-id <id> --case-ref <case-ref> --case-file <case.yaml>` as the caller's
+  child process. The broker re-derives the case-ref and checks status and
+  client_id.
+- warden refuses that step when `WARDEN_AGENT_ID` is set.
+
+2026-10-10: railiance-platform implemented the command (RPF-WP-0054-T03). It is
+catalogued as draft `keycape-client-secret-generate`, with `exec_owner`
+railiance-platform and `exec_capable: false`. `warden case check-type` now
+reports the lane as LANE-UNREVIEWED rather than LANE-MISSING. Before it can be
+activated:
+- the founder binds the issuer policy to the operator OIDC role
+- key-cape confirms the secret format
+- the RPF-WP-0054-T05 probe passes
+
+2026-10-10 (later):
+- **Broker lane.** The issuer role is bound (CCR-2026-0043) and the T05 probe
+  passed (railiance-platform `21b8af3`). Only key-cape's format confirmation is
+  left. The playbook now includes the issuer-role login, a 15m token with
+  unlimited uses that `warden case run` must group with the attended session.
+- **Env spec.** net-kingdom adopted `{client_id:env}` as a 1.0 patch
+  (`9a9b8e3`). The plan renders `KEYCAPE_FORGEJO_CLIENT_SECRET`.
+- **Forgejo case.** Rendered and built by ops-mason. It is not yet
+  `materialized`: MASON-WP-0010-T03 waits on the railiance-platform CCRs and
+  their founder apply.
+
+2026-10-10: `keycape-client-secret-generate` activated on railiance-platform's
+go-ahead (message 20973a9c) after key-cape confirmed the format (4e0213b3).
+`warden case check-type` on the live type now reports `plannable=True`. The
+only thing T03 still waits on is the Forgejo case reaching `materialized`
+(MASON-WP-0010-T03).
+
+2026-10-10: net-kingdom moved the type to 1.1 (`e2174ce`) and re-pinned the
+Forgejo case. 1.1 adds the verification `consumer-enforces-groups` and requires
+the hand-over to enforce `access_groups`. `check-type` on 1.1 reports
+`plannable=True`, and a materialized copy renders six steps and the new check.
+The case-ref digest covers the whole case file, including `status`, so it
+changes when the case becomes `materialized`. `warden case run` therefore takes
+it from the file at run time, and the broker re-derives it from the same file.
+
+```task
+id: WARDEN-WP-0044-T04
+status: wait
+depends_on: [WARDEN-WP-0044-T03]
+blocking_reason: "Catalog integration follows a proven run."
+priority: medium
+state_hub_task_id: "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e"
+```
+
+### T04 — Catalog entries from types
+
+Let a type contribute reviewed catalog entries once, so that every case of that
+type routes without a new catalog edit. Cases add parameter values, not routes.
+`warden route find` should be able to answer "which SecurityCaseType covers this
+need?" before anyone builds by hand.
+
+
+2026-10-10 consolidation source prototype (not an accepted owner adapter API):
+`src/warden/case_receipt_state.py` provides a pure immutable receipt reducer,
+with exact case/type/adapter/catalog/acceptance/run-sheet pins, running intent
+before dispatch, uncertain recovery after a lost result, no success replay,
+explicit retry-safe failed-before-change retry and created-only reverse undo.
+It executes nothing and accepts no command output. The caller must durably
+persist running before any future side effect; storage/authenticated owner
+receipts/live adapters are not implemented. Focused offline tests cover changed
+pins, lost receipts, retry/refusal, uncertain rollback and shared-object
+preservation. Source proposal: `docs/security-case-execution-proposal.md`.
+
+T03 remains open: typed owner execution/receipt contracts require review, the
+Forgejo structural materialization needs owner receipts, and CLI dispatch,
+contained sessions, native verification and provenance remain unimplemented.
+There is a circularity to resolve with net-kingdom/ops-mason: materialization
+cannot require mint-secret if mint-secret is itself a follow-through step whose
+planning requires materialized. No case status is changed by this prototype.
+
+
+2026-10-11: the exact execution-design memo version1 has confirmed native human
+acceptance (approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca). The approved proposal
+bytes remain unchanged. `src/warden/case_run.py` now implements a closed v1 local
+execution seam, independent admission/evidence callbacks, private transactional
+SQLite receipt storage, process locking, running-before-dispatch, crash recovery
+to uncertainty, explicit safe retry, separately required broker-grant and parent-session revocation
+proofs, native owner reconciliation and created-only
+reverse rollback. Thirty-seven kernel tests and fourteen reducer tests pass;
+ruff checks pass. See `docs/security-case-execution-kernel-v1.md` for exact scope
+and receipt provenance. No installed native adapter or live CLI execution is
+claimed. Current prose types stay plan-only; acknowledged descriptor/type machine
+seams and authenticated owner/caller receipts are still required. T03 progresses
+for implementation but cannot finish before ordered native Forgejo acceptance.
+
+2026-10-16 source preparation (isolated checkout; no native acceptance):
+T03's browser parameter mismatch now has a producer-validator-backed projection
+in `case_inputs.py`, explicitly configured on the real Executor. Exact 1.1/1.2
+parameter definitions and all four reviewed producer modules are pinned; full case
+validation admits reviewed security-sensitive metadata while unknown/fixed/secret
+inputs and type/producer drift refuse. Only the reviewed descriptor target
+reaches the owner callback; no parameter journal payload is added. Actual
+Executor/producer tests cover positive versions and refusal/containment paths.
+Acknowledged machine descriptors, authenticated owner evidence, real Forgejo
+materialization and contained native sessions remain mandatory and unimplemented;
+T03 stays progress, T04 stays wait. No type or case status changed.
+
+2026-10-16 producer source refresh: independently reviewed NetKingdom
+`015694ee414c802dc2ef1fa0120dfed610086e69` optional descriptor-map repair.
+Only the validator/evidence source pins change; exact parameter and transitive
+source identity remain enforced. Actual canonical producer, Executor and reducer
+suite passes 87 checks, including 14 new malformed-map integration cases; all
+four missing/changed modules still refuse. Review:
+`docs/reviews/2026-10-16-browser-producer-pin-refresh.md`. No adapter attestation,
+native acceptance, credential use or privileged dispatch. T03 remains progress.
+
+
+## T03 source correction and safe-test follow-through — 2026-10-17
+
+The reviewed KERNEL-2/3 source now authenticates and parses the actual catalog
+snapshot, checks lane owner/risk/delegation, and resolves each type step's Warden,
+attended or owner dispatch mode. Four proposed attended-change lanes remain
+DRAFT; no lane is promoted and PARAMETER_PINS still contains only 1.1/1.2.
+
+Independent review KR1-F1/F2 found cached attended run/rollback/reconcile could
+lose the human/runtime boundary, and actual admission lacked the planner's
+establishing-login checks. The exact successor retains the mode and authenticated
+catalog bytes and repeats caller/session, agent marker and attended-lane checks
+before any journal write or callback on all three operations. Planner and executor
+share active/reviewed login/session-lane validation. Two unresolved Apps session
+lanes correctly remain refused. Integration tests now explicitly disclose all
+fixture authority substitutions; they establish no owner or native authority.
+
+The new 19-test regression matrix reproduces 13 failures on its predecessor and
+passes on the candidate. A fresh independent reviewer adds changed-authority and
+catalog-snapshot probes: 90 focused checks and six guarded integration checks
+pass; the combined predecessor comparison has 22 expected failures. Author's
+isolated full suite passes 765 with four integration-marked tests deselected.
+Evidence: Custodian warden-1.3-kernel-fixes-r1 and warden-1.3-kernel-review-r2
+under docs/changes/netkingdom-target-2026-10-17. Original unsuccessful review,
+invalid setup attempts and unknown ambient-lookup outcome are retained.
+
+A separate reviewed test-only fix stubs ambient OpenBao identity in access CLI
+unit tests and adds a synthetic sentinel regression which fails before any
+subprocess can launch on the predecessor; 26 access/helper checks pass. The real
+production helper is unchanged. The first old review's unisolated launches may
+have invoked ambient `bao token lookup`; remote reach/success remain unknown,
+with no secret displayed. This patch does not erase that adverse outcome.
+
+Explicit remaining safe-test work is retained in this live T03 scope, owned by
+ops-warden: replace or wrap the ordinary unit-test entry path with allowlisted
+environment/empty synthetic HOME and guarded subprocess/network execution,
+including nested validator children. Completion requires representative access
+and case tests to refuse token-file/environment and live provider access under
+synthetic negative controls while permitted local fixtures remain usable. Until
+then use the preserved isolated review runner, not the ambient `make test` path.
+No credential lookup, live investigation or rotation is authorized by this note.
+T03 remains progress; contained sessions, authenticated owner provenance,
+materialization, exact type acknowledgment/pin and first native case remain open.
+
+
+2026-10-17 safe unit-runner source candidate: `make test` now selects an existing
+interpreter and `scripts/run_unit_tests.py`, which constructs the environment and
+empty temporary HOME before pytest collection, denies unexpected process/socket
+use and ambient file opens, and guards the pinned BrowserInputs child too.
+Closed fixture exceptions cover the synthetic desk endpoint, metadata checkers,
+exact-byte contract doubles and fixed transport prints; they confer no provider
+authority. Explicit public declaration fixtures replace ambient HOME source
+lookups. See `docs/development/safe-unit-tests.md` and Custodian packet
+`docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1`.
+Synthetic token, ambient-path, forged-provider and nested-child regressions are
+retained alongside the initial failed isolation runs and corrected results. This
+is a source candidate for the existing safe-test handoff, not an OS sandbox or
+native case acceptance. T03 remains progress; contained sessions, authenticated
+owner provenance, materialization, exact type acknowledgment/pin and first native
+case remain open. No credential lookup, live investigation or rotation occurred.
+
+Candidate validation: ordinary `make test` under synthetic ambient token/HOME
+controls passes 783 tests with four integration-marked tests deselected. Affected
+focused checks pass 117 tests; new runner code/regressions pass Ruff. Retained
+initial failures exposed fixture dependencies and were corrected, not suppressed.
+
+
+2026-10-17 root follow-through: the original safe-runner source candidate was
+independently rejected for O_TRUNC open-write misclassification and unchecked
+public fixture projection hashes. Both counterexamples are retained. The minimal
+correction treats truncating/appending opens as writes and adds the closed
+projection-byte provenance regression. Root inspected the two exact corrections
+and ran ordinary make test on stable corrected source with only synthetic parent
+HOME/token/Python/pytest sentinels: 785 passed, four deselected. No real credential
+or native provider action occurred. Initial author failures and rejected review
+are preserved in the Custodian warden-safe-unit-runner-r1 and
+warden-safe-unit-runner-review-r1 packets, with root disposition/full result in
+warden-safe-unit-integration-r1. This completes the known trusted-unit-entry
+accident-prevention follow-through; direct pytest bypass, native/non-open/preopened
+file-descriptor limits remain explicit. No OS sandbox, isolated agent assignment,
+production grant or native T03 acceptance follows. T03 stays progress.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/docs/security-case-execution-kernel-v1.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/docs/security-case-execution-kernel-v1.md
new file mode 100644
index 0000000..13bec32
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/docs/security-case-execution-kernel-v1.md
@@ -0,0 +1,154 @@
+# Closed case execution kernel v1 — 2026-10-11
+
+Owner implementation record for WARDEN-WP-0044-T03. The architectural proposal
+at SHA256 78ab1439e4c5beb205aeccf15b1b2e706511be55ab195c5a3aa682f326c7c77c
+was accepted through memo `infd-20261010-security-case-execution`, version 1,
+approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca, confirmed disposition
+disp-cf44dacb-2117-4de7-8f90-cfa99f84f325 at 2026-10-10T23:23:31Z. The original
+approved proposal remains byte-identical. That decision accepts source design;
+it grants no execution session, credential or deployment authority.
+
+`src/warden/case_run.py` advances the pure reducer into an executable injected
+owner harness with private durable receipts. Descriptor version
+`warden.case.execution.v1` is a closed local implementation seam, not an accepted
+NetKingdom type schema. It contains fixed owner/adapter/source digest, actor,
+lane, target parameter, effect, reviewed created-object identifiers declared
+retry safety and explicit required revocation scopes (parent-session and broker-grant).
+A mint descriptor cannot omit either scope. Unknown fields, free shell text and secret parameters are refused.
+An acknowledged type must additionally pin the descriptor bytes under its
+`execution_descriptors` map and independent owner evidence must authenticate
+that exact machine-seam revision. Existing descriptive types lack this map and
+remain plan-only. Their acknowledged labels do not authorize this new seam.
+
+There are no installed owner adapters, native provenance verifier or dispatch CLI
+in this change. Callables are injected only through a fixed adapter registry,
+with immutable owner reference/source pins. A real integration must supply
+independent owner/native verification or explicit attended manual evidence;
+a bare JSON receipt identifier is insufficient. Fixture verifiers in tests
+are deliberately fake and attest no native case. Caller sessions are independently
+verified for exact principal/actor/lane at admission and again before dispatch;
+input actor labels alone are never sufficient. Agent mint is refused, including
+when WARDEN_AGENT_ID appears after initial human admission.
+
+Each admission pins exact case/type/descriptor/catalog bytes, acceptance reference
+and run-sheet identity. Actual ops-mason materialization evidence is required
+against the case source, separately from its status label. Case parameters supply
+an exact metadata target. Source/session changes cannot inherit journal success.
+Owner results have a closed metadata shape, result evidence fingerprint and
+separate independently authenticated grant/parent-session revocation evidence
+fingerprints. An aggregate revoked boolean alone cannot satisfy either scope. Unknown result payloads, unverified evidence, absent revocation and
+created objects outside the reviewed scope become uncertain, never success.
+Python and OS stdout/stderr, including inherited child-process output, are
+discarded without buffering or retention under a serialized fd containment
+context. Independent provenance verification uses the same containment and
+sanitizes exceptions. All source inputs are capped at 256 KiB before parsing.
+Error text is not copied to the journal. KeyboardInterrupt/SystemExit and other
+owner interruptions are rethrown with a fixed message while retaining running
+intent for crash recovery.
+
+The journal uses an owner-private 0700 directory and 0600 files, refuses symlinks
+and insecure modes, uses SQLite FULL synchronization and commits running intent
+before calling the adapter. A separate process lock prevents concurrent mutation.
+A crash between dispatch and final receipt leaves running; the next lock holder
+persists uncertain before refusing replay. Both intent and outcome remain in
+history. Each persisted attempt has a unique identity bound to all exact pins,
+operation (run/reconcile/rollback), sequence and nonce. Adapter results and both
+revocation proof purposes carry that identity. Prior-attempt evidence cannot
+verify a safe retry, even if a caller rewrites result labels. Descriptor-created
+objects are capped at 32 and histories at 128 transitions, with dispatch stopped
+before archival is required. A throw or lost response is not failed-before-change. A safe retry needs
+verified failed-before-change, unchanged pins, descriptor retry-safe and explicit
+retry. Success and no-change cannot replay.
+
+Reconciliation is an explicit fixed owner callback, never the mutation callback.
+It may verify an already-present native CAS result as no-change/success, or prove
+failed-before-change; it never tells Warden to regenerate a credential. Uncertain
+or failed-after-change requires this owner-native inspection before any retry.
+Owner proof and revocation remain mandatory. Rollback visits only objects in a
+verified creation receipt, in reverse order; no-change has no undo and shared
+objects are excluded. Unknown/lost undo blocks another rollback.
+
+The kernel operates individual admitted steps. Full ordered run-sheet orchestration,
+verification inventory, contained login integration, native owner adapters and
+CLI activation remain WARDEN-WP-0044-T03; no overall native-complete result is
+implemented. Current Forgejo source is not materialized and has no acknowledged
+machine descriptors. Its first native run remains an acceptance requirement,
+with real materialization, separately authenticated broker-grant and parent-session
+revocation receipts, session/owner receipts and consumer enforcement. This
+implementation neither promotes a type nor changes any case status.
+
+Validation: 37 new kernel tests plus 14 reducer tests pass (51 total). Tests open
+an independent SQLite connection inside dispatch to prove running was committed,
+crash after mutation and reopen a fresh journal to prove no duplicate invocation,
+lose a response then reconcile without mint, require explicit retry, check exact
+pins/session expiry, withhold malicious output and unconfirmed revocation, and
+prove created-only reverse undo plus uncertain-undo refusal. Ruff formatting and
+checks pass. No live token or target action occurred.
+
+## Browser input projection — 2026-10-16 source preparation
+
+An explicitly configured `BrowserInputs(netkingdom_root)` now validates browser
+cases before admission. It calls the real NetKingdom type/case validator over
+verified producer bytes in a disposable Python process (`-I`, empty environment,
+timeout, no inherited output). The validator, composer, capability contract and lazy evidence
+modules have exact source pins; missing or changed code refuses. There is no
+automatic discovery or download. A producer upgrade needs reviewed pin changes.
+
+Only the exact reviewed 1.1/1.2 browser parameter definitions qualify. A digest
+of each complete parameter definition list prevents reclassifying secrets as
+metadata, loosening constraints, or adding fields under a recognized version.
+The complete case passes producer validation, including required fields,
+constraints and credential-shape checks. Explicit fixed/default overrides,
+unknown fields and secret references refuse. Security-sensitive browser metadata
+can therefore be present without being passed to an owner adapter: the only
+projection is its descriptor's exact public/operational target identifier.
+No raw parameter values are added to invocations or persisted receipts.
+
+`require_implemented=False` validates the acknowledged type's source, not its
+execution authority. Existing descriptor/type/source/catalog/caller provenance
+gates stay mandatory. Neither historical browser type contains the required
+exact machine-descriptor map, and neither is promoted by this change. There are
+still no installed native owner adapters, authenticated provenance verifier,
+contained session/ordered run orchestration or live CLI dispatch. A journal digest
+is a fingerprint and cannot authenticate native evidence. Completion still needs
+owner-admitted descriptors and actual structural, mint/delivery, consumer and
+revocation/rollback evidence. Local fixture success is not native acceptance.
+
+Tests use the actual producer checkout (override sibling location with
+`WARDEN_TEST_NETKINGDOM_ROOT`), the real Executor, SQLite journal and injected
+test-only owner adapter/evidence verifier. Their descriptor extensions and case
+materialized labels exist only in memory. Canonical case/type bytes stay intact.
+
+Producer integration refinement: the accepted NetKingdom browser-case patch
+`d32a7f51cbf3012bee3e4bb329f4259dea867eff1c59a2b01a65d72774488d05`
+is now the tested producer revision. Its evidence module is imported lazily only
+by `check-evidence`, outside this admission path; Warden nevertheless pins and
+copies it with the complete reviewed producer set. Missing or modified bytes in
+any of the four modules refuse admission. The test covers every dependency.
+
+
+## Original-intent consistency boundary — 2026-10-17
+
+`OriginalIntent` and the optional additive
+`reconcile_original(ReconcileContext(original, attempt))` callback retain the
+original run separately from a fresh reconciliation attempt. Existing one-argument
+reconcile adapters remain source-compatible. Intent and pre-dispatch receipt are
+committed in one SQLite transaction; lookup now requires their exact attempt,
+actor, step/owner/target, source and pin correspondence. Missing legacy context,
+an orphan receipt, changed context or an invalid bounded field contract refuses;
+there is no backfill or new runtime holder.
+
+Original intent serialization accepts only the fixed reviewed Invocation/Pins
+field contract and bounded operational identifiers. Duplicate, oversized and
+malformed original records refuse. Current Executor.admit leaves tenant and realm
+empty: those reserved fields are not admitted tenant/realm provenance, and future
+nonempty coordinates need an authoritative owner contract. Raw owner payloads,
+credentials, parameters and caller output are not part of this context contract.
+
+Local dispatch correspondence is not independent owner proof. A real owner must
+still authenticate the exact original created-only result and original revocation,
+current native revision and the fresh attempt's session/grant evidence before
+recovery can count. No actual original holder/verifier or native adapter is added.
+NetKingdom's current registration adapter still has no reconciliation callback;
+source tests do not authorize its post-restart undo, replay or a changed caller/
+session/run-sheet migration. WARDEN-WP-0044-T03 remains a native acceptance gate.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/src/warden/case_run.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/src/warden/case_run.py
new file mode 100644
index 0000000..60692b8
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/src/warden/case_run.py
@@ -0,0 +1,1072 @@
+"""Closed local execution kernel v1; no installed adapters or live CLI dispatch.
+
+An owner must acknowledge each descriptor and provide an independent provenance
+verifier. Descriptive case types remain plan-only. Nothing executes shell prose.
+"""
+
+from __future__ import annotations
+
+from contextlib import contextmanager, redirect_stderr, redirect_stdout
+from dataclasses import asdict, dataclass, replace
+import fcntl
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import sqlite3
+import threading
+import uuid
+from typing import Callable
+
+import yaml
+from .case_inputs import BrowserInputs
+from .case_receipt_state import (
+    Outcome,
+    Pins,
+    Receipt,
+    Refused,
+    StepState,
+    begin,
+    finish,
+    recover,
+    begin_rollback,
+    finish_rollback,
+)
+
+IDENTIFIER = re.compile(r"[a-zA-Z0-9][a-zA-Z0-9_.:/@-]{0,191}\Z")
+MAX_SOURCE_BYTES = 262144
+MAX_HISTORY = 128
+OUTPUT_LOCK = threading.RLock()
+
+
+def bounded_source(value: bytes):
+    if type(value) is not bytes or len(value) > MAX_SOURCE_BYTES:
+        raise Refused("source exceeds bounded input contract")
+
+
+@contextmanager
+def contained_output():
+    """Discard Python and inherited OS stdout/stderr; serialize process fd changes."""
+    with OUTPUT_LOCK:
+        saved = []
+        null = os.open(os.devnull, os.O_WRONLY)
+        try:
+            for target in (1, 2):
+                saved.append((target, os.dup(target)))
+                os.dup2(null, target)
+            with redirect_stdout(_Discard()), redirect_stderr(_Discard()):
+                try:
+                    yield
+                except Exception:
+                    raise Refused("owner callback failed") from None
+                except BaseException:
+                    raise OwnerInterrupted() from None
+        finally:
+            for target, original in saved:
+                os.dup2(original, target)
+                os.close(original)
+            os.close(null)
+
+
+DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
+
+
+def digest(value: bytes) -> str:
+    return "sha256:" + hashlib.sha256(value).hexdigest()
+
+
+@dataclass(frozen=True, slots=True)
+class Descriptor:
+    version: str
+    step: str
+    owner: str
+    adapter: str
+    adapter_source: str
+    actor: str
+    lane: str
+    target_parameter: str
+    effect: str
+    allowed_created: tuple[str, ...]
+    retry_safe: bool
+    revocation_scopes: tuple[str, ...]
+
+    @classmethod
+    def decode(cls, source: bytes) -> Descriptor:
+        bounded_source(source)
+        try:
+            obj = json.loads(source)
+            if set(obj) != set(cls.__dataclass_fields__):
+                raise ValueError
+            if not isinstance(obj["allowed_created"], list):
+                raise ValueError
+            obj["allowed_created"] = tuple(obj["allowed_created"])
+            if not isinstance(obj["revocation_scopes"], list):
+                raise ValueError
+            obj["revocation_scopes"] = tuple(obj["revocation_scopes"])
+            result = cls(**obj)
+            identifiers = (
+                result.step,
+                result.owner,
+                result.adapter,
+                result.lane,
+                result.target_parameter,
+                *result.allowed_created,
+            )
+            if result.version != "warden.case.execution.v1" or not all(
+                isinstance(v, str) and IDENTIFIER.fullmatch(v) for v in identifiers
+            ):
+                raise ValueError
+            if not DIGEST.fullmatch(result.adapter_source) or result.actor not in (
+                "human",
+                "agent",
+            ):
+                raise ValueError
+            if (
+                result.effect not in ("read", "change", "mint")
+                or type(result.retry_safe) is not bool
+            ):
+                raise ValueError
+            scopes = set(result.revocation_scopes)
+            if (
+                len(scopes) != len(result.revocation_scopes)
+                or not scopes <= {"parent-session", "broker-grant"}
+                or "parent-session" not in scopes
+            ):
+                raise ValueError
+            if result.effect == "mint" and "broker-grant" not in scopes:
+                raise ValueError
+            if len(result.allowed_created) > 32:
+                raise ValueError
+            if len(set(result.allowed_created)) != len(result.allowed_created):
+                raise ValueError
+            return result
+        except (ValueError, TypeError, KeyError):
+            raise Refused("invalid closed execution descriptor") from None
+
+
+@dataclass(frozen=True, slots=True)
+class OwnerResult:
+    outcome: Outcome
+    evidence: str
+    created: tuple[str, ...] = ()
+    revoked: bool = False
+    session_revocation_evidence: str | None = None
+    grant_revocation_evidence: str | None = None
+    attempt_id: str = ""
+    operation: str = ""
+
+
+@dataclass(frozen=True, slots=True)
+class Invocation:
+    step: str
+    owner: str
+    target: str
+    actor: str
+    principal: str
+    lane: str
+    pins: Pins
+    attempt_id: str = ""
+    operation: str = "admission"
+    tenant: str = ""
+    realm: str = ""
+
+
+INTENT_SCHEMA = "warden.case.original-intent.v1"
+
+
+@dataclass(frozen=True, slots=True)
+class OriginalIntent:
+    """Durable record of the original mutating dispatch, written before dispatch.
+
+    Binds the original Invocation (attempt, step, owner, target, actor, principal,
+    lane), all pins and the admitted adapter source. Current admit leaves tenant
+    and realm empty; their reserved fields are not admitted provenance. This is
+    local dispatch correspondence, not owner proof of creation. Owners still
+    authenticate original created-only provenance independently.
+    """
+
+    binding: str
+    invocation: Invocation
+    source: str
+
+    def validate(self) -> None:
+        """Fixed bounded metadata only; tenant/realm are not authority claims.
+
+        Current admit leaves tenant/realm empty. Nonempty future coordinates need
+        separate owner provenance; serializability alone must never supply it.
+        """
+        if (
+            type(self.invocation) is not Invocation
+            or type(self.invocation.pins) is not Pins
+        ):
+            raise Refused("exact original invocation required")
+        i = self.invocation
+        fields = (i.step, i.owner, i.target, i.principal, i.lane, i.attempt_id)
+        if (
+            not all(
+                type(value) is str and IDENTIFIER.fullmatch(value) for value in fields
+            )
+            or type(i.actor) is not str
+            or i.actor not in ("human", "agent")
+            or type(i.operation) is not str
+            or i.operation not in ("run", "rollback")
+            or not all(
+                type(value) is str and (not value or IDENTIFIER.fullmatch(value))
+                for value in (i.tenant, i.realm)
+            )
+            or type(self.source) is not str
+            or not DIGEST.fullmatch(self.source)
+            or type(self.binding) is not str
+            or self.binding != f"{i.step}:{i.target}"
+        ):
+            raise Refused("invalid original intent metadata")
+        if set(Invocation.__dataclass_fields__) != {
+            "step",
+            "owner",
+            "target",
+            "actor",
+            "principal",
+            "lane",
+            "pins",
+            "attempt_id",
+            "operation",
+            "tenant",
+            "realm",
+        }:
+            raise Refused("original invocation field contract changed")
+        if not all(
+            type(v) is str and DIGEST.fullmatch(v)
+            for v in (
+                i.pins.case,
+                i.pins.case_type,
+                i.pins.adapter,
+                i.pins.catalog,
+                i.pins.acceptance,
+                i.pins.run_sheet,
+            )
+        ):
+            raise Refused("invalid original intent pins")
+
+    def payload(self) -> str:
+        self.validate()
+        return json.dumps(
+            {"schema": INTENT_SCHEMA, "binding": self.binding, "source": self.source}
+            | asdict(self.invocation),
+            separators=(",", ":"),
+            sort_keys=True,
+        )
+
+    @classmethod
+    def decode(cls, raw: str) -> OriginalIntent:
+        def unique(pairs):
+            result = {}
+            for key, value in pairs:
+                if key in result:
+                    raise Refused("duplicate original intent field")
+                result[key] = value
+            return result
+
+        try:
+            if type(raw) is not str or len(raw.encode()) > MAX_SOURCE_BYTES:
+                raise Refused("original intent input exceeds bound")
+            obj = json.loads(raw, object_pairs_hook=unique)
+            fields = {
+                "step",
+                "owner",
+                "target",
+                "actor",
+                "principal",
+                "lane",
+                "pins",
+                "attempt_id",
+                "operation",
+                "tenant",
+                "realm",
+            }
+            if (
+                type(obj) is not dict
+                or set(obj) != fields | {"schema", "binding", "source"}
+                or obj["schema"] != INTENT_SCHEMA
+            ):
+                raise Refused("unknown original intent schema")
+            inv = {k: obj[k] for k in fields}
+            inv["pins"] = Pins(**inv["pins"])
+            result = cls(obj["binding"], Invocation(**inv), obj["source"])
+            result.validate()
+            return result
+        except (TypeError, ValueError, KeyError):
+            raise Refused("invalid original intent record") from None
+
+
+@dataclass(frozen=True, slots=True)
+class ReconcileContext:
+    """Original intent and the new reconciliation attempt, kept separate."""
+
+    original: OriginalIntent
+    attempt: Invocation
+
+
+@dataclass(frozen=True, slots=True)
+class Adapter:
+    reference: str
+    source: str
+    invoke: Callable[[Invocation], OwnerResult]
+    verify: Callable[[Invocation, OwnerResult], bool]
+    rollback: Callable[[Invocation, tuple[str, ...]], OwnerResult] | None = None
+    reconcile: Callable[[Invocation], OwnerResult] | None = None
+    reconcile_original: Callable[[ReconcileContext], OwnerResult] | None = None
+
+
+class Journal:
+    """Private SQLite journal plus process lock; transaction commits before dispatch."""
+
+    def __init__(self, directory: Path):
+        directory.mkdir(mode=0o700, parents=True, exist_ok=True)
+        if (
+            directory.is_symlink()
+            or directory.stat().st_uid != os.getuid()
+            or directory.stat().st_mode & 0o077
+        ):
+            raise Refused("journal directory is not private")
+        self.directory = directory
+        for name in ("journal.sqlite", "execution.lock"):
+            path = directory / name
+            fd = os.open(path, os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
+            try:
+                if os.fstat(fd).st_uid != os.getuid() or os.fstat(fd).st_mode & 0o077:
+                    raise Refused("journal file is not private")
+            finally:
+                os.close(fd)
+        self.db = sqlite3.connect(directory / "journal.sqlite", isolation_level=None)
+        self.db.execute("PRAGMA synchronous=FULL")
+        self.db.execute(
+            "CREATE TABLE IF NOT EXISTS receipts (seq INTEGER PRIMARY KEY, binding TEXT NOT NULL, payload TEXT NOT NULL)"
+        )
+        self.db.execute(
+            "CREATE TABLE IF NOT EXISTS intents (seq INTEGER PRIMARY KEY, attempt_id TEXT NOT NULL UNIQUE, binding TEXT NOT NULL, payload TEXT NOT NULL)"
+        )
+
+    def original_intent(
+        self, binding: str, current: Invocation, source: str
+    ) -> OriginalIntent:
+        """Latest original run intent for binding, refused unless it matches exactly.
+
+        Missing or mismatched records refuse; the step stays uncertain.
+        """
+        row = self.db.execute(
+            "SELECT attempt_id,payload FROM intents WHERE binding=? ORDER BY seq DESC LIMIT 1",
+            (binding,),
+        ).fetchone()
+        if row is None:
+            raise Refused("original intent record missing; step stays uncertain")
+        intent = OriginalIntent.decode(row[1])
+        o = intent.invocation
+        if row[0] != o.attempt_id:
+            raise Refused("original intent attempt identity differs")
+        if intent.binding != binding or o.operation != "run":
+            raise Refused("original intent binding mismatch")
+        if o.pins != current.pins:
+            raise Refused("original intent pins mismatch")
+        if intent.source != source:
+            raise Refused("original intent source mismatch")
+        for name in (
+            "step",
+            "owner",
+            "target",
+            "actor",
+            "principal",
+            "lane",
+            "tenant",
+            "realm",
+        ):
+            if getattr(o, name) != getattr(current, name):
+                raise Refused(f"original intent {name} mismatch")
+        # Match the persisted original running receipt. An orphan context or a
+        # payload from another attempt cannot become the current lookup key.
+        receipts = self.db.execute(
+            "SELECT payload FROM receipts WHERE binding=? ORDER BY seq DESC LIMIT ?",
+            (binding, MAX_HISTORY + 1),
+        ).fetchall()
+        if len(receipts) > MAX_HISTORY:
+            raise Refused("original intent receipt history exceeds bound")
+        matched = False
+        try:
+            for (raw,) in receipts:
+                if type(raw) is not str or len(raw.encode()) > MAX_SOURCE_BYTES:
+                    raise Refused("original receipt input exceeds bound")
+                payload = json.loads(raw)
+                if (
+                    payload.get("attempt_id") != o.attempt_id
+                    or payload.get("operation") != "run"
+                ):
+                    continue
+                last = payload.get("receipts", [])[-1]
+                if last.get("outcome") != "running":
+                    continue
+                if (
+                    payload.get("journal_schema") != "warden.case.step-journal.v1"
+                    or payload.get("step_id") != o.step
+                    or payload.get("owner") != o.owner
+                    or payload.get("pins") != asdict(o.pins)
+                ):
+                    raise Refused("original running receipt binding differs")
+                matched = True
+                break
+        except (TypeError, ValueError, KeyError, IndexError, AttributeError):
+            raise Refused("invalid original running receipt") from None
+        if not matched:
+            raise Refused("original running receipt missing; no backfill")
+        return intent
+
+    @contextmanager
+    def locked(self):
+        with (self.directory / "execution.lock").open("rb") as fh:
+            try:
+                fcntl.flock(fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                raise Refused("case execution already active") from None
+            try:
+                yield
+            finally:
+                fcntl.flock(fh, fcntl.LOCK_UN)
+
+    def load(self, binding: str, initial: StepState) -> StepState:
+        row = self.db.execute(
+            "SELECT payload FROM receipts WHERE binding=? ORDER BY seq DESC LIMIT 1",
+            (binding,),
+        ).fetchone()
+        if row is None:
+            return initial
+        obj = json.loads(row[0])
+        expected = {
+            "step_id",
+            "owner",
+            "pins",
+            "allowed_created",
+            "retry_safe",
+            "receipts",
+            "journal_schema",
+            "evidence_digest",
+            "session_revoked",
+            "session_revocation_digest",
+            "grant_revocation_digest",
+            "attempt_id",
+            "operation",
+        }
+        if (
+            set(obj) != expected
+            or obj["journal_schema"] != "warden.case.step-journal.v1"
+        ):
+            raise Refused("unknown journal receipt schema")
+        state = StepState(
+            obj["step_id"],
+            obj["owner"],
+            Pins(**obj["pins"]),
+            tuple(obj["allowed_created"]),
+            obj["retry_safe"],
+            tuple(
+                Receipt(r["attempt"], Outcome(r["outcome"]), tuple(r["created"]))
+                for r in obj["receipts"]
+            ),
+        )
+        if (
+            state.step_id,
+            state.owner,
+            state.pins,
+            state.allowed_created,
+            state.retry_safe,
+        ) != (
+            initial.step_id,
+            initial.owner,
+            initial.pins,
+            initial.allowed_created,
+            initial.retry_safe,
+        ):
+            raise Refused("journal pins changed")
+        return state
+
+    def save(
+        self,
+        binding: str,
+        state: StepState,
+        evidence: OwnerResult | None = None,
+        invocation: Invocation | None = None,
+        intent: OriginalIntent | None = None,
+    ):
+        if intent is not None:
+            if type(intent) is not OriginalIntent:
+                raise Refused("exact original intent required")
+            intent.validate()
+            expected = (
+                Outcome.RUNNING
+                if intent.invocation.operation == "run"
+                else Outcome.ROLLBACK_RUNNING
+            )
+            if (
+                intent.binding != binding
+                or intent.invocation != invocation
+                or intent.invocation.pins != state.pins
+                or not state.last
+                or state.last.outcome is not expected
+            ):
+                raise Refused("original intent and running receipt differ")
+        self.db.execute("BEGIN IMMEDIATE")
+        try:
+            if intent is not None:
+                self.db.execute(
+                    "INSERT INTO intents(attempt_id,binding,payload) VALUES (?,?,?)",
+                    (intent.invocation.attempt_id, binding, intent.payload()),
+                )
+            self.db.execute(
+                "INSERT INTO receipts(binding,payload) VALUES (?,?)",
+                (
+                    binding,
+                    json.dumps(
+                        asdict(state)
+                        | {
+                            "journal_schema": "warden.case.step-journal.v1",
+                            "attempt_id": invocation.attempt_id if invocation else None,
+                            "operation": invocation.operation if invocation else None,
+                            "evidence_digest": digest(evidence.evidence.encode())
+                            if evidence
+                            else None,
+                            "session_revoked": evidence.revoked if evidence else None,
+                            "session_revocation_digest": digest(
+                                evidence.session_revocation_evidence.encode()
+                            )
+                            if evidence and evidence.session_revocation_evidence
+                            else None,
+                            "grant_revocation_digest": digest(
+                                evidence.grant_revocation_evidence.encode()
+                            )
+                            if evidence and evidence.grant_revocation_evidence
+                            else None,
+                        },
+                        separators=(",", ":"),
+                    ),
+                ),
+            )
+            self.db.execute("COMMIT")
+        except BaseException:
+            self.db.execute("ROLLBACK")
+            raise
+
+
+def _catalog_lane(catalog_source: bytes, descriptor: Descriptor):
+    """KERNEL-2: the descriptor's lane must be an active, fitting catalog entry.
+
+    catalog-routing-acceptance still covers the whole catalog digest; this
+    ties the one lane the descriptor names to an entry inside that digest.
+    """
+    from .routing.catalog import CatalogError, _parse_entry
+
+    try:
+        raw = yaml.safe_load(catalog_source)
+        items = raw["entries"]
+        if not isinstance(items, list):
+            raise TypeError
+        entries = {}
+        for index, item in enumerate(items):
+            parsed = _parse_entry(item, index)
+            if parsed.id in entries:
+                raise ValueError
+            entries[parsed.id] = parsed
+    except (yaml.YAMLError, CatalogError, KeyError, TypeError, ValueError):
+        raise Refused("invalid catalog source shape") from None
+    entry = entries.get(descriptor.lane)
+    if entry is None:
+        raise Refused("descriptor lane is not in the catalog")
+    if not entry.is_active:
+        raise Refused("descriptor lane is not active in the catalog")
+    if entry.delegation is None:
+        raise Refused("descriptor lane has no catalog delegation record")
+    if not entry.is_graded:
+        raise Refused("descriptor lane carries no risk grade")
+    if descriptor.owner not in entry.owner_repo.split("/"):
+        raise Refused("descriptor owner does not fit catalog lane owner_repo")
+    if descriptor.effect in ("mint", "change") and entry.risk != "high":
+        raise Refused("catalog lane risk does not cover the descriptor effect")
+    return entry, entries
+
+
+def _attended_admission(descriptor, actor, entry, entries):
+    from .routing.models import attended_lane_issue
+
+    if (actor != "human" or "WARDEN_AGENT_ID" in os.environ
+            or "parent-session" not in descriptor.revocation_scopes):
+        raise Refused("attended step requires a human parent session")
+    issue = attended_lane_issue(entry, entries.get)
+    if issue:
+        raise Refused(issue[1])
+
+
+def _step_mode(case_type: dict, case: dict, descriptor: Descriptor) -> str:
+    """KERNEL-3: warden, attended or owner, from the type step's own text."""
+    steps = [
+        step
+        for step in case_type.get("follow_through") or []
+        if isinstance(step, dict) and step.get("id") == descriptor.step
+    ]
+    step = steps[0] if len(steps) == 1 else {}
+    executes, attended = step.get("warden_executes"), step.get("attended")
+    if (
+        type(executes) is not bool
+        or type(attended) is not bool
+        or (executes and attended)
+        or not isinstance(step.get("lane"), str)
+    ):
+        raise Refused("type step does not declare how the kernel dispatches it")
+    owner = step.get("owner")
+    if isinstance(owner, str) and re.fullmatch(r"\{[a-z_]+\}", owner):
+        owner = (case.get("parameters") or {}).get(owner[1:-1])
+    if step["lane"] != descriptor.lane or owner != descriptor.owner:
+        raise Refused("type step lane or owner disagrees with descriptor")
+    return "warden" if executes else "attended" if attended else "owner"
+
+
+class Executor:
+    """Injected fixed owner adapters and provenance verifier; none ship by default.
+
+    evidence verifier must authenticate owner custody/provenance or explicitly
+    attest attended manual evidence; a bare JSON reference is never sufficient.
+    It receives purpose, exact source digest, and named evidence reference.
+    """
+
+    def __init__(
+        self,
+        journal: Journal,
+        adapters: dict[str, Adapter],
+        evidence_verifier: Callable[[str, str, str], bool],
+        *,
+        browser_inputs: BrowserInputs | None = None,
+    ):
+        self.journal, self.adapters, self.evidence_verifier = (
+            journal,
+            dict(adapters),
+            evidence_verifier,
+        )
+        self._admitted = {}
+        self.browser_inputs = browser_inputs
+
+    def admit(
+        self,
+        case_source: bytes,
+        type_source: bytes,
+        descriptor_source: bytes,
+        catalog_source: bytes,
+        *,
+        principal: str,
+        actor: str,
+        lane: str,
+        acceptance_evidence: str,
+        materialization_evidence: str,
+        descriptor_evidence: str,
+        session_evidence: str,
+    ) -> tuple[Descriptor, Invocation, StepState]:
+        for source in (case_source, type_source, descriptor_source, catalog_source):
+            bounded_source(source)
+        descriptor = Descriptor.decode(descriptor_source)
+        try:
+            case = yaml.safe_load(case_source)["spec"]
+            case_type = yaml.safe_load(type_source)["spec"]
+            if not isinstance(case, dict) or not isinstance(case_type, dict):
+                raise ValueError
+        except (yaml.YAMLError, KeyError, TypeError, ValueError):
+            raise Refused("invalid case or type source shape") from None
+        if case.get("status") != "materialized" or not case.get("acceptance"):
+            raise Refused("case is not accepted and structurally materialized")
+        if case_type.get("status") not in ("acknowledged", "implemented"):
+            raise Refused("type is not acknowledged")
+        if case.get("type") != f"{case_type['id']}@{case_type['version']}":
+            raise Refused("case type pin mismatch")
+        if case_type.get("execution_descriptors", {}).get(descriptor.step) != digest(
+            descriptor_source
+        ):
+            raise Refused(
+                "type has no exact acknowledged machine descriptor; plan only"
+            )
+        for purpose, source, evidence in (
+            ("case-acceptance", digest(case_source), acceptance_evidence),
+            (
+                "ops-mason-materialization",
+                digest(case_source),
+                materialization_evidence,
+            ),
+            (
+                "owner-descriptor-acceptance:" + descriptor.owner,
+                digest(descriptor_source),
+                descriptor_evidence,
+            ),
+            ("type-machine-seam-acceptance", digest(type_source), descriptor_evidence),
+            ("catalog-routing-acceptance", digest(catalog_source), descriptor_evidence),
+            (
+                f"caller-session:{actor}:{principal}:{lane}",
+                digest(case_source),
+                session_evidence,
+            ),
+        ):
+            if (
+                not isinstance(evidence, str)
+                or not IDENTIFIER.fullmatch(evidence)
+                or self._verify_evidence(purpose, source, evidence) is not True
+            ):
+                raise Refused("independent owner evidence not verified")
+        if (
+            not IDENTIFIER.fullmatch(principal)
+            or actor != descriptor.actor
+            or lane != descriptor.lane
+        ):
+            raise Refused("principal actor or lane mismatch")
+        if descriptor.effect == "mint" and (
+            actor != "human" or os.getenv("WARDEN_AGENT_ID")
+        ):
+            raise Refused("agent mint is forbidden")
+        entry, entries = _catalog_lane(catalog_source, descriptor)
+        mode = _step_mode(case_type, case, descriptor)
+        if mode == "attended":
+            _attended_admission(descriptor, actor, entry, entries)
+        if mode == "owner" and (
+            entry.effective_delegation.mode != "native"
+            or entry.owner_repo != descriptor.owner
+            or entry.warden_executes
+            or descriptor.effect == "mint"
+        ):
+            raise Refused("owner step lane is not the owner's native path")
+        parameters = case.get("parameters", {})
+        declared = {
+            item["name"]: item
+            for item in case_type.get("parameters", [])
+            if isinstance(item, dict) and isinstance(item.get("name"), str)
+        }
+        if (
+            not isinstance(parameters, dict)
+            or descriptor.target_parameter not in declared
+        ):
+            raise Refused("target parameter is not declared by acknowledged type")
+        if case_type.get("id") == "oidc-browser-relying-party":
+            if type(self.browser_inputs) is not BrowserInputs:
+                raise Refused("browser metadata validator is not configured")
+            target = self.browser_inputs.target(
+                yaml.safe_load(case_source),
+                yaml.safe_load(type_source),
+                descriptor.target_parameter,
+            )
+        else:
+            for name in parameters:
+                definition = declared.get(name)
+                if (
+                    definition is None
+                    or definition.get("sensitivity") not in ("public", "operational")
+                    or definition.get("case_settable") is False
+                ):
+                    raise Refused("unknown, fixed or secret-sensitivity case parameter")
+            target = parameters.get(descriptor.target_parameter)
+        if not isinstance(target, str) or not IDENTIFIER.fullmatch(target):
+            raise Refused("target must be exact case metadata")
+        adapter = self.adapters.get(descriptor.adapter)
+        if adapter is None or (adapter.reference, adapter.source) != (
+            descriptor.adapter,
+            descriptor.adapter_source,
+        ):
+            raise Refused("unknown adapter or owner source pin")
+        sheet = json.dumps(
+            [
+                descriptor.step,
+                descriptor.owner,
+                target,
+                actor,
+                principal,
+                lane,
+                acceptance_evidence,
+                materialization_evidence,
+                descriptor_evidence,
+                session_evidence,
+            ],
+            separators=(",", ":"),
+        ).encode()
+        pins = Pins(
+            digest(case_source),
+            digest(type_source),
+            digest(descriptor_source),
+            digest(catalog_source),
+            digest(acceptance_evidence.encode()),
+            digest(sheet),
+        )
+        invocation = Invocation(
+            descriptor.step, descriptor.owner, target, actor, principal, lane, pins
+        )
+        initial = StepState(
+            descriptor.step,
+            descriptor.owner,
+            pins,
+            descriptor.allowed_created,
+            descriptor.retry_safe,
+        )
+        # Keep the mode and exact authenticated catalog bytes with this admission;
+        # dispatch must not substitute a later ambient catalog or lose its mode.
+        self._admitted[invocation] = (
+            descriptor, initial, session_evidence, mode, catalog_source
+        )
+        return descriptor, invocation, initial
+
+    def _result(
+        self, adapter: Adapter, invocation: Invocation, result: OwnerResult
+    ) -> OwnerResult:
+        if type(result) is not OwnerResult or not isinstance(result.outcome, Outcome):
+            raise Refused("unknown owner result shape")
+        if type(result.created) is not tuple or not all(
+            isinstance(v, str) and IDENTIFIER.fullmatch(v) for v in result.created
+        ):
+            raise Refused("owner created-object result invalid")
+        if not isinstance(result.evidence, str) or not IDENTIFIER.fullmatch(
+            result.evidence
+        ):
+            raise Refused("owner evidence identifier invalid")
+        if adapter.verify(invocation, result) is not True or result.revoked is not True:
+            raise Refused("owner result or session revocation unverified")
+        if (result.attempt_id, result.operation) != (
+            invocation.attempt_id,
+            invocation.operation,
+        ):
+            raise Refused("owner receipt belongs to another attempt")
+        descriptor = self._admitted[
+            replace(invocation, attempt_id="", operation="admission")
+        ][0]
+        proof_fields = {
+            "parent-session": (
+                f"session-revocation:{invocation.lane}:{invocation.operation}:{invocation.attempt_id}",
+                result.session_revocation_evidence,
+            ),
+            "broker-grant": (
+                f"grant-revocation:{invocation.lane}:{invocation.operation}:{invocation.attempt_id}",
+                result.grant_revocation_evidence,
+            ),
+        }
+        proofs = [proof_fields[scope] for scope in descriptor.revocation_scopes]
+        for purpose, evidence in proofs:
+            if (
+                not isinstance(evidence, str)
+                or not IDENTIFIER.fullmatch(evidence)
+                or self._verify_evidence(purpose, invocation.pins.case, evidence)
+                is not True
+            ):
+                raise Refused("independent grant or parent-session revocation absent")
+        return result
+
+    def _verify_evidence(self, purpose, source, evidence):
+        try:
+            with contained_output():
+                return self.evidence_verifier(purpose, source, evidence) is True
+        except Exception:
+            raise Refused("independent evidence verification failed") from None
+
+    def _admission(
+        self, descriptor: Descriptor, invocation: Invocation, initial: StepState
+    ):
+        if self._admitted.get(invocation, ())[:2] != (descriptor, initial):
+            raise Refused("execution requires verified admission on this executor")
+        adapter = self.adapters.get(descriptor.adapter)
+        if adapter is None or (adapter.reference, adapter.source) != (
+            descriptor.adapter,
+            descriptor.adapter_source,
+        ):
+            raise Refused("adapter changed after admission")
+        _, _, session, mode, catalog_source = self._admitted[invocation]
+        if (
+            self._verify_evidence(
+                f"caller-session:{invocation.actor}:{invocation.principal}:{invocation.lane}",
+                invocation.pins.case,
+                session,
+            )
+            is not True
+        ):
+            raise Refused("caller session no longer verified")
+        if descriptor.effect == "mint" and os.getenv("WARDEN_AGENT_ID"):
+            raise Refused("agent mint is forbidden")
+        if mode == "attended":
+            entry, entries = _catalog_lane(catalog_source, descriptor)
+            _attended_admission(descriptor, invocation.actor, entry, entries)
+        return adapter
+
+    def _attempt(self, invocation: Invocation, state: StepState, operation: str):
+        identity = json.dumps(
+            [asdict(invocation.pins), operation, state.last.attempt, uuid.uuid4().hex],
+            separators=(",", ":"),
+        ).encode()
+        return replace(
+            invocation,
+            attempt_id="attempt-" + hashlib.sha256(identity).hexdigest(),
+            operation=operation,
+        )
+
+    def run(
+        self,
+        descriptor: Descriptor,
+        invocation: Invocation,
+        initial: StepState,
+        *,
+        retry=False,
+    ) -> StepState:
+        adapter = self._admission(descriptor, invocation, initial)
+        with self.journal.locked():
+            binding = f"{invocation.step}:{invocation.target}"
+            state = self.journal.load(binding, initial)
+            recovered = recover(state)
+            if recovered != state:
+                self.journal.save(binding, recovered)
+                state = recovered
+            if len(state.receipts) > MAX_HISTORY - 4:
+                raise Refused("bounded journal history requires owner archival")
+            running = begin(state, invocation.pins, retry=retry)
+            dispatched = self._attempt(invocation, running, "run")
+            self.journal.save(
+                binding,
+                running,
+                invocation=dispatched,
+                intent=OriginalIntent(binding, dispatched, adapter.source),
+            )
+            evidence = None
+            try:
+                with contained_output():
+                    result = self._result(
+                        adapter, dispatched, adapter.invoke(dispatched)
+                    )
+                completed = finish(
+                    running, invocation.pins, result.outcome, created=result.created
+                )
+                evidence = result
+            except Exception:
+                completed = finish(running, invocation.pins, Outcome.UNCERTAIN)
+            self.journal.save(binding, completed, evidence, dispatched)
+            return completed
+
+    def rollback(
+        self, descriptor: Descriptor, invocation: Invocation, initial: StepState
+    ) -> StepState:
+        adapter = self._admission(descriptor, invocation, initial)
+        with self.journal.locked():
+            binding = f"{invocation.step}:{invocation.target}"
+            state = self.journal.load(binding, initial)
+            if recover(state) != state:
+                self.journal.save(binding, recover(state))
+                raise Refused("lost rollback result requires owner reconciliation")
+            if adapter.rollback is None:
+                raise Refused("owner has no reviewed undo adapter")
+            if len(state.receipts) > MAX_HISTORY - 4:
+                raise Refused("bounded journal history requires owner archival")
+            running = begin_rollback(state, invocation.pins)
+            dispatched = self._attempt(invocation, running, "rollback")
+            self.journal.save(
+                binding,
+                running,
+                invocation=dispatched,
+                intent=OriginalIntent(binding, dispatched, adapter.source),
+            )
+            evidence = None
+            try:
+                with contained_output():
+                    result = self._result(
+                        adapter,
+                        dispatched,
+                        adapter.rollback(dispatched, running.last.created),
+                    )
+                verified = result.outcome is Outcome.ROLLED_BACK and not result.created
+                evidence = result if verified else None
+            except Exception:
+                verified = False
+            completed = finish_rollback(running, invocation.pins, verified=verified)
+            self.journal.save(binding, completed, evidence, dispatched)
+            return completed
+
+    def reconcile(
+        self, descriptor: Descriptor, invocation: Invocation, initial: StepState
+    ) -> StepState:
+        """Explicit owner-native state inspection; never redispatches the mutation."""
+        adapter = self._admission(descriptor, invocation, initial)
+        if adapter.reconcile is None and adapter.reconcile_original is None:
+            raise Refused("owner reconciliation adapter absent")
+        with self.journal.locked():
+            binding = f"{invocation.step}:{invocation.target}"
+            state = recover(self.journal.load(binding, initial))
+            if not state.last or state.last.outcome not in (
+                Outcome.UNCERTAIN,
+                Outcome.FAILED_AFTER,
+            ):
+                raise Refused("no uncertain mutation to reconcile")
+            if len(state.receipts) > MAX_HISTORY - 4:
+                raise Refused("bounded journal history requires owner archival")
+            state = replace(
+                state,
+                receipts=(
+                    *state.receipts,
+                    Receipt(len(state.receipts) + 1, Outcome.UNCERTAIN),
+                ),
+            )
+            original = (
+                self.journal.original_intent(binding, invocation, adapter.source)
+                if adapter.reconcile_original is not None
+                else None
+            )
+            dispatched = self._attempt(invocation, state, "reconcile")
+            self.journal.save(binding, state, invocation=dispatched)
+            with contained_output():
+                result = self._result(
+                    adapter,
+                    dispatched,
+                    adapter.reconcile_original(ReconcileContext(original, dispatched))
+                    if original is not None
+                    else adapter.reconcile(dispatched),
+                )
+            if result.outcome not in (
+                Outcome.NO_CHANGE,
+                Outcome.SUCCESS,
+                Outcome.FAILED_BEFORE,
+            ):
+                raise Refused("owner did not reconcile target state")
+            # Validate created-object scope using the same closed result reducer.
+            finish(
+                begin(
+                    StepState(
+                        state.step_id,
+                        state.owner,
+                        state.pins,
+                        state.allowed_created,
+                        state.retry_safe,
+                    ),
+                    state.pins,
+                ),
+                state.pins,
+                result.outcome,
+                created=result.created,
+            )
+            reconciled = StepState(
+                state.step_id,
+                state.owner,
+                state.pins,
+                state.allowed_created,
+                state.retry_safe,
+                (
+                    *state.receipts,
+                    Receipt(len(state.receipts) + 1, result.outcome, result.created),
+                ),
+            )
+            self.journal.save(binding, reconciled, result, dispatched)
+            return reconciled
+
+
+class OwnerInterrupted(KeyboardInterrupt):
+    """Sanitized interruption preserves persisted running/crash recovery semantics."""
+
+    def __init__(self):
+        super().__init__("owner execution interrupted")
+
+
+class _Discard:
+    """Never retain or forward adapter output, including unbounded malicious text."""
+
+    def write(self, text):
+        return len(text)
+
+    def flush(self):
+        pass
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/workplans/WARDEN-WP-0044-security-case-follow-through.md b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/workplans/WARDEN-WP-0044-security-case-follow-through.md
new file mode 100644
index 0000000..3ad2870
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/preimages/workplans/WARDEN-WP-0044-security-case-follow-through.md
@@ -0,0 +1,394 @@
+---
+id: WARDEN-WP-0044
+type: workplan
+title: "Follow through on KnownSecurityCases along their type's route"
+domain: infotech
+repo: ops-warden
+status: active
+flavor: implementation
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-08"
+updated: "2026-10-11"
+depends_on: []
+related_repos:
+  - net-kingdom
+  - ops-mason
+  - key-cape
+  - railiance-platform
+state_hub_workstream_id: "f7e81013-6868-5d99-8528-ba75a442eca9"
+---
+
+# WARDEN-WP-0044 — Follow through on KnownSecurityCases along their type's route
+
+## Why
+
+NetKingdom is introducing SecurityCaseTypes (net-kingdom `NK-WP-0048`, canon
+`security-case-types_v0.1`, proposed). Once a case of an implemented type is
+accepted and ops-mason has materialized its structure (`MASON-WP-0010`),
+ops-warden carries out the remaining steps. These are the owners' declared entry
+points, run on the authentication path the type defines, followed by the type's
+verification.
+
+Today ops-warden routes needs and, for `exec_capable` lanes, proxies fetches as
+the caller. It does not yet know about cases, and each new integration ends with
+a founder running a hand-written script (for example the proposed KEY-WP-0038-T02
+rollout). This plan gives ops-warden the follow-through role, without widening
+what it may do: each step still runs under its owner's entry point and the
+caller's identity.
+
+## Tasks
+
+```task
+id: WARDEN-WP-0044-T01
+status: done
+depends_on: [NK-WP-0048-T03]
+priority: high
+state_hub_task_id: "ef0920fc-418e-52cb-acff-9a5c0c728bf5"
+```
+
+### T01 — Define the type's follow-through section
+
+Propose the `follow_through` part of the SecurityCaseType schema together with
+net-kingdom. For each step it names the owner entry point, `warden_executes`,
+the auth method and lane, whether an attended human login is unavoidable (with
+the type's justification), and the verification command. Write it for the first
+type, `oidc-browser-relying-party`, covering key-cape client registration,
+custody minting and LLDAP group membership.
+
+2026-10-08: NK-WP-0048-T03/T04 landed with a drafted section. Review is in
+`history/2026-10-08-oidc-rp-follow-through-review.md`. It requires three
+changes before T02: a per-step `lane`, a narrow `warden_executes`, and
+`value_handling`. It also lists four refinements. This task is done when
+net-kingdom acknowledges the review (NK-WP-0048-T05).
+
+2026-10-09: R4 was withdrawn in favour of ops-mason's per-case
+`{consuming_service}-keycape-client`, with the entry body templated in the type
+(R4′, see the addendum in the review).
+
+2026-10-09: the revised 1.0 type and canon now carry R1–R3, R4′, R5–R7.
+`warden case check-type <type.yaml>` (`src/warden/case_type.py`, tests in
+`tests/test_case_type.py`) checks a type's follow-through mechanically: the
+live type is schema-conformant, with one attended session
+(`key-cape-oidc-login`). It is not yet plannable, because two lanes are not
+in the catalog: `identity-provisioner-groups` (net-kingdom) and
+`keycape-client-secret-generate` (railiance-platform). These gate T02, not
+T01. T01 still closes on net-kingdom's acknowledgement (NK-WP-0048-T05).
+
+2026-10-09: ops-warden cannot add `identity-provisioner-groups` as the type
+declares it. The provisioner accepts only user-engine's runtime token and
+admits only user-engine pods, so no caller-identity path exists. R8 (review
+addendum) asks net-kingdom either to move `ensure-groups` into the existing
+attended session (recommended) or to give the provisioner an operator
+credential. `keycape-client-secret-generate` needs a generate-in-custody entry
+point from railiance-platform, and the broker does not have one yet. Both were
+sent to their owners.
+
+2026-10-09: done. net-kingdom took R8 option 1, so `ensure-groups` runs attended
+in the `register-client` session and `identity-provisioner-groups` is dropped
+(net-kingdom `0e86f95`). The founder acknowledged the type with memo r4 (hub
+decision `e418263e`, NK-WP-0048-T05 done).
+
+```task
+id: WARDEN-WP-0044-T02
+status: done
+depends_on: [WARDEN-WP-0044-T01]
+priority: high
+state_hub_task_id: "5f68c991-f490-58f8-a121-92f74073d272"
+```
+
+### T02 — Plan a case run
+
+`warden case plan <case.yaml>` checks that the case is accepted and materialized,
+resolves each step to its catalog entry and entry point, and prints the run:
+which steps warden executes, which run as the attended caller, what the
+verification is. No secret values; no execution.
+
+Tests: refuse an unaccepted or unmaterialized case; refuse a step whose catalog
+entry is missing or not reviewed; show attended steps explicitly.
+
+2026-10-09: done. `warden case plan <case.yaml> [--type] [--json]`
+(`src/warden/case_plan.py`, 14 tests in `tests/test_case_plan.py`). It refuses:
+- a case that is not `materialized`, or has no acceptance record
+- a type that is mismatched or not acknowledged
+- any `case check-type` finding, including a missing or unreviewed lane
+- undeclared, type-fixed or secret-sensitivity parameters
+- a placeholder the case does not set, or an unsupported `when`
+
+It fills type defaults (`issuer`), evaluates `<param> == <value>` conditions,
+renders owner, entry point, auth and ready_check, groups attended steps per
+lane, and lists the applicable verification.
+
+The live Forgejo case is correctly refused: it is `accepted`, not
+materialized. A materialized copy, with a stand-in lane for
+`keycape-client-secret-generate`, renders six steps: two attended steps plus
+`register-client` in one `key-cape-oidc-login` session, one warden step
+(`mint-secret`), and two owner steps. Seven checks follow.
+
+Observation for net-kingdom (not blocking): `bind-env` runs before
+`register-client`, in type order. Its entry carries a literal
+`KEYCAPE_<CLIENT_ID>_CLIENT_SECRET`, which is not a `{param}` placeholder, so it
+reaches the plan unrendered.
+
+2026-10-09 follow-up:
+- **Format specs.** `_render` supports net-kingdom's `{param:env}` spec (upper
+  case, `-` as `_`, the same as `keycape-client.py env_name`) and refuses any
+  other spec or `!conversion`.
+- **Case reference.** The plan prints `case-ref: <case_id>@sha256:<hex>` over the
+  case file's exact bytes. This is the reference proposed to railiance-platform
+  for `credential.py generate --case-ref` (RPF-WP-0054-T01); the broker
+  re-derives it from the file.
+- 18 tests now.
+
+```task
+id: WARDEN-WP-0044-T03
+status: progress
+depends_on: [WARDEN-WP-0044-T02, MASON-WP-0010-T03]
+blocking_reason: "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run."
+priority: high
+state_hub_task_id: "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
+```
+
+### T03 — Run and verify a case
+
+`warden case run <case.yaml>` executes the plan. Owner entry points run through
+the existing proxy as the caller; steps that need an attended login use the
+existing contained login envelope (silent command, session revoked afterwards),
+grouped into as few attended sessions as possible. Then it runs the type's
+verification and writes a receipt without values. `warden case rollback`
+reverses exactly this case's steps.
+
+Acceptance: the Forgejo reference case (NK-WP-0048-T06) reaches `live` through
+this path, with no case-specific script.
+
+2026-10-17: original-intent lookup/context interface for NK-WP-0048-T15, source
+and synthetic tests only. `src/warden/case_run.py`: `Executor.run` writes an
+`OriginalIntent` (schema `warden.case.original-intent.v1`: the dispatched run
+Invocation — attempt, step, owner, target, actor, principal, lane, all six pins,
+tenant, realm — plus admitted adapter source) in the same SQLite transaction as
+the pre-dispatch journal row. `Journal.original_intent(binding, current, source)`
+returns it after restart and refuses on a missing record or any
+pins/source/step/owner/target/actor/principal/lane/tenant/realm mismatch, before any
+journal write, so the step stays uncertain. An adapter's
+`reconcile_original(ReconcileContext(original, attempt))` receives the original
+intent separately from the new reconcile attempt. This is Warden's record of what
+it dispatched, not owner created-only provenance. Current Executor.admit leaves
+tenant/realm empty; the reserved coordinates establish no admitted provenance.
+Owner descriptors/adapters, contained session integration, Forgejo
+materialization and the native run remain open.
+
+2026-10-17 source consistency follow-through: retained the additive intents table
+and reconcile_original callback and fixed four reproduced local defects: original
+actor mismatch, payload/SQL attempt-ID mismatch, orphan intent without its
+matching original running receipt, and arbitrary nonmetadata values accepted by
+the original-intent serializer. Exact bounded field validation, duplicate-free
+bounded decode and save-time intent/invocation/running-state equality now preserve
+the original receipt linkage before owner lookup. No new context store, native
+verifier, trust root, adapter activation or authority migration was introduced.
+
+The actual canonical focused kernel and new consistency suite passes 54 checks;
+owner-installed Ruff check/format passes. The existing generated-data/synthetic
+owner fixture and a distinct interpreter prove source correspondence/refusal,
+not independent native custody or creation. Earlier comparison probes and failed
+preparation are retained. Current caller and fresh session/grant revocation checks
+remain required; original owner payload/revocation, exact native readback and
+created-only provenance still need independent authenticated owner admission.
+No JSON/SQL context, unknown tenant/realm, changed run-sheet or legacy missing
+intent supplies recovery, replay or undo authority. T03 remains progress and all
+native acceptance gates/statuses/dependencies/UUIDs remain unchanged. Evidence:
+Custodian original-context-compare-r2 and original-context-owner-followthrough-r3
+under docs/changes/netkingdom-target-2026-10-17/; publication/projection is separate.
+
+Agreed with railiance-platform (RPF-WP-0054-T01, 2026-10-09):
+- `mint-secret` runs `credential.py generate --grant keycape/client-secret-generate
+  --client-id <id> --case-ref <case-ref> --case-file <case.yaml>` as the caller's
+  child process. The broker re-derives the case-ref and checks status and
+  client_id.
+- warden refuses that step when `WARDEN_AGENT_ID` is set.
+
+2026-10-10: railiance-platform implemented the command (RPF-WP-0054-T03). It is
+catalogued as draft `keycape-client-secret-generate`, with `exec_owner`
+railiance-platform and `exec_capable: false`. `warden case check-type` now
+reports the lane as LANE-UNREVIEWED rather than LANE-MISSING. Before it can be
+activated:
+- the founder binds the issuer policy to the operator OIDC role
+- key-cape confirms the secret format
+- the RPF-WP-0054-T05 probe passes
+
+2026-10-10 (later):
+- **Broker lane.** The issuer role is bound (CCR-2026-0043) and the T05 probe
+  passed (railiance-platform `21b8af3`). Only key-cape's format confirmation is
+  left. The playbook now includes the issuer-role login, a 15m token with
+  unlimited uses that `warden case run` must group with the attended session.
+- **Env spec.** net-kingdom adopted `{client_id:env}` as a 1.0 patch
+  (`9a9b8e3`). The plan renders `KEYCAPE_FORGEJO_CLIENT_SECRET`.
+- **Forgejo case.** Rendered and built by ops-mason. It is not yet
+  `materialized`: MASON-WP-0010-T03 waits on the railiance-platform CCRs and
+  their founder apply.
+
+2026-10-10: `keycape-client-secret-generate` activated on railiance-platform's
+go-ahead (message 20973a9c) after key-cape confirmed the format (4e0213b3).
+`warden case check-type` on the live type now reports `plannable=True`. The
+only thing T03 still waits on is the Forgejo case reaching `materialized`
+(MASON-WP-0010-T03).
+
+2026-10-10: net-kingdom moved the type to 1.1 (`e2174ce`) and re-pinned the
+Forgejo case. 1.1 adds the verification `consumer-enforces-groups` and requires
+the hand-over to enforce `access_groups`. `check-type` on 1.1 reports
+`plannable=True`, and a materialized copy renders six steps and the new check.
+The case-ref digest covers the whole case file, including `status`, so it
+changes when the case becomes `materialized`. `warden case run` therefore takes
+it from the file at run time, and the broker re-derives it from the same file.
+
+```task
+id: WARDEN-WP-0044-T04
+status: wait
+depends_on: [WARDEN-WP-0044-T03]
+blocking_reason: "Catalog integration follows a proven run."
+priority: medium
+state_hub_task_id: "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e"
+```
+
+### T04 — Catalog entries from types
+
+Let a type contribute reviewed catalog entries once, so that every case of that
+type routes without a new catalog edit. Cases add parameter values, not routes.
+`warden route find` should be able to answer "which SecurityCaseType covers this
+need?" before anyone builds by hand.
+
+
+2026-10-10 consolidation source prototype (not an accepted owner adapter API):
+`src/warden/case_receipt_state.py` provides a pure immutable receipt reducer,
+with exact case/type/adapter/catalog/acceptance/run-sheet pins, running intent
+before dispatch, uncertain recovery after a lost result, no success replay,
+explicit retry-safe failed-before-change retry and created-only reverse undo.
+It executes nothing and accepts no command output. The caller must durably
+persist running before any future side effect; storage/authenticated owner
+receipts/live adapters are not implemented. Focused offline tests cover changed
+pins, lost receipts, retry/refusal, uncertain rollback and shared-object
+preservation. Source proposal: `docs/security-case-execution-proposal.md`.
+
+T03 remains open: typed owner execution/receipt contracts require review, the
+Forgejo structural materialization needs owner receipts, and CLI dispatch,
+contained sessions, native verification and provenance remain unimplemented.
+There is a circularity to resolve with net-kingdom/ops-mason: materialization
+cannot require mint-secret if mint-secret is itself a follow-through step whose
+planning requires materialized. No case status is changed by this prototype.
+
+
+2026-10-11: the exact execution-design memo version1 has confirmed native human
+acceptance (approval e46b149b-ec3c-4b3b-98a7-dcb4934448ca). The approved proposal
+bytes remain unchanged. `src/warden/case_run.py` now implements a closed v1 local
+execution seam, independent admission/evidence callbacks, private transactional
+SQLite receipt storage, process locking, running-before-dispatch, crash recovery
+to uncertainty, explicit safe retry, separately required broker-grant and parent-session revocation
+proofs, native owner reconciliation and created-only
+reverse rollback. Thirty-seven kernel tests and fourteen reducer tests pass;
+ruff checks pass. See `docs/security-case-execution-kernel-v1.md` for exact scope
+and receipt provenance. No installed native adapter or live CLI execution is
+claimed. Current prose types stay plan-only; acknowledged descriptor/type machine
+seams and authenticated owner/caller receipts are still required. T03 progresses
+for implementation but cannot finish before ordered native Forgejo acceptance.
+
+2026-10-16 source preparation (isolated checkout; no native acceptance):
+T03's browser parameter mismatch now has a producer-validator-backed projection
+in `case_inputs.py`, explicitly configured on the real Executor. Exact 1.1/1.2
+parameter definitions and all four reviewed producer modules are pinned; full case
+validation admits reviewed security-sensitive metadata while unknown/fixed/secret
+inputs and type/producer drift refuse. Only the reviewed descriptor target
+reaches the owner callback; no parameter journal payload is added. Actual
+Executor/producer tests cover positive versions and refusal/containment paths.
+Acknowledged machine descriptors, authenticated owner evidence, real Forgejo
+materialization and contained native sessions remain mandatory and unimplemented;
+T03 stays progress, T04 stays wait. No type or case status changed.
+
+2026-10-16 producer source refresh: independently reviewed NetKingdom
+`015694ee414c802dc2ef1fa0120dfed610086e69` optional descriptor-map repair.
+Only the validator/evidence source pins change; exact parameter and transitive
+source identity remain enforced. Actual canonical producer, Executor and reducer
+suite passes 87 checks, including 14 new malformed-map integration cases; all
+four missing/changed modules still refuse. Review:
+`docs/reviews/2026-10-16-browser-producer-pin-refresh.md`. No adapter attestation,
+native acceptance, credential use or privileged dispatch. T03 remains progress.
+
+
+## T03 source correction and safe-test follow-through — 2026-10-17
+
+The reviewed KERNEL-2/3 source now authenticates and parses the actual catalog
+snapshot, checks lane owner/risk/delegation, and resolves each type step's Warden,
+attended or owner dispatch mode. Four proposed attended-change lanes remain
+DRAFT; no lane is promoted and PARAMETER_PINS still contains only 1.1/1.2.
+
+Independent review KR1-F1/F2 found cached attended run/rollback/reconcile could
+lose the human/runtime boundary, and actual admission lacked the planner's
+establishing-login checks. The exact successor retains the mode and authenticated
+catalog bytes and repeats caller/session, agent marker and attended-lane checks
+before any journal write or callback on all three operations. Planner and executor
+share active/reviewed login/session-lane validation. Two unresolved Apps session
+lanes correctly remain refused. Integration tests now explicitly disclose all
+fixture authority substitutions; they establish no owner or native authority.
+
+The new 19-test regression matrix reproduces 13 failures on its predecessor and
+passes on the candidate. A fresh independent reviewer adds changed-authority and
+catalog-snapshot probes: 90 focused checks and six guarded integration checks
+pass; the combined predecessor comparison has 22 expected failures. Author's
+isolated full suite passes 765 with four integration-marked tests deselected.
+Evidence: Custodian warden-1.3-kernel-fixes-r1 and warden-1.3-kernel-review-r2
+under docs/changes/netkingdom-target-2026-10-17. Original unsuccessful review,
+invalid setup attempts and unknown ambient-lookup outcome are retained.
+
+A separate reviewed test-only fix stubs ambient OpenBao identity in access CLI
+unit tests and adds a synthetic sentinel regression which fails before any
+subprocess can launch on the predecessor; 26 access/helper checks pass. The real
+production helper is unchanged. The first old review's unisolated launches may
+have invoked ambient `bao token lookup`; remote reach/success remain unknown,
+with no secret displayed. This patch does not erase that adverse outcome.
+
+Explicit remaining safe-test work is retained in this live T03 scope, owned by
+ops-warden: replace or wrap the ordinary unit-test entry path with allowlisted
+environment/empty synthetic HOME and guarded subprocess/network execution,
+including nested validator children. Completion requires representative access
+and case tests to refuse token-file/environment and live provider access under
+synthetic negative controls while permitted local fixtures remain usable. Until
+then use the preserved isolated review runner, not the ambient `make test` path.
+No credential lookup, live investigation or rotation is authorized by this note.
+T03 remains progress; contained sessions, authenticated owner provenance,
+materialization, exact type acknowledgment/pin and first native case remain open.
+
+
+2026-10-17 safe unit-runner source candidate: `make test` now selects an existing
+interpreter and `scripts/run_unit_tests.py`, which constructs the environment and
+empty temporary HOME before pytest collection, denies unexpected process/socket
+use and ambient file opens, and guards the pinned BrowserInputs child too.
+Closed fixture exceptions cover the synthetic desk endpoint, metadata checkers,
+exact-byte contract doubles and fixed transport prints; they confer no provider
+authority. Explicit public declaration fixtures replace ambient HOME source
+lookups. See `docs/development/safe-unit-tests.md` and Custodian packet
+`docs/changes/netkingdom-target-2026-10-17/warden-safe-unit-runner-r1`.
+Synthetic token, ambient-path, forged-provider and nested-child regressions are
+retained alongside the initial failed isolation runs and corrected results. This
+is a source candidate for the existing safe-test handoff, not an OS sandbox or
+native case acceptance. T03 remains progress; contained sessions, authenticated
+owner provenance, materialization, exact type acknowledgment/pin and first native
+case remain open. No credential lookup, live investigation or rotation occurred.
+
+Candidate validation: ordinary `make test` under synthetic ambient token/HOME
+controls passes 783 tests with four integration-marked tests deselected. Affected
+focused checks pass 117 tests; new runner code/regressions pass Ruff. Retained
+initial failures exposed fixture dependencies and were corrected, not suppressed.
+
+
+2026-10-17 root follow-through: the original safe-runner source candidate was
+independently rejected for O_TRUNC open-write misclassification and unchecked
+public fixture projection hashes. Both counterexamples are retained. The minimal
+correction treats truncating/appending opens as writes and adds the closed
+projection-byte provenance regression. Root inspected the two exact corrections
+and ran ordinary make test on stable corrected source with only synthetic parent
+HOME/token/Python/pytest sentinels: 785 passed, four deselected. No real credential
+or native provider action occurred. Initial author failures and rejected review
+are preserved in the Custodian warden-safe-unit-runner-r1 and
+warden-safe-unit-runner-review-r1 packets, with root disposition/full result in
+warden-safe-unit-integration-r1. This completes the known trusted-unit-entry
+accident-prevention follow-through; direct pytest bypass, native/non-open/preopened
+file-descriptor limits remain explicit. No OS sandbox, isolated agent assignment,
+production grant or native T03 acceptance follows. T03 stays progress.
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/source-manifest.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/source-manifest.json
new file mode 100644
index 0000000..b262e08
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/ops-warden-source/source-manifest.json
@@ -0,0 +1,37 @@
+{
+  "owner": "ops-warden",
+  "base_revision": "git:b593c879831378db7dc62adfabdfedf2d44ddd38",
+  "files": [
+    {
+      "path": "docs/security-case-execution-kernel-v1.md",
+      "before_sha256": "sha256:e5570f542ec3ef4e6c11332cfe48fea16bf90cde5b9a5d926f5a068b7cafdbc7",
+      "sha256": "sha256:4055f8cee7688dd45a2026c6e1927d178bc38f4a7dbcf9736ef8fc3fcd9d8e4a"
+    },
+    {
+      "path": "src/warden/case_run.py",
+      "before_sha256": "sha256:1bc73e30ac718fd75bbaff2a739495fc051aeaec73802ac71f0583cb2d53ab0a",
+      "sha256": "sha256:6bc06faf727db42810e4db2ab228cf60f52ede1e48d2b65d03d0a67492bd3c97"
+    },
+    {
+      "path": "tests/test_case_current_session_reference.py",
+      "before_sha256": null,
+      "sha256": "sha256:7013ad1b30a0648cb83a78102def02340c6af3ebc284877335b71b080fced720"
+    },
+    {
+      "path": "workplans/WARDEN-WP-0044-security-case-follow-through.md",
+      "before_sha256": "sha256:44f88a5a84894d951add888206fe823d3d13019aca39a572ad8dfa15d510e05d",
+      "sha256": "sha256:f67f434a05df28c936e6e35dbe1a0623f6915e4bc8df2f0263d1c030aaad8714"
+    }
+  ],
+  "archive_sha256": "sha256:d46db68b77df8b150a8a2ccfd7903c4f3175b2c1204f7f3b879c6ad7d1e870ac",
+  "patch_sha256": "sha256:9c1c46a29969686320f2ac2326f016ae7b3686e3d2f60e8c598c0ba6f53333bb",
+  "replay": {
+    "fuzz": 0,
+    "all_postimages_exact": true,
+    "all_unrelated_archive_files_unchanged": true,
+    "stdout": "patching file docs/security-case-execution-kernel-v1.md\npatching file src/warden/case_run.py\npatching file tests/test_case_current_session_reference.py\npatching file workplans/WARDEN-WP-0044-security-case-follow-through.md\n",
+    "stderr": ""
+  },
+  "independent_owner_assent": false,
+  "native_admission": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/owner-boundary-result.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/owner-boundary-result.json
new file mode 100644
index 0000000..99e296f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/owner-boundary-result.json
@@ -0,0 +1,248 @@
+{
+  "admission_and_target": "synthetic source fixture only",
+  "consumer_processes": 4,
+  "credentials": "synthetic and retained only inside fixture tmpfs",
+  "go_consumer_results": [
+    {
+      "expected_current": true,
+      "label": "go-current-initial",
+      "matched": true
+    },
+    {
+      "expected_current": false,
+      "label": "go-revoked-initial",
+      "matched": true
+    },
+    {
+      "expected_current": true,
+      "label": "go-current-inverse",
+      "matched": true
+    },
+    {
+      "expected_current": false,
+      "label": "go-revoked-inverse",
+      "matched": true
+    }
+  ],
+  "issuer": "actual KeyCape token/status handlers over fixture HTTPS",
+  "native_acceptance": false,
+  "owner_kernel": "actual Warden Executor/Journal",
+  "owner_processes": 2,
+  "owner_results": [
+    {
+      "caller_status_and_cleanup": "actual producer CLI/HTTPS issuer",
+      "case_catalog_owner_acceptance_and_target": "synthetic fixture only",
+      "checks": [
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "current_expected_identity",
+          "passed": true
+        },
+        {
+          "check": "current_exact_token",
+          "passed": true
+        },
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "current_expected_identity",
+          "passed": true
+        },
+        {
+          "check": "current_exact_token",
+          "passed": true
+        },
+        {
+          "check": "original_token_facts_stable",
+          "passed": true
+        },
+        {
+          "check": "exact_fixture_before",
+          "passed": true
+        },
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "negative_exact_client_and_token",
+          "passed": true
+        },
+        {
+          "check": "prior_positive_ownership_required",
+          "passed": true
+        },
+        {
+          "check": "actual_parent_cleanup",
+          "passed": true
+        },
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "negative_exact_client_and_token",
+          "passed": true
+        },
+        {
+          "check": "prior_positive_ownership_required",
+          "passed": true
+        },
+        {
+          "check": "actual_guarded_run",
+          "passed": true
+        },
+        {
+          "check": "failed_client_removes_observation",
+          "passed": true
+        },
+        {
+          "check": "revoked_parent_no_journal_or_callback",
+          "passed": true
+        }
+      ],
+      "native_acceptance": false,
+      "original_journal_pins": {
+        "acceptance": "sha256:3e5028cf109dc045bc677e34aa63c6e809f0ce98a7c53888d78a5c7bdb865a73",
+        "adapter": "sha256:b2e135f3d9ca89b46d2461aa5fb6ba15656d3b4e59585c977fbbf9e7ac9ff147",
+        "case": "sha256:94fab029a0d7a9a03ba4214dd57de40f0af76fd536d260715b1d68351b067840",
+        "case_type": "sha256:604a4c0654697986475c42e1983974a3083f4ef2c952e5ed000da818668cfdaa",
+        "catalog": "sha256:51548ce82c5f4160d8053eee2db9e7df348160457e60710dfa9065de2faf36b5",
+        "run_sheet": "sha256:3a045bac0ab9cfdeb3c46b276f75ec8f0098c5ea2349385c840b920d34eed8ea"
+      },
+      "phase": "run",
+      "source_kernel": "actual Warden Executor/Journal"
+    },
+    {
+      "caller_status_and_cleanup": "actual producer CLI/HTTPS issuer",
+      "case_catalog_owner_acceptance_and_target": "synthetic fixture only",
+      "checks": [
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "current_expected_identity",
+          "passed": true
+        },
+        {
+          "check": "current_exact_token",
+          "passed": true
+        },
+        {
+          "check": "inverse_is_distinct_grant",
+          "passed": true
+        },
+        {
+          "check": "fresh_process_original_pins_preserved",
+          "passed": true
+        },
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "current_expected_identity",
+          "passed": true
+        },
+        {
+          "check": "current_exact_token",
+          "passed": true
+        },
+        {
+          "check": "original_token_facts_stable",
+          "passed": true
+        },
+        {
+          "check": "inverse_is_distinct_grant",
+          "passed": true
+        },
+        {
+          "check": "readmission_no_business_replay",
+          "passed": true
+        },
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "current_expected_identity",
+          "passed": true
+        },
+        {
+          "check": "current_exact_token",
+          "passed": true
+        },
+        {
+          "check": "original_token_facts_stable",
+          "passed": true
+        },
+        {
+          "check": "inverse_is_distinct_grant",
+          "passed": true
+        },
+        {
+          "check": "exact_fixture_before",
+          "passed": true
+        },
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "negative_exact_client_and_token",
+          "passed": true
+        },
+        {
+          "check": "prior_positive_ownership_required",
+          "passed": true
+        },
+        {
+          "check": "actual_parent_cleanup",
+          "passed": true
+        },
+        {
+          "check": "observation_private",
+          "passed": true
+        },
+        {
+          "check": "negative_exact_client_and_token",
+          "passed": true
+        },
+        {
+          "check": "prior_positive_ownership_required",
+          "passed": true
+        },
+        {
+          "check": "actual_guarded_inverse",
+          "passed": true
+        },
+        {
+          "check": "exact_fixture_restore",
+          "passed": true
+        },
+        {
+          "check": "exact_callback_denominator",
+          "passed": true
+        }
+      ],
+      "native_acceptance": false,
+      "original_journal_pins": {
+        "acceptance": "sha256:3e5028cf109dc045bc677e34aa63c6e809f0ce98a7c53888d78a5c7bdb865a73",
+        "adapter": "sha256:b2e135f3d9ca89b46d2461aa5fb6ba15656d3b4e59585c977fbbf9e7ac9ff147",
+        "case": "sha256:94fab029a0d7a9a03ba4214dd57de40f0af76fd536d260715b1d68351b067840",
+        "case_type": "sha256:604a4c0654697986475c42e1983974a3083f4ef2c952e5ed000da818668cfdaa",
+        "catalog": "sha256:51548ce82c5f4160d8053eee2db9e7df348160457e60710dfa9065de2faf36b5",
+        "run_sheet": "sha256:3a045bac0ab9cfdeb3c46b276f75ec8f0098c5ea2349385c840b920d34eed8ea"
+      },
+      "phase": "inverse",
+      "source_kernel": "actual Warden Executor/Journal"
+    }
+  ],
+  "status": "passed"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/owner-publication-summary.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/owner-publication-summary.json
new file mode 100644
index 0000000..1c33493
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/owner-publication-summary.json
@@ -0,0 +1,60 @@
+{
+  "key-cape": {
+    "commit": "git:08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+    "source_paths_exact": 19,
+    "primary_projection_exact": true,
+    "remote_main_exact": true,
+    "tasks": [
+      {
+        "record_id": "KEY-WP-0042-T01",
+        "uuid": "d8af8e77-f6e5-5d0d-8b44-794af3dee5cf",
+        "status": "progress"
+      },
+      {
+        "record_id": "KEY-WP-0042-T02",
+        "uuid": "2cade51f-d25a-5719-96b4-b57d50c1b97d",
+        "status": "done"
+      },
+      {
+        "record_id": "KEY-WP-0042-T03",
+        "uuid": "a5539bb0-2501-5774-a7d8-acddfb0938ab",
+        "status": "todo"
+      },
+      {
+        "record_id": "KEY-WP-0042-T04",
+        "uuid": "4c71c9f7-8e14-5fec-8491-d7a7995f97e2",
+        "status": "done"
+      }
+    ],
+    "native_admission": false
+  },
+  "ops-warden": {
+    "commit": "git:08c098e64a9afd89e43f65436782ed2bb69cdfbd",
+    "source_paths_exact": 4,
+    "primary_projection_exact": true,
+    "remote_main_exact": true,
+    "tasks": [
+      {
+        "record_id": "WARDEN-WP-0044-T01",
+        "uuid": "ef0920fc-418e-52cb-acff-9a5c0c728bf5",
+        "status": "done"
+      },
+      {
+        "record_id": "WARDEN-WP-0044-T02",
+        "uuid": "5f68c991-f490-58f8-a121-92f74073d272",
+        "status": "done"
+      },
+      {
+        "record_id": "WARDEN-WP-0044-T03",
+        "uuid": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
+        "status": "progress"
+      },
+      {
+        "record_id": "WARDEN-WP-0044-T04",
+        "uuid": "4a0fa4a7-5ca9-518a-ab92-a79a5e2cf93e",
+        "status": "wait"
+      }
+    ],
+    "native_admission": false
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/publication-refusal-and-clarification.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/publication-refusal-and-clarification.json
new file mode 100644
index 0000000..11ae87f
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/publication-refusal-and-clarification.json
@@ -0,0 +1,12 @@
+{
+  "normal_publication": "blocked",
+  "flagged_path": "docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/freeze_sources.py",
+  "blocked_blob": "git:3e1a84efb23bee94fdc1620757f9b254f09730a4",
+  "cause": "untyped public owner Git revision literals in evidence helper",
+  "correction": "explicit git: revision types; remove the prefix only at the archive command boundary",
+  "original_helper_sha256": "sha256:5fcf78d7658ca76304f221eb4377d9e463311a5c666d37afe3592a61965ce7c8",
+  "published_helper_sha256": "sha256:6d6f6291016e8e756e241f716b4f5564d0528ddae769cbf7f0fc02cd2f63d893",
+  "runtime_and_test_source_changed": false,
+  "scanner_configuration_changed": false,
+  "normal_scanner_rerun_required": true
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/run_candidate.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/run_candidate.py
new file mode 100644
index 0000000..2448c85
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/run_candidate.py
@@ -0,0 +1,79 @@
+"""Run issuer source checks with no host network, HOME, or credentials."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import time
+
+HERE = Path(__file__).resolve().parent
+parser = argparse.ArgumentParser()
+parser.add_argument("mode", choices=["focused", "full", "build", "consumer-build", "integration"])
+parser.add_argument("--attempt", type=int, default=1)
+parser.add_argument("--source", type=Path, default=Path("/tmp/custodian-keycape-current-client-r1/source"))
+parser.add_argument("--cache-from", type=Path)
+args = parser.parse_args()
+source = args.source.resolve()
+assert source.is_relative_to("/tmp") and (source / "src/go.mod").is_file()
+workspace = source.parent
+(workspace / "home").mkdir(exist_ok=True)
+toolchain = Path("/home/worsch/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.7.linux-amd64")
+argv = ["bwrap", "--unshare-net", "--unshare-pid", "--die-with-parent", "--new-session"]
+for name in ["/usr", "/lib", "/lib64"]:
+    argv += ["--ro-bind", name, name]
+argv += ["--symlink", "usr/bin", "/bin", "--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp",
+         "--bind", str(workspace), "/work", "--ro-bind", "/home/worsch/go/pkg/mod", "/modules",
+         "--ro-bind", str(toolchain), "/toolchain", "--chdir", "/work/consumer" if args.mode == "consumer-build" else "/work/" + source.name + "/src", "--clearenv"]
+if args.mode == "integration":
+    argv += ["--ro-bind", str(HERE / 'current_session_owner.py'), "/fixture-owner.py",
+             "--ro-bind", "/home/worsch/ops-warden/.venv/lib/python3.12/site-packages", "/python-site"]
+if args.cache_from:
+    cache = args.cache_from.resolve()
+    assert cache.is_relative_to('/tmp') and cache.is_dir()
+    argv += ['--bind', str(cache), '/work/gocache']
+for key, value in {"PATH": "/toolchain/bin:/usr/bin:/bin", "HOME": "/work/home", "GOTOOLCHAIN": "local",
+                   "GOPROXY": "off", "GOSUMDB": "off", "GOMODCACHE": "/modules", "GOCACHE": "/work/gocache",
+                   "GOMAXPROCS": "4", "CGO_ENABLED": "1"}.items():
+    argv += ["--setenv", key, value]
+if args.mode == "integration":
+    for key,value in {'PYTHONPATH':'/work/warden-source/src:/python-site', 'PYTHONDONTWRITEBYTECODE':'1',
+                      'KEYCAPE_FIXTURE_BINARY':'/work/keycape-candidate','KEYCAPE_PUBLIC_CONSUMER':'/work/tokenstatus-consumer',
+                      'KEYCAPE_OWNER_FIXTURE':'/fixture-owner.py','KEYCAPE_OWNER_REPORT':'/work/owner-boundary-result.json'}.items():
+        argv += ['--setenv',key,value]
+    command = ['go','test','-p','4','-race','-json','-count=1','-tags','current_owner_fixture','-run','^TestOnlineActualOwnerBoundaryAcrossProcesses$','./internal/authclient']
+elif args.mode == "build":
+    command = ["go", "build", "-o", "/work/keycape-candidate", "./cmd/keycape"]
+elif args.mode == "consumer-build":
+    command = ['go','build','-o','/work/tokenstatus-consumer','.']
+else:
+    command = ["go", "test", "-p", "4", "-race", "-json", "-count=1"]
+    command += ["-run", "^TestOnline", "./internal/authclient"] if args.mode == "focused" else ["./..."]
+argv += ["--", *command]
+prefix = HERE / f"{args.mode}-attempt{args.attempt}"
+assert not prefix.with_suffix(".json").exists()
+start = time.monotonic()
+source_inventory = {str(p.relative_to(source)): "sha256:" + hashlib.sha256(p.read_bytes()).hexdigest()
+                    for p in (source / 'src').rglob('*') if p.is_file()}
+with prefix.with_suffix(".jsonl").open("xb") as output:
+    result = subprocess.run(argv, stdout=output, stderr=subprocess.STDOUT, timeout=900)
+counts = {"pass": 0, "fail": 0, "skip": 0}
+failures, skips = [], []
+for line in prefix.with_suffix(".jsonl").read_text().splitlines():
+    try:
+        event = json.loads(line)
+    except ValueError:
+        continue
+    if event.get("Test") and event.get("Action") in counts:
+        action = event["Action"]
+        counts[action] += 1
+        if action == "fail": failures.append(event["Package"] + ":" + event["Test"])
+        if action == "skip": skips.append(event["Package"] + ":" + event["Test"])
+receipt = {"returncode": result.returncode, "seconds": round(time.monotonic() - start, 2), "argv": argv,
+           "source_sha256_at_start": source_inventory,
+           "counts_including_subtests": counts, "failures": failures, "skips": skips,
+           "source": str(source), "native_acceptance": False, "credentials_accessed": False,
+           "network": "private empty namespace; fixture loopback only", "home": "new empty sandbox HOME"}
+prefix.with_suffix(".json").write_text(json.dumps(receipt, indent=2) + "\n")
+print(json.dumps({k: receipt[k] for k in ["returncode", "seconds", "counts_including_subtests", "failures", "skips"]}))
+raise SystemExit(result.returncode)
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/run_warden.py b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/run_warden.py
new file mode 100644
index 0000000..8e8b57a
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/run_warden.py
@@ -0,0 +1,30 @@
+"""Use Warden's actual ordinary unit guard with explicit public source roots."""
+from pathlib import Path
+import argparse
+import hashlib
+import json
+import subprocess
+import time
+
+HERE=Path(__file__).resolve().parent
+parser=argparse.ArgumentParser()
+parser.add_argument('--attempt',type=int,default=1)
+parser.add_argument('--focused',action='store_true')
+parser.add_argument('--canonical',action='store_true')
+args=parser.parse_args()
+root=Path('/home/worsch/ops-warden') if args.canonical else Path('/tmp/custodian-keycape-current-client-r1/warden-source')
+target='tests/test_case_current_session_reference.py -q' if args.focused else '--netkingdom-root /tmp/custodian-keycape-current-client-r1/net-kingdom-source -q'
+command=['make','test','UNIT_PYTHON=/home/worsch/ops-warden/.venv/bin/python','PHASE_MEMORY_REPO=/home/worsch/phase-memory','TEST_ARGS='+target]
+prefix=HERE/('warden-'+('canonical-' if args.canonical else '')+('focused' if args.focused else 'full')+'-attempt'+str(args.attempt))
+assert not prefix.with_suffix('.json').exists()
+inventory={str(p.relative_to(root)):'sha256:'+hashlib.sha256(p.read_bytes()).hexdigest() for p in root.rglob('*.py')}
+start=time.monotonic()
+with prefix.with_suffix('.txt').open('xb') as output:
+    result=subprocess.run(command,cwd=root,stdout=output,stderr=subprocess.STDOUT,timeout=600)
+receipt={'returncode':result.returncode,'seconds':round(time.monotonic()-start,2),'command':command,
+         'source':str(root),'source_sha256_at_start':inventory,'summary':prefix.with_suffix('.txt').read_text().splitlines()[-3:],
+         'guard':'scripts/run_unit_tests.py; empty temporary HOME, no inherited credentials, reviewed subprocess inventory; no provider I/O',
+         'production_or_native_acceptance':False}
+prefix.with_suffix('.json').write_text(json.dumps(receipt,indent=2)+'\n')
+print(json.dumps({k:receipt[k] for k in ['returncode','seconds','summary']}))
+raise SystemExit(result.returncode)
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/sdk_consumer.go b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/sdk_consumer.go
new file mode 100644
index 0000000..6a68dd6
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/sdk_consumer.go
@@ -0,0 +1,61 @@
+// A standalone source-fixture consumer of the generated public producer adapter.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"time"
+
+	"keycape/pkg/tokenstatus"
+)
+
+func run() error {
+	if len(os.Args) != 3 {
+		return fmt.Errorf("fixture arguments refused")
+	}
+	var input struct {
+		Admission tokenstatus.OnlineAdmission
+		Expected  tokenstatus.ExpectedIdentity
+		TokenFile string
+	}
+	data, err := os.ReadFile(os.Args[1])
+	if err != nil {
+		return fmt.Errorf("fixture input unavailable")
+	}
+	if json.Unmarshal(data, &input) != nil {
+		return fmt.Errorf("fixture input refused")
+	}
+	var tokens struct {
+		AccessToken string `json:"access_token"`
+	}
+	data, err = os.ReadFile(input.TokenFile)
+	if err != nil || json.Unmarshal(data, &tokens) != nil {
+		return fmt.Errorf("fixture token unavailable")
+	}
+	client, err := tokenstatus.NewOnlineClient(input.Admission)
+	if err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	current, err := client.Check(ctx, tokens.AccessToken, input.Expected)
+	if err != nil {
+		return err
+	}
+	file, err := os.OpenFile(os.Args[2], os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	if err != nil {
+		return fmt.Errorf("fixture output refused")
+	}
+	defer file.Close()
+	return json.NewEncoder(file).Encode(current)
+}
+
+func main() {
+	if run() != nil {
+		fmt.Fprintln(os.Stderr, "fixture consumer refused")
+		os.Exit(2)
+	}
+	fmt.Println("fixture consumer observed current identity")
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-decision-receipt.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-decision-receipt.json
new file mode 100644
index 0000000..9e84d35
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-decision-receipt.json
@@ -0,0 +1,18 @@
+{
+  "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+  "id": "837e88ff-a896-4b47-82af-b838fc158da0",
+  "topic_id": null,
+  "title": "Share issuer current-status code and keep original execution provenance separate from current authentication",
+  "description": "Publish one producer-owned current-token client through KeyCape CLI and a generated byte-parity-checked Go adapter. Warden fresh-session readmission retains an exact existing journal intent and original pins while independently revalidating the fresh caller before writes/callbacks. Immutable provenance never supplies current authority. Inactive status is client-scoped and needs prior independent ownership before it can support cleanup. No native issuer/profile, policy, catalog lane, credential, package or effect admission is granted.",
+  "decision_type": "made",
+  "status": "resolved",
+  "rationale": "Actual cross-owner composition exposed the original-session journal pin conflict. A shared producer implementation avoids app-local token registries and verifier forks. Source race/unit, fresh-process HTTPS integration, exact archive replay and controlled export drift checks support the bounded source result. Native operation/inverse/resource-path acceptance and independent owner review remain open.",
+  "decided_by": "codex (authorized source implementation only)",
+  "decided_at": "2026-10-18T09:39:19.723007Z",
+  "deadline": null,
+  "escalation_note": null,
+  "superseded_by": null,
+  "created_at": "2026-10-18T09:39:20.471847Z",
+  "updated_at": "2026-10-18T09:39:20.471847Z",
+  "workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-decision-request.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-decision-request.json
new file mode 100644
index 0000000..6435b6c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-decision-request.json
@@ -0,0 +1,11 @@
+{
+  "id": "837e88ff-a896-4b47-82af-b838fc158da0",
+  "workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
+  "title": "Share issuer current-status code and keep original execution provenance separate from current authentication",
+  "description": "Publish one producer-owned current-token client through KeyCape CLI and a generated byte-parity-checked Go adapter. Warden fresh-session readmission retains an exact existing journal intent and original pins while independently revalidating the fresh caller before writes/callbacks. Immutable provenance never supplies current authority. Inactive status is client-scoped and needs prior independent ownership before it can support cleanup. No native issuer/profile, policy, catalog lane, credential, package or effect admission is granted.",
+  "decision_type": "made",
+  "status": "resolved",
+  "rationale": "Actual cross-owner composition exposed the original-session journal pin conflict. A shared producer implementation avoids app-local token registries and verifier forks. Source race/unit, fresh-process HTTPS integration, exact archive replay and controlled export drift checks support the bounded source result. Native operation/inverse/resource-path acceptance and independent owner review remain open.",
+  "decided_by": "codex (authorized source implementation only)",
+  "decided_at": "2026-10-18T09:39:19.723007+00:00"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-equivalence-and-drift-control.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-equivalence-and-drift-control.json
new file mode 100644
index 0000000..e107ef4
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/source-equivalence-and-drift-control.json
@@ -0,0 +1,25 @@
+{
+  "key-cape": {
+    "canonical_postimages_exact": 19
+  },
+  "ops-warden": {
+    "canonical_postimages_exact": 4
+  },
+  "integration": {
+    "production_go_and_module_files_exact": 54,
+    "generated_adapter_files_exact": 5,
+    "warden_runtime_exact": true,
+    "extra_tagged_test_fixture_only": true,
+    "native_acceptance": false,
+    "binaries": {
+      "keycape-candidate": "sha256:100fa2ef729c63601e09b5392260ac04675d46d497674c4dbf24093c43354cd7",
+      "tokenstatus-consumer": "sha256:2552054056769493c002202b635157483e2c9a4a13c13a063b38510076c7b28b"
+    }
+  },
+  "export_drift_control": {
+    "unmodified_returncode": 0,
+    "consumer_only_mutation_returncode": 1,
+    "refusal": "producer/consumer token-status source drift",
+    "canonical_files_modified": false
+  }
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-archive-metadata-limit.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-archive-metadata-limit.json
new file mode 100644
index 0000000..ea5f944
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-archive-metadata-limit.json
@@ -0,0 +1,13 @@
+{
+  "archive_full_suite": {
+    "passed": 793,
+    "failed": 1,
+    "deselected": 4
+  },
+  "failed_check": "generated catalog artifact freshness",
+  "cause": "git archive has no history; generator cannot recover the historical catalog commit",
+  "actual_catalog_last_change": "207d29e8d1d613ca2bdee4ab7628ccc5ca2ec0fb 2026-10-17T12:13:49+02:00",
+  "catalog_and_artifact_bytes_unchanged_from_canonical": true,
+  "artifact_sha256": "sha256:5cd9c03b86751f7197cb5661a53a86d59765137958b215ec14bb343156f216d0",
+  "next_verification": "Use the ordinary credential-isolated make test runner in the actual checkout after source-only application; do not rewrite the correct artifact"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-baseline.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-baseline.json
new file mode 100644
index 0000000..0623724
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-baseline.json
@@ -0,0 +1,6 @@
+{
+  "commit": "git:b593c879831378db7dc62adfabdfedf2d44ddd38",
+  "archive_sha256": "sha256:d46db68b77df8b150a8a2ccfd7903c4f3175b2c1204f7f3b879c6ad7d1e870ac",
+  "source": "/tmp/custodian-keycape-current-client-r1/warden-source",
+  "canonical_owner_changed": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-canonical-full-attempt1.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-canonical-full-attempt1.json
new file mode 100644
index 0000000..fe48bfa
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-canonical-full-attempt1.json
@@ -0,0 +1,917 @@
+{
+  "returncode": 0,
+  "seconds": 76.42,
+  "command": [
+    "make",
+    "test",
+    "UNIT_PYTHON=/home/worsch/ops-warden/.venv/bin/python",
+    "PHASE_MEMORY_REPO=/home/worsch/phase-memory",
+    "TEST_ARGS=--netkingdom-root /tmp/custodian-keycape-current-client-r1/net-kingdom-source -q"
+  ],
+  "source": "/home/worsch/ops-warden",
+  "source_sha256_at_start": {
+    "scripts/build_flex_auth_registry.py": "sha256:8074c845be00405024ee4d9b02987b872c2dc324cb94a67037e269ccc006f003",
+    "scripts/check_policy_caller_identity.py": "sha256:6b3050ef2799297e95952a05f47d87e966e256e7f23c5dfae70659aa458f8c15",
+    "scripts/check_tunnel_cert_readiness.py": "sha256:acb2576f0a28161b58954ba264946163a99a3b4ff93789ee783443355d115c17",
+    "scripts/check_flex_auth_manifest_coverage.py": "sha256:7b75451b41a79c858462de93d70b6eb4da31db31b8cd5f636b0fa2d866eef17c",
+    "scripts/report_workload_join.py": "sha256:3df0d33e680a9f3bff82cdebe8ff5528deb09e103cdcf7f376c1b1b7cd051361",
+    "scripts/check_secret_posture_conformance.py": "sha256:10c1f752d8831671d57ab5149e847413ef8a83bf407f5e8fce45cbc180848efe",
+    "scripts/check_layer_conformance.py": "sha256:7262fae9fae7ed454c0765cc6859e83a74e59ef6eade849991e0b8ab9c66757b",
+    "scripts/emit_high_risk_paths.py": "sha256:5e95f7ba6d00f923adc41913e3ca6063209416e3133955d69ad59920149fd9fe",
+    "scripts/check_agent_read_boundary.py": "sha256:d8ce6f0793c33ec9cc0200ce907b6fc9c0e7dfcc181415831d051ea712d6f7ed",
+    "scripts/check_principals_drift.py": "sha256:f6ef9b036e398d59740057ddeeffbad964acb793cab280abe8188ace55832696",
+    "scripts/report_coverage.py": "sha256:2bf180427a2878cc2ec09e69d2e4ceca09d3e53316678c2c40aa61314459bfe2",
+    "scripts/run_unit_tests.py": "sha256:86880094b33114fdefb26691140b5c9a516cdba5fe6ddabd70fd5b7f18e9d2aa",
+    "tests/test_models.py": "sha256:81b2416654a3abcb2431d7867914d594a9ee15f49b8f59ed8d7d7c0d7aa78350",
+    "tests/test_principals_drift.py": "sha256:17bcfec0fc25584739b04c59d83ff10e407a3af81d21e99aae83a35d31084f85",
+    "tests/test_flex_auth_registry.py": "sha256:7b1eba1aed31f74112455524ea928129e4ad03bd9688500cb2077b7df9d6b0a5",
+    "tests/test_scorecard.py": "sha256:830ebc26b1337202641eaa28d7da61c513231a272805de02c3f2a7ff15f2e95d",
+    "tests/test_policy.py": "sha256:208ca1ba567e86e4fb1b40206c0e030d7592edab937bdc4232367890852dfb31",
+    "tests/test_doubles.py": "sha256:ffc3d792d5571c420c21ee301d3fa74ec45937c8e374211453d7027fe0b1f100",
+    "tests/test_case_current_session_reference.py": "sha256:7013ad1b30a0648cb83a78102def02340c6af3ebc284877335b71b080fced720",
+    "tests/test_ca.py": "sha256:1358b78a33079185e6ff69b27cdfcb21db10a6ce5c44321a21b43165a4428ede",
+    "tests/test_case_attended_boundary.py": "sha256:4615e653f06144305ea1a84e98bc6260e16ed41ef9e5db2d0f162ef9f723ef2d",
+    "tests/unit_isolation_probe.py": "sha256:726d3e01ae21c1379588e1f08459449908cc8a75ffea1b337c33a1a888c66f59",
+    "tests/test_openbao_configuration_routing.py": "sha256:597c3092827b684cb86986a12e489d6fd609b62dc739a33b7dd42e59c9879721",
+    "tests/test_case_1_3_integration.py": "sha256:4862c5a004075eb18733d354bee7dda3f55e04a6ee8ecb44b76166347c121158",
+    "tests/test_routing.py": "sha256:43998fccf67b1f0d1a6c8bde1a4768a32f8418fb72a8eda5bf321dd96c097d35",
+    "tests/test_case_type.py": "sha256:5a217a172e7e2ffbea66f1beee9a1c18bf5e97f9fb25b83cb96b6ba976cbb2a5",
+    "tests/test_layer_conformance.py": "sha256:3edf0a0d49c3560278a564c477834335cfaf5243341cb9345f0d4bf8994db56c",
+    "tests/test_vault.py": "sha256:3c3b16739cc16651eaf4409e00d44b5a9bce92b710e75b98913b61a4fd00fe6f",
+    "tests/test_plan.py": "sha256:405906b207d8f7469b6135782b357f5a35e4e31ed0426fd56cedfd02d43c1392",
+    "tests/test_case_admission_modes.py": "sha256:9110d6b6286cf0f85268d4970d1fd403250da3f04351d70b1fd2d9d7a93e2d89",
+    "tests/test_policy_http_refusal.py": "sha256:443f214ffbcc454cbfdc9752e8622593816139f2d8538c6c535e9902559a842e",
+    "tests/test_posture.py": "sha256:dde12cfcd8a951be4a122e2eb9730f70a588a257e437dfed23c0c05461b5a6b6",
+    "tests/test_audit.py": "sha256:74efa3dcfdb05e21b28b0d22c8770133fcea001c66cc7a80bd9e6af2c87636ba",
+    "tests/test_memory.py": "sha256:300d9d9c6cd98eea1292eb70a01b28849cb5696690a2504f524123934180220e",
+    "tests/test_safe_unit_runner.py": "sha256:5408e7face98b01b92da077b0b2d115fcb370ec46e572ad5a69e3d0c10df8433",
+    "tests/test_config.py": "sha256:ef4e8bea2ebbc689e822cf10fd27bd2bd9b5271a93eb2039e2e0a236ebbabac3",
+    "tests/test_case_original_context_consistency.py": "sha256:10c5187cbc49222017319249ccb408816497ec6e006859d23003f3b2b375445b",
+    "tests/test_desk.py": "sha256:b655023ae57e4e889c87802d47c19efddc575154f89516343761212694eeb092",
+    "tests/test_tunnel_cert_readiness.py": "sha256:d2bf6f1bf6d7cc50b86a28fd8a52959e513ea1b6dd15a0326f7028af52653b44",
+    "tests/test_scaffold.py": "sha256:3126d8ea447fdb0685ba40d0bb031e2635bff26b0eb057c6bc7cdd5851a4aa2e",
+    "tests/test_inventory.py": "sha256:895d2032cd4927ab9ec94253286e2605695c3261c1e4b4aaf67c9ee2cf3461cb",
+    "tests/test_worker.py": "sha256:9584572486bafb0de585aed8433add7f60f7947527684f64cef4498bb84efb6b",
+    "tests/test_integration.py": "sha256:b27529b3c794639c21a778265c589ba3c87bb82e7ce280bddb38ed64ea398d4b",
+    "tests/test_workload_join.py": "sha256:8ef0891daf4b7ac520430a514690364917110628edc760911a850195cffbdd4a",
+    "tests/test_case_receipt_state.py": "sha256:6ca261660744ea187b7a7aa79cfa5e0d05e7e53af72f9c12d6c9ed375a4130e9",
+    "tests/test_taint.py": "sha256:5909a29b43e24b0cdc7d8752b789679f175a6614ba021e62cf82ffde1bf5455c",
+    "tests/test_case_run.py": "sha256:32a277175cfa9f496a2850289f6ad8d5afdf47d33c4747dd7ec552e951fd7b39",
+    "tests/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "tests/test_case_inputs.py": "sha256:6bf84eafbc4399831b35aa58e755574c8da9ddcbf1d0532eccf649d37779533d",
+    "tests/test_agent_read_boundary_check.py": "sha256:cda637e2ab179cec155989d203ec6e74ae7489a3d68d55f85ab0d6764c829443",
+    "tests/test_openbao_caller.py": "sha256:3ec471cc61f4c968c89e74f482de1a6cd70ec861387a61d2219e970651a521ee",
+    "tests/test_posture_conformance.py": "sha256:29ba461285f8a1812a9f0d1c6759f5ce8f969ad3d8f4e5b47c49aafff0368b04",
+    "tests/test_access.py": "sha256:89c8e57929a83da409ddd327bd0b3a5b48399c888523e3e599510b437853873d",
+    "tests/test_proxy.py": "sha256:9e464043e85f450c0130acfe64b362ee0714483ed2e6fbc2bea6edfac7cdb83e",
+    "tests/test_mask.py": "sha256:51588dff08546f7f4d7761b4203b647dfe23121fe0a94de78f2900450d444fee",
+    "tests/test_case_plan.py": "sha256:944bc2a725ca1b7a10f4516c3ceed65f99627057dd15a859da4f8ffb3d97e71f",
+    "tests/test_reuse_surface_caller_gate.py": "sha256:c17b36a7e2de1c832737d65b36c45a8c5e3bdd820fa96c5faed3d269053a511e",
+    "tests/test_policy_fetch_evaluator.py": "sha256:122f6ce39d01e78d46abd2ffae0a2a2021a9dbe4189f2181679f9539cca8683c",
+    "tests/test_cli.py": "sha256:4b9d32c990dd5b0e5ed7b81bf17577e09458fac2006e01e59caadd99d761ac56",
+    "tests/conftest.py": "sha256:40ae0e4e7e57e5daa13f2997b27b7fa30ac86ec7ac1800e3e65a2247d7e3edfd",
+    ".venv/bin/activate_this.py": "sha256:46ca89ffcaad5d6874dd52d771a177c4c4dd41390591b5230ebc41184b934775",
+    ".venv/lib/python3.12/site-packages/typing_extensions.py": "sha256:433d11d170d3a24d2eb065ebc1bfe848cea7e3d7ce68567ab52bea2d4c2f7ed8",
+    ".venv/lib/python3.12/site-packages/py.py": "sha256:b71675b5d9845ba0814e9e88767f88dac3b3cc0d3128da028bd45edbb523e871",
+    ".venv/lib/python3.12/site-packages/_virtualenv.py": "sha256:6cf30c56faf2a55228914dbbd17f8088ed371ebb08f5e7fa6fd931f913fcaf1d",
+    ".venv/lib/python3.12/site-packages/annotated_doc/__init__.py": "sha256:56ecb1c547bcd247c4c969ceac2c7f064f21c9ba3768aa3a4580659010585bc9",
+    ".venv/lib/python3.12/site-packages/annotated_doc/main.py": "sha256:e597efc6ff344b0c0baa9456ef7019c99ca23386d699af505916e9fdc803db4b",
+    ".venv/lib/python3.12/site-packages/pytest/__main__.py": "sha256:a150eb186a3b3744cdcb35e7b546e57204ca6e11c65ad8af717e530bbb4470aa",
+    ".venv/lib/python3.12/site-packages/pytest/__init__.py": "sha256:7be7a1e2218dc59a19d1ad131e4abe21172a295087efc72898938248782e8766",
+    ".venv/lib/python3.12/site-packages/ruff/__main__.py": "sha256:9d1d7fd69cf37d7dd3b38acea6efa67e6429defa5d0452c2dffa94d8afebac3e",
+    ".venv/lib/python3.12/site-packages/ruff/__init__.py": "sha256:eba8a7f720d20a26214448eec4b4af01cfe0e717f6a773d870401e06cc10842d",
+    ".venv/lib/python3.12/site-packages/ruff/_find_ruff.py": "sha256:24dc682895e4aa24a4995ad3089fecbf83a5d12c0c05ca3311edd6ebb6dbd22a",
+    ".venv/lib/python3.12/site-packages/iniconfig/_version.py": "sha256:28d1587be56d76ded9fa81f297c8e60c043da97a0234c0045e2823e814754142",
+    ".venv/lib/python3.12/site-packages/iniconfig/_parse.py": "sha256:e6770197b30042268f367a51aecf45478b7a1ba0e480e52ce39f0e63fd42476f",
+    ".venv/lib/python3.12/site-packages/iniconfig/exceptions.py": "sha256:9a2a50fda3310fd0af4af156375a135d8e10b919ca00c6757f7b027668c34d4d",
+    ".venv/lib/python3.12/site-packages/iniconfig/__init__.py": "sha256:5cbe5ea94623e26b2400ea2b6798df4408a726f2734c8f9f271a4fe317d7b5ac",
+    ".venv/lib/python3.12/site-packages/anyio/to_thread.py": "sha256:7fa87f93677be37181bfd16102784cfd8a53bd6808af3072f5c384d1e275509c",
+    ".venv/lib/python3.12/site-packages/anyio/pytest_plugin.py": "sha256:b7a878289b2da88c5fc704d9d583bcbe9515b81f7d9df08b96d9f43477dab47a",
+    ".venv/lib/python3.12/site-packages/anyio/to_interpreter.py": "sha256:fe62e782b332f7b4cc47a55b5b863a6330d493d66e3dc40c3e592ec918770bd9",
+    ".venv/lib/python3.12/site-packages/anyio/from_thread.py": "sha256:2fed30d47c49e8149bf8ab958b9ee4e5391cdf2cd0af1dd02b9b40c4c3dc63ed",
+    ".venv/lib/python3.12/site-packages/anyio/to_process.py": "sha256:27b80003f60eba81ea9e90c07f97e6d50bba90e993cdd15b88336f9d5ef9e6f9",
+    ".venv/lib/python3.12/site-packages/anyio/__init__.py": "sha256:ee20d5a8c529ad4b8a358f7516ea0aa9ac80851f8e635dfa6033c8e8fefc1c79",
+    ".venv/lib/python3.12/site-packages/anyio/functools.py": "sha256:e4058cd626132a44f3a6dbd48500dd2d28791af6c15bebdcb3e48051f21f03d0",
+    ".venv/lib/python3.12/site-packages/anyio/lowlevel.py": "sha256:03228b54adcb6964a82b7f4b9022b1138fc60cc2ca64136a4eb2d4824eb7cbcd",
+    ".venv/lib/python3.12/site-packages/pygments/sphinxext.py": "sha256:aa6896bf96fbaaae9b3544f6636c197a3576226426bedcc624583a2dc184365d",
+    ".venv/lib/python3.12/site-packages/pygments/lexer.py": "sha256:80d318ce675291337259faa22c9dfba147752ab37f74c5edb0fc9a5f6fa7f440",
+    ".venv/lib/python3.12/site-packages/pygments/console.py": "sha256:0b5f3d240c210b5421d002a0b21cdbd70543cc5a819efd55678e644c40c83b7d",
+    ".venv/lib/python3.12/site-packages/pygments/filter.py": "sha256:d5d9db92ad80742dc0907b770da5f09ce91304b0a1975911ea76922f09ebfed7",
+    ".venv/lib/python3.12/site-packages/pygments/plugin.py": "sha256:3facc8c3ebe4490d24d56287af36c14e3a7094264f6d1fba41efdd3bd06376ed",
+    ".venv/lib/python3.12/site-packages/pygments/__main__.py": "sha256:4195a3d13e934d1b2aafec3ed18bd520ba350f202fcf3c9d18244e370744ceaa",
+    ".venv/lib/python3.12/site-packages/pygments/regexopt.py": "sha256:776853bdace5a30e73cd920e0959df7841b6098d06ad8fe2807d6409249fee8c",
+    ".venv/lib/python3.12/site-packages/pygments/cmdline.py": "sha256:fdd3a7aed6bfd8621ef0983ed58d296f9bd68bc2fa413889cf2a13b87ad8adb3",
+    ".venv/lib/python3.12/site-packages/pygments/token.py": "sha256:0d58a5e53da5b479138104d4632d5d32d8328a08dabc2b35ca913841fd82ac6a",
+    ".venv/lib/python3.12/site-packages/pygments/scanner.py": "sha256:0eda0b8b5a4e2a936efba8e26a42694902d48bf7a9dbd490421bfba00c1858c1",
+    ".venv/lib/python3.12/site-packages/pygments/modeline.py": "sha256:99ef20e6bc9289dbcfb4c04eac3cb63b5b0ca99774da5047318e4a0d979f530b",
+    ".venv/lib/python3.12/site-packages/pygments/__init__.py": "sha256:673a675e9be7bf473baff3884bc87b51e6844aa60d28ccbffe957b2828965f1c",
+    ".venv/lib/python3.12/site-packages/pygments/formatter.py": "sha256:3d30674d6d041e47b6bf39402aebc72648f7fbf08c8fc76e231fb7c955227bea",
+    ".venv/lib/python3.12/site-packages/pygments/style.py": "sha256:1eb89edfbddb81653cd5937056364cf86341a3107155ed56d53af733324b7646",
+    ".venv/lib/python3.12/site-packages/pygments/util.py": "sha256:ce4f77e6d252a70480f73c4d995d53ba17043f431f6e85e24594864272cf12a9",
+    ".venv/lib/python3.12/site-packages/pygments/unistring.py": "sha256:678c381df395521b9e09445191f840a90d9bfbaf54ce4858e31b877af604cb98",
+    ".venv/lib/python3.12/site-packages/typer/_completion_shared.py": "sha256:fae84250831cd92d72c1d07e7c149271c1fbd2620112c553c47a26726cbe9251",
+    ".venv/lib/python3.12/site-packages/typer/_completion_classes.py": "sha256:47dbf80fca49ffe9fc7cb3aecb1ad14aeeec3f99695c8cb97ec2d45bccf0b035",
+    ".venv/lib/python3.12/site-packages/typer/_typing.py": "sha256:40ec39a3e0762fef82de5cb60d01fa694c1a83ac796eb57916155a059e60ccc8",
+    ".venv/lib/python3.12/site-packages/typer/colors.py": "sha256:7b8da3f2e079db484ba57e42ff47e247738ea0814c6e13b700366fbfa865015f",
+    ".venv/lib/python3.12/site-packages/typer/__main__.py": "sha256:6d8b7d7846a845059d7a3107143f11131f63c5511d669b44085b15ec5e3d2279",
+    ".venv/lib/python3.12/site-packages/typer/completion.py": "sha256:1514d1f613ff20f749a7ee065cf3aad1bb57a394af800b4b55f4b766400ca604",
+    ".venv/lib/python3.12/site-packages/typer/cli.py": "sha256:7a0e3069fcfeedd07e3d9a90711ba70db4ae71cde0486458b1cf37e12ebd77cd",
+    ".venv/lib/python3.12/site-packages/typer/utils.py": "sha256:c272750d65c114c9f12c768c37f1c3627b712d16f2d0afabbb1eb76a89072272",
+    ".venv/lib/python3.12/site-packages/typer/rich_utils.py": "sha256:96ac6b47340bb67c1574d88368d70018fcef4b1458a5602d3c7c0f1015cb7335",
+    ".venv/lib/python3.12/site-packages/typer/params.py": "sha256:028bd5891b65f95bd42179e628aa67c6858af7f80751bc90817c71bf787fee52",
+    ".venv/lib/python3.12/site-packages/typer/testing.py": "sha256:fa8bcb36350d3441422686aefb8d624c92286ec8cf6eac93ad1abbfbc69ce33e",
+    ".venv/lib/python3.12/site-packages/typer/models.py": "sha256:3b03c6dcc0178940f98a1de9f1e3557225d4b0bd3b50825f356cb72623690df8",
+    ".venv/lib/python3.12/site-packages/typer/__init__.py": "sha256:0e593c413725cb6540d140e1efdd9193f5c6f0df47662f72b9ccbf4504497026",
+    ".venv/lib/python3.12/site-packages/typer/core.py": "sha256:37be001301b1d0f6d837abf38a65b1a896ddf8ee6e809e7f1578c18519e05d0a",
+    ".venv/lib/python3.12/site-packages/typer/main.py": "sha256:5d405191aa4731de5d40d2198500473b4004f913d35779b95ecf005b6d02a2f6",
+    ".venv/lib/python3.12/site-packages/typer/_types.py": "sha256:d257010cb72cc6aaf5b314eca8e6e3feed037dadfb956258518e0f3645f84250",
+    ".venv/lib/python3.12/site-packages/idna/package_data.py": "sha256:69dad7c413931f8a97b2deca5d5ff3f162703f938a6d07c6f1238705f14ae36b",
+    ".venv/lib/python3.12/site-packages/idna/compat.py": "sha256:01ea40dfd71e447c647c73f8d7e16f296e4a8be7f83df519f7445432508d766a",
+    ".venv/lib/python3.12/site-packages/idna/uts46data.py": "sha256:f15a9ade36a4138656618324b7e713929ec8ce9c09126a2b603c8068064e3c8e",
+    ".venv/lib/python3.12/site-packages/idna/idnadata.py": "sha256:118921aa13b37b45a1c35a4832e9bffaa10733ef2eb54c1cfc8068214596f06a",
+    ".venv/lib/python3.12/site-packages/idna/codec.py": "sha256:c2dc978833562b63ed22cf0b0214c747b14508d0b811c330c004a4b0726a071b",
+    ".venv/lib/python3.12/site-packages/idna/__init__.py": "sha256:30fa8d0cb65b5ea19a35d5f1005862a853ca1105e3bb68cd42109ecbafb97893",
+    ".venv/lib/python3.12/site-packages/idna/intranges.py": "sha256:7a0a5211760327a044d048e8f1d8d1761b1be09254b72a0043f7b8f463feed51",
+    ".venv/lib/python3.12/site-packages/idna/core.py": "sha256:eeb32752db2c5ad9e4917ad1ee54405ef1197b6c4ab4b71ce3d7590cdd804f15",
+    ".venv/lib/python3.12/site-packages/shellingham/__init__.py": "sha256:a4029750f294770c84ac2d198d2fb9c3e7d17526e675c7ef9e9b7fc75c96aad0",
+    ".venv/lib/python3.12/site-packages/shellingham/nt.py": "sha256:9ba27a4aec32a95565c574fd05cfbd17fd71f93e6ed2008516b4401762c891e8",
+    ".venv/lib/python3.12/site-packages/shellingham/_core.py": "sha256:bfe093affec5edc240b4d9f3a5ad4dfc797c69f918e728830388e81a6b1406ed",
+    ".venv/lib/python3.12/site-packages/_yaml/__init__.py": "sha256:d3801eff9a2cc5a8692476b75c165401fe308ba5d7df6811f03e97ea9eb81840",
+    ".venv/lib/python3.12/site-packages/rich/ansi.py": "sha256:4d0ee9764b2ad1bdd73dcc3fb521af2ff42d84fc4d2ca39840898f4185a9ea93",
+    ".venv/lib/python3.12/site-packages/rich/_win32_console.py": "sha256:a3640dfc8471d746e218fdc0a759de6aa5fc1411a550a4a658ce8ac3839283e5",
+    ".venv/lib/python3.12/site-packages/rich/errors.py": "sha256:e693f729ce5de1027f734285b31adfca18e23d57bb275ccea9215b140cdc57e6",
+    ".venv/lib/python3.12/site-packages/rich/theme.py": "sha256:6e261959dfd6bb5296f15b53ed4b13403ac353cf51c402b9fd5cf5cb7ced1982",
+    ".venv/lib/python3.12/site-packages/rich/_emoji_replace.py": "sha256:cac4a7f2c992a905b6d9711f087d2527cd2fa2051864aafd74f2267d41b67ba6",
+    ".venv/lib/python3.12/site-packages/rich/syntax.py": "sha256:cad81e194b7dd5f76bf0b68728e76468d31ec2b3d1c60a1c8b998c77730f1382",
+    ".venv/lib/python3.12/site-packages/rich/_ratio.py": "sha256:20eb65efcb1009866c987cb185ee3992b91bebcbbdc55cfbcc5b175490fe6f66",
+    ".venv/lib/python3.12/site-packages/rich/padding.py": "sha256:87c5e7222bcbacdb65c48def40f2875e1e210308ce26a671d2c94cd33de0d7f3",
+    ".venv/lib/python3.12/site-packages/rich/_wrap.py": "sha256:1654aca26e445f42d5900dca5b2df8c879c27cbb6a5fe6487a95ca87eef4ae97",
+    ".venv/lib/python3.12/site-packages/rich/palette.py": "sha256:02be9952b607885b7af91af693e93d17c57b87180960735daa3936bd55ec2e07",
+    ".venv/lib/python3.12/site-packages/rich/console.py": "sha256:4533fc66963623a2a21447b501d6f51f8cfee7e14775178093a5e6eb61dc135a",
+    ".venv/lib/python3.12/site-packages/rich/jupyter.py": "sha256:1bda4e26647811220561277830a1aa987a82b6cb71d28456a7279382fe78f977",
+    ".venv/lib/python3.12/site-packages/rich/segment.py": "sha256:d7b240c386e6b15fcbac9f0f9e123d5c7d8368df9f3843c5fbc9a0c7b8e82c33",
+    ".venv/lib/python3.12/site-packages/rich/default_styles.py": "sha256:0ea114886ae3e0dd1e01c803c2319e5127bc04b331670e7b2fd4579d30aba13b",
+    ".venv/lib/python3.12/site-packages/rich/color.py": "sha256:dc74942d50e3eea4245d47455afefc24e8926737f2e72d6791c6219dadbde95d",
+    ".venv/lib/python3.12/site-packages/rich/_inspect.py": "sha256:e695180aabde3787a46ff9a01ce6028a9c990ab30610965866cdf2e50aa609fd",
+    ".venv/lib/python3.12/site-packages/rich/containers.py": "sha256:73fe7a4f171e74662a0dea4704c4ee65d5088a38ad010827a31f9075ed19d6aa",
+    ".venv/lib/python3.12/site-packages/rich/repr.py": "sha256:9857b119356579d7ac662303de3041041a080a85a1f973c5014ab71eeee25f85",
+    ".venv/lib/python3.12/site-packages/rich/box.py": "sha256:492a2583cfe9cc7cd8f50bc9428faaa74b5b3ec9e3f0eff65b88668b597e668d",
+    ".venv/lib/python3.12/site-packages/rich/pager.py": "sha256:48efc44c114a6e0de7fc080ecd79b8d52bf7e98c57032237fd1f8a398dbfb927",
+    ".venv/lib/python3.12/site-packages/rich/rule.py": "sha256:ba63b6d568f0d0571801e4c1dd4ba634b0ac0d685e8f3c678e57f65708978832",
+    ".venv/lib/python3.12/site-packages/rich/_export_format.py": "sha256:448d3ca52ae6e6d052ccf32f9db4ea6c3f5621a95a3a837977833545398bab56",
+    ".venv/lib/python3.12/site-packages/rich/spinner.py": "sha256:a27221a4a9658d11e9a5365ab313bc91782d632087524a5280a825449de8e758",
+    ".venv/lib/python3.12/site-packages/rich/cells.py": "sha256:7cf4529eab989423b84c782652890e24e84d95cc7c0b8359d97bfd24cffb19b1",
+    ".venv/lib/python3.12/site-packages/rich/prompt.py": "sha256:d5222e0447a5a2fbf0086db0a76d8f670b24037224980b0ec5fd2bb8590e84e9",
+    ".venv/lib/python3.12/site-packages/rich/progress_bar.py": "sha256:9994cfa4953071f71d8100934f3de4c98f9f73bf5d74bc2dc7a1a18717e8d3ae",
+    ".venv/lib/python3.12/site-packages/rich/_timer.py": "sha256:cde9716d3ea83c566736bc163e973592d51e013f957387ee15c4592d018bb4c2",
+    ".venv/lib/python3.12/site-packages/rich/_palettes.py": "sha256:71d7afd4940a67426f960b95f62a478339d3767be52335050c16f422dd8fce32",
+    ".venv/lib/python3.12/site-packages/rich/terminal_theme.py": "sha256:d63e7eb9f25f9ef940a3942c8bf0026625c39b0317cea826141c8e6d3f7ec896",
+    ".venv/lib/python3.12/site-packages/rich/logging.py": "sha256:eef864eebfcb8564dcc2d7b28cb2cce4d7dcf37f5fc01b888884af059706c33a",
+    ".venv/lib/python3.12/site-packages/rich/file_proxy.py": "sha256:32f941ded4acb95987e2a0965caf522b74bf3a8855448733530fc5b9f9ac76df",
+    ".venv/lib/python3.12/site-packages/rich/json.py": "sha256:a260b65874e0511c44a2c9dad5fb684890a77b6117ecc0ee42d09db304b7aac9",
+    ".venv/lib/python3.12/site-packages/rich/diagnose.py": "sha256:d515a7428a693d78c2ff8f40078bed574e3c0cade4b104aaebbd42f3763a7fe8",
+    ".venv/lib/python3.12/site-packages/rich/table.py": "sha256:eb2bfbc0c2d76603ac1a0cc40e9297a5e71740ec1c2c11cd3a7f8c61c6e8d599",
+    ".venv/lib/python3.12/site-packages/rich/filesize.py": "sha256:fe2cfd948a5182f5bb30d49e0999cb83e1f0cdb3f81844e0e78dd6a83f1216cd",
+    ".venv/lib/python3.12/site-packages/rich/__main__.py": "sha256:91ccbc06d04452460b0a8811930842749b3454dc7a285d67f24154da0fbba658",
+    ".venv/lib/python3.12/site-packages/rich/screen.py": "sha256:acbfe3db05fee127ae20e236a0e95ce35f103fd100bc3e7d1889d4984004ea34",
+    ".venv/lib/python3.12/site-packages/rich/bar.py": "sha256:95d6d51cecca24e9df95536ebf5c52ee0e9d2d7d84df03275e474f6e9cc94dcb",
+    ".venv/lib/python3.12/site-packages/rich/themes.py": "sha256:d318132e8cdf69b79b62d709b43742e50917e4855411abe2a83509261e185459",
+    ".venv/lib/python3.12/site-packages/rich/_emoji_codes.py": "sha256:86ed552fd9db55da6926b5688a356c85195c4517bfbf7763bb7326776b0a65d6",
+    ".venv/lib/python3.12/site-packages/rich/markdown.py": "sha256:3266cd87c2215a074635091e3531d6351e3bd0a415002b7ff5a26ee93328bab0",
+    ".venv/lib/python3.12/site-packages/rich/markup.py": "sha256:6eda6bdbbd412e18824758cd825467bf606923355c35e7d8c1231e5bdb5e0db7",
+    ".venv/lib/python3.12/site-packages/rich/_stack.py": "sha256:f82f0e2bbaf19f7b0851d570c59041a5e1e12335f4788f9533731e9987da5e6d",
+    ".venv/lib/python3.12/site-packages/rich/_null_file.py": "sha256:00318aa75cadfa4ef414c295ead9ea0aa79c07ead2273a7e590b03ecb3cbfa48",
+    ".venv/lib/python3.12/site-packages/rich/styled.py": "sha256:c258d5b154d76c004c319be4ce43b8dd9124ffe8abcc4b6f52243eb0d9e2910f",
+    ".venv/lib/python3.12/site-packages/rich/control.py": "sha256:1e7b2b6854f305a5100f3289597b1f3eff8f3e6806ca94a04afee800d69c92ab",
+    ".venv/lib/python3.12/site-packages/rich/traceback.py": "sha256:4d3d3778b2848f95daa57169f6481fd1b07036ea4816b1eab8ac59b70061cfff",
+    ".venv/lib/python3.12/site-packages/rich/constrain.py": "sha256:d5520fb82f0082d296adc9dc42b8c1758a80dc9556cacbba8d9a35aeb87b73b4",
+    ".venv/lib/python3.12/site-packages/rich/protocol.py": "sha256:f4e1f37d95c09e2759a9a660485b17e4ab0983c2471cd51cf2393d76cc5ad629",
+    ".venv/lib/python3.12/site-packages/rich/scope.py": "sha256:c7e8e428813e8fb67103d234ee5c9ae62540b8303250a339f075ad359414cd17",
+    ".venv/lib/python3.12/site-packages/rich/_log_render.py": "sha256:c41282c6a88ee05664f1e1b9e9ff1cac576b989c45ac9b1013757717e7c57a47",
+    ".venv/lib/python3.12/site-packages/rich/_fileno.py": "sha256:1d66713f90b66a331b1ebcaf01066c79f9557d0a06cec28e1f3286b0b0fcca74",
+    ".venv/lib/python3.12/site-packages/rich/_spinners.py": "sha256:536af5fe0ff5cd28ec8e251d00449cda200c7378b8ae2fd2f0f60fea4439cf52",
+    ".venv/lib/python3.12/site-packages/rich/align.py": "sha256:6bc31b3fe8898e8385a27c6a8283f76247ad28c594dd61596b18ea02fd907391",
+    ".venv/lib/python3.12/site-packages/rich/text.py": "sha256:b7627c88caaec11d015148209be715369df45b1c3933c7c817fa748e2a18455d",
+    ".venv/lib/python3.12/site-packages/rich/highlighter.py": "sha256:3086a95b08d1f1a85472c0e2720378c4b45b6a76e1e71fd0ce1e647dd0eb28a9",
+    ".venv/lib/python3.12/site-packages/rich/_extension.py": "sha256:1bae8f91b1ff41d4c987a8c3f89db6f0eefa0a6027af684b42fef60a03cfbb31",
+    ".venv/lib/python3.12/site-packages/rich/_windows_renderer.py": "sha256:77bf7dc4e9f12db0820b31aef7e53b60b988424c6dc5020115043a8aee2f7927",
+    ".venv/lib/python3.12/site-packages/rich/__init__.py": "sha256:8fb000f7fcff3c03506e6453c1391665cfc355daad0411f106a1ab32ccf6d422",
+    ".venv/lib/python3.12/site-packages/rich/tree.py": "sha256:4283b0838db816477019f47c2b4b59e90eeab7358d0143ff9b8b05698b86ea7c",
+    ".venv/lib/python3.12/site-packages/rich/_windows.py": "sha256:8acdd6a5b1cc8fc59a4c7601d7585cea53f6b78865bede135624e51d29a3b22d",
+    ".venv/lib/python3.12/site-packages/rich/pretty.py": "sha256:9715bf6e105f0d329efa0aedccfd4a42142ca8f6717d9375e2d8782515682f34",
+    ".venv/lib/python3.12/site-packages/rich/columns.py": "sha256:1d45f429c326f5db0a362d757d36e233f876883b65f3248269573195a944ceaf",
+    ".venv/lib/python3.12/site-packages/rich/_pick.py": "sha256:7af0edf10378945e428b0ad421794e2429ed8ad0423ac23764b3c42005512c95",
+    ".venv/lib/python3.12/site-packages/rich/abc.py": "sha256:7402cc3867ca54d7806efaaaeba2294d0c5051eaf10fb004e052b0a9dd1e40a9",
+    ".venv/lib/python3.12/site-packages/rich/style.py": "sha256:ca9e13b0d28d3d4c41cada0559fcbb9331361a1ffd4d803b7ecd942d77db9b4d",
+    ".venv/lib/python3.12/site-packages/rich/status.py": "sha256:9243e987761e019068f97fb8c0fa7c813a99c94e3ae8d2f06410383d94d37b0a",
+    ".venv/lib/python3.12/site-packages/rich/color_triplet.py": "sha256:de585091d25bbd63e82c33be0276089805a626f579765818342559f7b39168de",
+    ".venv/lib/python3.12/site-packages/rich/progress.py": "sha256:67a633ea960edba2c55f1db87172af9366c45fa1648cad99e5ed9fcb406defcb",
+    ".venv/lib/python3.12/site-packages/rich/measure.py": "sha256:1e6ac8257f2c5914c76e087c33111acbff37564a8d5bfef4b3c68a3f965c608f",
+    ".venv/lib/python3.12/site-packages/rich/layout.py": "sha256:591f0f092ae8627b5e213df36b0c50de4dda775b103b9c061b54993a8781b813",
+    ".venv/lib/python3.12/site-packages/rich/emoji.py": "sha256:cfb001bb4ffad5624f58e33f7718541cd680d01e9142e657deb7a58ecd62584f",
+    ".venv/lib/python3.12/site-packages/rich/panel.py": "sha256:f6c425d3484f22a1f91b68002d0a3835ea45c293f493dc13facfe03a6b39a487",
+    ".venv/lib/python3.12/site-packages/rich/live.py": "sha256:50abea2d2b92ccd1c8073e69c51ad4ed23ec9c6e3cbc9271d9330789a1e59a72",
+    ".venv/lib/python3.12/site-packages/rich/live_render.py": "sha256:8d03b75ffa76c1e9862366dd08063f7b98fdc57353c03c6eba36e9a1246c1fa7",
+    ".venv/lib/python3.12/site-packages/rich/_loop.py": "sha256:855ffa08b7683e6d2f6b6d96a70e332aa334458b33dd36715e3d0fa12fbd7834",
+    ".venv/lib/python3.12/site-packages/rich/region.py": "sha256:acd4fdc59ad56536085d90b43589f8d42250c1835b47e29e70f3b14e042f07c6",
+    ".venv/lib/python3.12/site-packages/markdown_it/_compat.py": "sha256:5384bfdb2df380b6557cc7a71d16891415bccaa87699406e236f752c6415389f",
+    ".venv/lib/python3.12/site-packages/markdown_it/parser_block.py": "sha256:f8ccae81707add37bbd6ce0d71241988ae5b13a04791d17266ffdbbe2b9ab5d2",
+    ".venv/lib/python3.12/site-packages/markdown_it/parser_core.py": "sha256:4919898ea7bc742e865b310046959b6b9f5c066c630abdc6b20f21dbd3bcb109",
+    ".venv/lib/python3.12/site-packages/markdown_it/_punycode.py": "sha256:26f48e649e152abe7ccfbba71463342a17d3c6a1cc936c3c82097169ed90b333",
+    ".venv/lib/python3.12/site-packages/markdown_it/utils.py": "sha256:95d8a894bafee3524ea287a13d9e7e4fe41d5976180bc3474b2b62aa079969fd",
+    ".venv/lib/python3.12/site-packages/markdown_it/token.py": "sha256:716aedf64a1d7cf762cc7abfb58af3c8864db4960d30dd7cd770cf365ba7c138",
+    ".venv/lib/python3.12/site-packages/markdown_it/parser_inline.py": "sha256:b80ba2675cc3a2712a281e3fb1d72424fe9662ef00ee78c994558c01be82f1ca",
+    ".venv/lib/python3.12/site-packages/markdown_it/__init__.py": "sha256:adbd33b1e6cd46a4fc62f727627b10a55eb46f39f7edb751ee89a3f5fa284395",
+    ".venv/lib/python3.12/site-packages/markdown_it/ruler.py": "sha256:78c02d5864407d2337dda88979dd24e7ddb704492e315b0cab572df2f53eaa5e",
+    ".venv/lib/python3.12/site-packages/markdown_it/tree.py": "sha256:8f58ff2e8f13ceb4fd2ef6d0334f58ce01d984c3e8d281499c1634053038d7f9",
+    ".venv/lib/python3.12/site-packages/markdown_it/renderer.py": "sha256:ee075e93bf94395dcd654e3ec1ee65b2e41df1afa8760af3ec735cc0287f5358",
+    ".venv/lib/python3.12/site-packages/markdown_it/main.py": "sha256:9fcda6500083f6a9b0d9c92f5865c8906f501158ecc38d7e57ea0dac58630023",
+    ".venv/lib/python3.12/site-packages/_pytest/timing.py": "sha256:94f70a1da33578a1efd7fd9981468f2bd877161b6a1af64062e731fcb49d670d",
+    ".venv/lib/python3.12/site-packages/_pytest/warnings.py": "sha256:c89303afbbd27a28fe9f24ee95d13bc0bdb964bfcbba640663a3c96695e243e2",
+    ".venv/lib/python3.12/site-packages/_pytest/skipping.py": "sha256:5824731d5a311780f418eac9a094e7cf1fd63a82d3b0cd5e9e5498cc6ecd127c",
+    ".venv/lib/python3.12/site-packages/_pytest/compat.py": "sha256:a9c1dc647432100e933b70b4a861203b46ff63136edb7a24d264d9d2c6a1ea49",
+    ".venv/lib/python3.12/site-packages/_pytest/_argcomplete.py": "sha256:821d299daebaa782d56f60fc493e39ebc586c6f7489c64f8de6eac95886a36a5",
+    ".venv/lib/python3.12/site-packages/_pytest/runner.py": "sha256:8d784b2b3e23b05f4c4edd3f5263eb11964e86b6e16d2c814c5fcb2125dc4ea4",
+    ".venv/lib/python3.12/site-packages/_pytest/setuponly.py": "sha256:06c46b0b81110d5af8dbed86fcbd00c61354e175706ccb32e52d253af2abf300",
+    ".venv/lib/python3.12/site-packages/_pytest/faulthandler.py": "sha256:d5cec3a51b4fd3f0b7ce91544b0d41391a401bc1ac883b49f730ae59d1222dcd",
+    ".venv/lib/python3.12/site-packages/_pytest/_version.py": "sha256:f8a6163a40407ea2d5020fce05934d67bed201ee389d90f82b9c2483c3924fa4",
+    ".venv/lib/python3.12/site-packages/_pytest/deprecated.py": "sha256:122928623a9d94b4d981b04d4e615d3ea88fe43759a730322b045b3b6840d151",
+    ".venv/lib/python3.12/site-packages/_pytest/recwarn.py": "sha256:e1aeacf165aa9fec82087caa82707f7df73fce4c170463c2baf0bed372fae5ce",
+    ".venv/lib/python3.12/site-packages/_pytest/unraisableexception.py": "sha256:74d681a411e4381e293884a868c75abb6a23ac6a1cfe2e2ec7be835572cb4fec",
+    ".venv/lib/python3.12/site-packages/_pytest/stash.py": "sha256:e69137903c78abce794d6f5a56f61376b9242a530353afb1897e25b8aa491202",
+    ".venv/lib/python3.12/site-packages/_pytest/python_api.py": "sha256:2f34e38783f3db967bc085450ddc5343aba6a98482e41ffc1ad2b1bb80af91ac",
+    ".venv/lib/python3.12/site-packages/_pytest/helpconfig.py": "sha256:ea2cb6d6850351119e759a41dde992cda142c5e353fc44529122192c8c4c26f5",
+    ".venv/lib/python3.12/site-packages/_pytest/raises.py": "sha256:f3a57e8686398586daebd9e9cab1fbaf891035bf108e8b986fc4b27462e68d57",
+    ".venv/lib/python3.12/site-packages/_pytest/pathlib.py": "sha256:c483986bc125cb2a43d814ee4b6ffc6e1e8ec83e038cf7c13ae9641714396f54",
+    ".venv/lib/python3.12/site-packages/_pytest/cacheprovider.py": "sha256:40229d89ea544a4b8f344c790e58484076c0e35dccc0d5257782c8a55d7a156f",
+    ".venv/lib/python3.12/site-packages/_pytest/terminal.py": "sha256:e2fe406f930e795d09026746e8209a9a7142ac704fc0a0200af9e4f74d2104d0",
+    ".venv/lib/python3.12/site-packages/_pytest/unittest.py": "sha256:945e76cdc3ea6fddf5168582582ed88bbf240160010d192a6fad156692351e5e",
+    ".venv/lib/python3.12/site-packages/_pytest/capture.py": "sha256:92e96e989751747bbbce8a2c3abe257c747471ee8bb0eb616aef41cabc3cc55e",
+    ".venv/lib/python3.12/site-packages/_pytest/reports.py": "sha256:2e9272a67cde38b925eba24a288b2ef77f741c0daa22da6fbce53ee6e58fa41d",
+    ".venv/lib/python3.12/site-packages/_pytest/outcomes.py": "sha256:a9b8074421110d12bc5bc6407da9d07f80e9e3f5bbbcda1cdafbf7a66dc7b4aa",
+    ".venv/lib/python3.12/site-packages/_pytest/logging.py": "sha256:4d9ebb2503ffdd896dd29d750f627af0bfe8b3d825b2e82032f79cd07963b5bf",
+    ".venv/lib/python3.12/site-packages/_pytest/tracemalloc.py": "sha256:942501fd85006fa475beaabf6fe2d26125f2f9389d6e7da6eed7f3996014ae39",
+    ".venv/lib/python3.12/site-packages/_pytest/tmpdir.py": "sha256:b25a80db25476cfd9d58e7c80e8962ac9e39ca628369a1db789a9c81a2261dd9",
+    ".venv/lib/python3.12/site-packages/_pytest/setupplan.py": "sha256:97ec9c14dc4364fc98e76c21e1fef26aa87367b496d628d22a740b9aacc36560",
+    ".venv/lib/python3.12/site-packages/_pytest/nodes.py": "sha256:693b0385b2c45646767200bc517416e776c10c3e58ee5ed937007491be4d868e",
+    ".venv/lib/python3.12/site-packages/_pytest/python.py": "sha256:fd28318a23e7afb8cf81794ab3cb028ddb0148df80a14666cc8bc9320324561e",
+    ".venv/lib/python3.12/site-packages/_pytest/pytester_assertions.py": "sha256:c57fc76c53c1f91cff34d0edb53637f5fb7bff064bbcf81040155ebd209e5660",
+    ".venv/lib/python3.12/site-packages/_pytest/pastebin.py": "sha256:a7ddb326d48dcfdfb10c4173a90df37a662081745a0e7c43e97e08ca2b5ebdb0",
+    ".venv/lib/python3.12/site-packages/_pytest/fixtures.py": "sha256:eff80aa15502a5fa38b022f2dd3d3ba760efff16b9c761e7283299bbcf380de6",
+    ".venv/lib/python3.12/site-packages/_pytest/warning_types.py": "sha256:566ea71b4b0f502c82dcc06a1c7ae86570e5914f95be2d104c941a68caf21890",
+    ".venv/lib/python3.12/site-packages/_pytest/scope.py": "sha256:a41ee3b228acb61d7a3c115a715d58c5ddcf8f7600c767669529866c6e26c3a0",
+    ".venv/lib/python3.12/site-packages/_pytest/stepwise.py": "sha256:903f350eb9e19dc94a06631f6aec1099b78c6d852fbb0d3bc395a73649887444",
+    ".venv/lib/python3.12/site-packages/_pytest/doctest.py": "sha256:1a08dd58ec47f9f57d790a1643ba6e29e8dc15d0351cfb46f98eea6e9fb92fc7",
+    ".venv/lib/python3.12/site-packages/_pytest/hookspec.py": "sha256:10492386fded5ac217ccf4be2f2bd7b05c7999aaf700c9b83ce04278f20708c4",
+    ".venv/lib/python3.12/site-packages/_pytest/freeze_support.py": "sha256:5fde08c62a6a79b780fc7833261f1d6e3a869ebb44405b8c202e612bb486597c",
+    ".venv/lib/python3.12/site-packages/_pytest/__init__.py": "sha256:e087512619d6e571b62a568990ec67e7f4c2f56790e6d5c3485eed6dbe2f12ca",
+    ".venv/lib/python3.12/site-packages/_pytest/terminalprogress.py": "sha256:fc83b7bd1195013cf746491a72a200682502e3e46ada94c400d50063ae9d1304",
+    ".venv/lib/python3.12/site-packages/_pytest/monkeypatch.py": "sha256:597dffe9ccd42e1bdcdf0485fb437c55eb1bbfdc0637777096261c0ef4fc11fb",
+    ".venv/lib/python3.12/site-packages/_pytest/junitxml.py": "sha256:d71198950cf33bd1c7dc782167986ee130427fc57e221046e6455dc7a5b63d5a",
+    ".venv/lib/python3.12/site-packages/_pytest/pytester.py": "sha256:c746a6f5b5c7cf740f0533d73f295c6267cff2c1a1562e510bf28f8fa8371e7e",
+    ".venv/lib/python3.12/site-packages/_pytest/threadexception.py": "sha256:85371ca73654aeb4240d1395140a87817c00538f3571ae0cab8080e1807b9b2e",
+    ".venv/lib/python3.12/site-packages/_pytest/main.py": "sha256:7ca2b20cc41fbfc2761bcb231eecb26967d553651035c40000f44d70e174b693",
+    ".venv/lib/python3.12/site-packages/_pytest/legacypath.py": "sha256:fe5eaff1a90d31f4dce53023bdb73a33efedd79ee9f5013afb5d7c58cd0346df",
+    ".venv/lib/python3.12/site-packages/_pytest/debugging.py": "sha256:26457b39bef0439dd3146910d136bdea300c606b9b81d5e212cdfd4fb14fcc74",
+    ".venv/lib/python3.12/site-packages/_pytest/subtests.py": "sha256:f8eccea44d23f7cbc358c02c23ec4c27415c61bea29cbaba60f1ffd2d132538e",
+    ".venv/lib/python3.12/site-packages/certifi/__main__.py": "sha256:c410688fdd394d45812d118034e71fee88ba7beddd30fe1c1281bd3b232cd758",
+    ".venv/lib/python3.12/site-packages/certifi/__init__.py": "sha256:8812585adc5118731a3b54bbde9598a459fdeb6590e257687f61a47cc4911093",
+    ".venv/lib/python3.12/site-packages/certifi/core.py": "sha256:5c55f2727746e697f7edac9e17c377d8752e0da7ecca191531b3b80403d61dad",
+    ".venv/lib/python3.12/site-packages/httpcore/_exceptions.py": "sha256:968a022a06b7fd8558bb7b3e7772fd44c3d127286c63b7e2bae1b1be4383d1cd",
+    ".venv/lib/python3.12/site-packages/httpcore/_trace.py": "sha256:724e99a08cd84e474d0087eae4c19e2aa0570edaa3397faa7d8c266456eb19ca",
+    ".venv/lib/python3.12/site-packages/httpcore/_utils.py": "sha256:fd12e05d8380602df9d229002d5e7d199ebc209adda1c459c4fb3d3e39b37456",
+    ".venv/lib/python3.12/site-packages/httpcore/_api.py": "sha256:ba7666783b1c8415821823c2c244b75a8b7d7ae2ba6e0fe42b12ed193c70db5e",
+    ".venv/lib/python3.12/site-packages/httpcore/_ssl.py": "sha256:b2baa648d53888e52f585f92ac9bdbf06fd811b1c510b39740ec1d0c80534bd7",
+    ".venv/lib/python3.12/site-packages/httpcore/_models.py": "sha256:20ed8271771da68bd170b4dd185181e91c8165d126da1fd33a6a02738ac42a1a",
+    ".venv/lib/python3.12/site-packages/httpcore/_synchronization.py": "sha256:cd28b5de6002a250679278d90649d40ba84a343413e02ea28e77b367eaf44f6b",
+    ".venv/lib/python3.12/site-packages/httpcore/__init__.py": "sha256:f644ff92a0a10822544c7c30db866647f7b371d6e94585a4b03fa060dce464ff",
+    ".venv/lib/python3.12/site-packages/mdurl/_parse.py": "sha256:7b365290cdbfe0d436671d38eec11d7091bb3584111478992bb63c20d1c5cf06",
+    ".venv/lib/python3.12/site-packages/mdurl/_url.py": "sha256:e6442745037603f1b8b2f2e747365c1b46dfa03f406c1ad80d7a2eb031d9df3d",
+    ".venv/lib/python3.12/site-packages/mdurl/_encode.py": "sha256:82824b505b75878ad564daaa9bdb75e4dc365be6c55d8404cb7691d352265afb",
+    ".venv/lib/python3.12/site-packages/mdurl/_decode.py": "sha256:dd0fe00d0a94fff4ef0dbbbbc7e6fd2e36d5978416cb983fa85c258dcbaf37f6",
+    ".venv/lib/python3.12/site-packages/mdurl/_format.py": "sha256:c5972dd2675e3d70341f7900ab18c6b650793bce86df90c060c1a4038e02981e",
+    ".venv/lib/python3.12/site-packages/mdurl/__init__.py": "sha256:d6fa44f3d3725e7888459342ff87fa04f9b751be1b3e7b637f2ca12d147ba295",
+    ".venv/lib/python3.12/site-packages/pluggy/_callers.py": "sha256:804665946692615b2c676526a4d7e6602d1b755821da361b0057982afb913236",
+    ".venv/lib/python3.12/site-packages/pluggy/_version.py": "sha256:e45189369f4b924f6e3b17828d7a68086045efd02be8b18f391efe6ad06a6ffe",
+    ".venv/lib/python3.12/site-packages/pluggy/_manager.py": "sha256:2b8229fe99048ef4f6a0e21f40fa7c0b0016a1756710d81045ccbdb651a28b4a",
+    ".venv/lib/python3.12/site-packages/pluggy/_warnings.py": "sha256:b5dd00bd90697da9ab8820b73aab0bc31321f92cc03237e399ce7c4f9bcfde5c",
+    ".venv/lib/python3.12/site-packages/pluggy/_hooks.py": "sha256:13a7f79d8708e9d6c4b8ed069b2eb5a3380653fe7dfdeebd902d3c6b4e8406ea",
+    ".venv/lib/python3.12/site-packages/pluggy/__init__.py": "sha256:0fa769d609840e3b43a7c840c1073eaab81aba59cbe2296daea90b0ddfa0f6d8",
+    ".venv/lib/python3.12/site-packages/pluggy/_result.py": "sha256:dd77f2ec3ae35db61bee9b91aaec98d956e274858daba3e9ed09ee12531d8fc4",
+    ".venv/lib/python3.12/site-packages/pluggy/_tracing.py": "sha256:9d777604298381ff2327157e1cedcfab147e595e777969c5f01e001759c91a0a",
+    ".venv/lib/python3.12/site-packages/click/decorators.py": "sha256:e4feda6e126d010629fca1e08d4be132fe3ae044703b3aefd9e9cd9279701f24",
+    ".venv/lib/python3.12/site-packages/click/_textwrap.py": "sha256:04e69ed1143abe0dc590d8122723a81b31b599e18cc49fee9165592b1feffb4a",
+    ".venv/lib/python3.12/site-packages/click/_compat.py": "sha256:bf7c4166415bbc0d415cf46415f04973afa92303c8ef7e399be910127a5502ce",
+    ".venv/lib/python3.12/site-packages/click/types.py": "sha256:7a4e7804d485c0f2acaad7d3ee3b2a71ce161ee8bc00815530a338a156485e17",
+    ".venv/lib/python3.12/site-packages/click/exceptions.py": "sha256:f2eb5ff30e95e612573273bf89cd4536bb5bc2e127d4d52ed5a0f057c52a9c6e",
+    ".venv/lib/python3.12/site-packages/click/_utils.py": "sha256:919c2d4dfe6032e0a294925c792da24c2bd1bc263ed1a379ac9abc80ac3ba7c8",
+    ".venv/lib/python3.12/site-packages/click/shell_completion.py": "sha256:09ce0641416e5a97d005af6c179a9779e608ee7ded23fd64e997529f80596d3d",
+    ".venv/lib/python3.12/site-packages/click/_termui_impl.py": "sha256:4776988cf0f6c75c6035789712a1d247e8c05616d72a42ca7aa82bfb87833a40",
+    ".venv/lib/python3.12/site-packages/click/parser.py": "sha256:437d691f416541912af945c4fc0051ce5ca011fbf13d3b996d6361e317d79b3c",
+    ".venv/lib/python3.12/site-packages/click/utils.py": "sha256:bdea7aaaa324bf75a4cc0f4e0aeedfe8abbeddb7991cda68f2a26a2febb3524f",
+    ".venv/lib/python3.12/site-packages/click/testing.py": "sha256:3d82d85b86630803fa1d15ad361169af78a627141510f16adc45b724bd0b4df0",
+    ".venv/lib/python3.12/site-packages/click/formatting.py": "sha256:4557f0c2bd2bc16369806afc35a1e874fce422beffb54c9587f9c375a9cb30d7",
+    ".venv/lib/python3.12/site-packages/click/__init__.py": "sha256:b6ae68969d2556e50d6f03a3d29e6731576a84ec98cf8699cc5f12e53d1a14c5",
+    ".venv/lib/python3.12/site-packages/click/globals.py": "sha256:80cf8d87a0383341c1fd2824685e4ce2770618c0c773f7e51d7bbdfe88781845",
+    ".venv/lib/python3.12/site-packages/click/_winconsole.py": "sha256:fefc54b946b1c01868474bd458236e1d8f1551e7e231d088c94d925cfaa817e0",
+    ".venv/lib/python3.12/site-packages/click/termui.py": "sha256:d318d4684649cf5ff5cbc7aaa27da439ed8e5eb987cd9089a15a2115be37c93b",
+    ".venv/lib/python3.12/site-packages/click/core.py": "sha256:c330e91f85a1e398417ec770dc11ea9ffd3de78e7b591adbf7677269e2069079",
+    ".venv/lib/python3.12/site-packages/yaml/composer.py": "sha256:fcaa37d16afa783594794a5ab94193dcb720f503c19ce3d59539c8311189f453",
+    ".venv/lib/python3.12/site-packages/yaml/emitter.py": "sha256:8e086d694ede170837d5b1b407b45979aff6f40762f422a65eafd08e04290a44",
+    ".venv/lib/python3.12/site-packages/yaml/serializer.py": "sha256:0a1b85826854d35863e31808f0668abfabdf33606e8f06bd8bb7761401e3edc0",
+    ".venv/lib/python3.12/site-packages/yaml/dumper.py": "sha256:3cb72d66563064ba7b5e679477046ebf89d8399d940670c8532f3e94a7cb17ea",
+    ".venv/lib/python3.12/site-packages/yaml/cyaml.py": "sha256:e99ac01bd7c062f7557b614aff0d21997a06ed962ca185306a91bc0a20bbd87d",
+    ".venv/lib/python3.12/site-packages/yaml/loader.py": "sha256:5156becc8aa6905482218abf3e04869b835226db4763645fff3438fdbd5f1cdd",
+    ".venv/lib/python3.12/site-packages/yaml/events.py": "sha256:e74fd392c810884e2ea7e94aa3f57e9c1cbeb402319083d0c58e6a0e1282787c",
+    ".venv/lib/python3.12/site-packages/yaml/nodes.py": "sha256:80f28d8fca4a09d87677882bde021820d9cf39a3b11a12405226211919cf13ce",
+    ".venv/lib/python3.12/site-packages/yaml/parser.py": "sha256:8a55a9e6fbe0a07146cef3990c8b45a068c3e83e369e1959ad9ca30306b4a09a",
+    ".venv/lib/python3.12/site-packages/yaml/representer.py": "sha256:22e58ff9c016f6c1ca1274b4802a926bcf78935060e1c813c5a0f021c6d143e6",
+    ".venv/lib/python3.12/site-packages/yaml/reader.py": "sha256:d1d9b38ab3a20c6e17a38d519ee412ecaf6b918df18c78956ac7c330d4ea08dc",
+    ".venv/lib/python3.12/site-packages/yaml/constructor.py": "sha256:90d8247da78b524c10618fd0e857f54f3d97570fe91b5c5513d024ef3faf88b0",
+    ".venv/lib/python3.12/site-packages/yaml/error.py": "sha256:021f73fada072546c4f63f8cf18a7181244ce4280b09cc15cc980b2d1176171a",
+    ".venv/lib/python3.12/site-packages/yaml/scanner.py": "sha256:60433788b652690c17710460da5d91e0c753d3318fd85f5e1e42862a71f25906",
+    ".venv/lib/python3.12/site-packages/yaml/tokens.py": "sha256:953408cd2570f0c83dc2fe39f7e4e388e41eeb05738aa69196a5f6ffcf6ba79e",
+    ".venv/lib/python3.12/site-packages/yaml/__init__.py": "sha256:b19dfcc333d6a75dfd73073901164507252f271b41d3b5f7d85510033a0547a7",
+    ".venv/lib/python3.12/site-packages/yaml/resolver.py": "sha256:f4bf9561f9b89961f1503d558385fbae30d12bfed565de9bf76c33abb63620a6",
+    ".venv/lib/python3.12/site-packages/h11/_state.py": "sha256:ff92c6fc1191f0509c1507813c7f93307826ffe07e1147160a74287fff578c51",
+    ".venv/lib/python3.12/site-packages/h11/_version.py": "sha256:1954ac6cf48f0dc3ae17aa6d7c88979d52686849b7ca05db327aa5aff1a26a1c",
+    ".venv/lib/python3.12/site-packages/h11/_writers.py": "sha256:a052a6e8fb637877db8f844b5fb541eca0dcd60218e778171b7fc747d96d9930",
+    ".venv/lib/python3.12/site-packages/h11/_abnf.py": "sha256:c9b8b1af4c6cba99e403a18503232e6ee5c5e9373595bfe117cf743600ac7cd7",
+    ".venv/lib/python3.12/site-packages/h11/_receivebuffer.py": "sha256:c6bb29b1db0d81617145f41c4d7c51f11add8d15d74cad08a39710616a49d56b",
+    ".venv/lib/python3.12/site-packages/h11/_connection.py": "sha256:93d61155fea4a19a9bb6d056dfac5259a26959d6706bec50554f401c4a3d0ee2",
+    ".venv/lib/python3.12/site-packages/h11/_headers.py": "sha256:3fb0fe9413711f074b64f2e29a6630acf1bef59923125bef25925d6408123fee",
+    ".venv/lib/python3.12/site-packages/h11/_util.py": "sha256:2d69248d7c89685940cba2eddfdc3bdd44ad925153e68bdcbe8d13918ed162e9",
+    ".venv/lib/python3.12/site-packages/h11/__init__.py": "sha256:88ed4ace448ee36c99e9f7e0f953206f1fd9553586518d349d16045a7facde46",
+    ".venv/lib/python3.12/site-packages/h11/_readers.py": "sha256:6b8472a4e454082dddd2afe4c4fb8120cee34c3f222ede57f754c7d05b1db8de",
+    ".venv/lib/python3.12/site-packages/h11/_events.py": "sha256:23deda5e86a5d56bbb7642f9e3c04034150290e21b7bec790a2a1803d201635e",
+    ".venv/lib/python3.12/site-packages/httpx/_decoders.py": "sha256:a74757f08d0d1077b1b37506a784ac66eb62321b17aeb5a5ebe1a7a956f488a3",
+    ".venv/lib/python3.12/site-packages/httpx/_exceptions.py": "sha256:6f15bb7f1ce054c01d3536f04f4567ab4e202435b5fe023f1858903ee3328cbd",
+    ".venv/lib/python3.12/site-packages/httpx/_status_codes.py": "sha256:0d89fedae7c180c797cb9b3cc77fd307bc2302e00031ec136a43eb9b9ad712c7",
+    ".venv/lib/python3.12/site-packages/httpx/_utils.py": "sha256:fd355ea802afc4990a1ddcfb74579be2cd0b66a41781e1645d281f88704aff5a",
+    ".venv/lib/python3.12/site-packages/httpx/_multipart.py": "sha256:28e1c465997aa28860f663da2b2caedf8e6aab5ac92e0df94d41b7600cd70776",
+    ".venv/lib/python3.12/site-packages/httpx/_client.py": "sha256:c43f941baefe58c91e96d00039e1868fe719d91453026d7db1647194563bff8d",
+    ".venv/lib/python3.12/site-packages/httpx/_auth.py": "sha256:62bdd0c1a5122b5eeb198c7eee3f85762705233cf863d14557ed45e3eed15d7e",
+    ".venv/lib/python3.12/site-packages/httpx/_api.py": "sha256:aff660b388c8a5c3c92ea2b975b6d26b2aa8fe254c2856b164277ea0e1f12c4b",
+    ".venv/lib/python3.12/site-packages/httpx/_config.py": "sha256:a4fa7653ec2271f70ab05f8a6111352d876dddee84446788a1767c1a3a372d67",
+    ".venv/lib/python3.12/site-packages/httpx/__version__.py": "sha256:2e853261e3974e2786cee3ffeb850bd30c5db718eebbf41b3af13b34e83e22a5",
+    ".venv/lib/python3.12/site-packages/httpx/_models.py": "sha256:e3ffc6bb2bf580bc6e6428708a6f247d036220e709f5a72b785392babbd97e6b",
+    ".venv/lib/python3.12/site-packages/httpx/_urls.py": "sha256:757f7d551d4348e1e9828f40abb3f360ee0529dc6a2a3c32369f20adff1d1cdd",
+    ".venv/lib/python3.12/site-packages/httpx/_main.py": "sha256:0a0f4631a6e24d3fecc1a0df5202118ad4b0c4b44c4b05033a6ecb7521aa940e",
+    ".venv/lib/python3.12/site-packages/httpx/__init__.py": "sha256:0ac6997bac998f4ac783adf6d8058a587193315afdb718047c3e4fdff46bcfad",
+    ".venv/lib/python3.12/site-packages/httpx/_content.py": "sha256:2c61b3ac94d1dcebcde0c6f519554d2d7917247fbaa0a97002db4ef69e70ff28",
+    ".venv/lib/python3.12/site-packages/httpx/_types.py": "sha256:272878d4642aec039ebfc20e58a0c083bcc26ef1c07ee7e65b983f3e24ed12b6",
+    ".venv/lib/python3.12/site-packages/httpx/_urlparse.py": "sha256:640987e3b38d7e4c6bae3f8f3d88467a21e36fa0232824be00d58837838bfca6",
+    ".venv/lib/python3.12/site-packages/packaging/_manylinux.py": "sha256:1dfea707470eadac84b3debea77a085c08069c5aaebf6d033b997ea36fd79efd",
+    ".venv/lib/python3.12/site-packages/packaging/metadata.py": "sha256:72b021d04dc654656a3e5bba11d445b1a1be63a518ce74d4aa3b8629118fbfa7",
+    ".venv/lib/python3.12/site-packages/packaging/errors.py": "sha256:ea17c461701ff2ffc817ae7e94569d24e30889e04fdb120ab721178c6d67188b",
+    ".venv/lib/python3.12/site-packages/packaging/_structures.py": "sha256:eb48d16c5efca7ccf930a9cd77a700a6b80e69d0891d5d03966526441a8565cb",
+    ".venv/lib/python3.12/site-packages/packaging/dependency_groups.py": "sha256:5d92005452bdb871b84421a9ae6267dd522751631eb3185afe4cad26e30ef5e6",
+    ".venv/lib/python3.12/site-packages/packaging/_tokenizer.py": "sha256:b455365abf996497406e45cb109a3ba9440325a2247dfb7d0ea6a27e210d0fb0",
+    ".venv/lib/python3.12/site-packages/packaging/markers.py": "sha256:f1f0c8521005e9832708d0791528b087da4422eb22173005ef727ed0e07c6d39",
+    ".venv/lib/python3.12/site-packages/packaging/version.py": "sha256:635693b717b7b27db138c6b905d23ce7e01c1eec9b6da9ce56412fbd24510bc2",
+    ".venv/lib/python3.12/site-packages/packaging/pylock.py": "sha256:1bfd609dc4e60db44b6358e8e150c8f54c3e6f9204ae1fd0f55fc16d5253983f",
+    ".venv/lib/python3.12/site-packages/packaging/_parser.py": "sha256:29fda7b03c38739e17f36a58f1b6b8174d81bdee8eca018c0232fe05e82a71ec",
+    ".venv/lib/python3.12/site-packages/packaging/specifiers.py": "sha256:31fa7c6af420d25568b75eeda3d955281b590f516c5814c8b681b0154677c2d8",
+    ".venv/lib/python3.12/site-packages/packaging/utils.py": "sha256:33bf8930a89cdac3f562d57ff1a5bb795181fb1dc00ee282892aec55e09dd94a",
+    ".venv/lib/python3.12/site-packages/packaging/_elffile.py": "sha256:fac2a4a6d62acd8c36fb1dd007225ae66078adf3d6bb5a719191d1c755801426",
+    ".venv/lib/python3.12/site-packages/packaging/__init__.py": "sha256:42130474fbb65e882b2735774b42964bab7b97423d93c11e0d1265e1f9f0f3bb",
+    ".venv/lib/python3.12/site-packages/packaging/requirements.py": "sha256:75dd5cf5a6b5829e4d23a6ed17a5054508cf9f59f14179c4fd3df8c830d31297",
+    ".venv/lib/python3.12/site-packages/packaging/direct_url.py": "sha256:78a99b0e23cfd6c2d5e0c8ff902499aaa927ac8c953bd4abec9a45f0a0a3a785",
+    ".venv/lib/python3.12/site-packages/packaging/tags.py": "sha256:350d707a8ebdfd28ed7b7c4167523f1badc22200a668dd02db89b3fb3de1198a",
+    ".venv/lib/python3.12/site-packages/packaging/_musllinux.py": "sha256:67ab308c7dcc03b5d2dea5e798c37b40f86a3f77e7a18234790d7c7bdf878001",
+    ".venv/lib/python3.12/site-packages/anyio/abc/_testing.py": "sha256:b41254ce449f397270db77def2a489d3790995284e6238da132141ea4e8c613f",
+    ".venv/lib/python3.12/site-packages/anyio/abc/_eventloop.py": "sha256:dfd9589e6b6fa07699c36dac58128e4c0ff3bfb6da98e9ebf0ee3d3ea8035ddc",
+    ".venv/lib/python3.12/site-packages/anyio/abc/_tasks.py": "sha256:282ef0adc884e3c00834e23e0213eeb671617b57b07cfed09da985943cea7ac4",
+    ".venv/lib/python3.12/site-packages/anyio/abc/_sockets.py": "sha256:3a6543adf7a656f17d7392b5b6906043257a7e7e6fd17c821312c0a81386cfda",
+    ".venv/lib/python3.12/site-packages/anyio/abc/_resources.py": "sha256:0eb62f90d375847e94befe7fe6e2b24af0ec9e49c65437bc14229f928d15b4df",
+    ".venv/lib/python3.12/site-packages/anyio/abc/_subprocesses.py": "sha256:72e9803c94e4b4e42dc3adc8a86d250e9c99aaefe5d44125bd01cc8b02602f4f",
+    ".venv/lib/python3.12/site-packages/anyio/abc/__init__.py": "sha256:ea65a1725fe919786b8195473ff4c27ccbc85c83a9f66ae810533dd1f60253f5",
+    ".venv/lib/python3.12/site-packages/anyio/abc/_streams.py": "sha256:1d8be76b58996d67302d13933ba2212d7efd45344b3d28593167b4b06d6ae782",
+    ".venv/lib/python3.12/site-packages/anyio/streams/tls.py": "sha256:0d05645d4bec4c460a9013bc765554ee3ff91fc40eb4bcb8b068b55ab8ea7afa",
+    ".venv/lib/python3.12/site-packages/anyio/streams/memory.py": "sha256:174cf0cef149280857fcb4591a82b3cea0c2da830cf9ffb2c9306b11810639a5",
+    ".venv/lib/python3.12/site-packages/anyio/streams/file.py": "sha256:9ac9eba2d54a18c428994bbf463daacfd32f21d529e9ddc91abecc3843bc915e",
+    ".venv/lib/python3.12/site-packages/anyio/streams/text.py": "sha256:05c540189c35551bed22a9effa8d116f4a701fba7cbf096f976d711eae76d9a8",
+    ".venv/lib/python3.12/site-packages/anyio/streams/buffered.py": "sha256:d91dcf78985ee045eb758ab3e3863af8483d47a0eb9a5b18acfdfa22be37fa9a",
+    ".venv/lib/python3.12/site-packages/anyio/streams/stapled.py": "sha256:4fc5eac1ff0ae8481444fc5bb753788bb03c04093e81272ff864618cb5c87ffa",
+    ".venv/lib/python3.12/site-packages/anyio/streams/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    ".venv/lib/python3.12/site-packages/anyio/_backends/_trio.py": "sha256:97d53e4ec291c7399343148cbce867d1b35e167fe2471dc7a37d23bd1e4176ed",
+    ".venv/lib/python3.12/site-packages/anyio/_backends/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    ".venv/lib/python3.12/site-packages/anyio/_backends/_asyncio.py": "sha256:92eaa5836b0152c15d818f34c520c0c3ad06c7fe1634297d8922f95e563a9425",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_exceptions.py": "sha256:6376aaf96c5ded0d87ab04a0ee764fbd1b0712e19aceffea79eb7a82a10174f9",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_testing.py": "sha256:bbb30fa865f0a53c6a23b85c95274d037d33d861f5370db9f2ec0abf2fd17c18",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_eventloop.py": "sha256:73611d7015fec672b0c4f702e0f8e7dffa86f48fb1e085853b647d46a0868cce",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_contextmanagers.py": "sha256:6089c109a6e211e4be51a3ff25dc5ad426850bbd444cf5bc1d94c720cf11b1cf",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_tasks.py": "sha256:a5507b2ba000ba5cd433c6205c07aa3591b8e274b26756d82631fc1b39c2d342",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_sockets.py": "sha256:4415c7714a99b79820ffe38e7e01d5bfcbaad8548a935b955334dda63068235a",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_tempfile.py": "sha256:8c4db0e7d151177c91a38be39237d917661caac059bdceba556470ac91836069",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_fileio.py": "sha256:08a8b58053625b61b892759e044ec77bbfaba6d4308188c35167c6f034a5bcbb",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_typedattr.py": "sha256:3f8a33662927dfe0dba6861cbf28214bf14e60081b994c5ea14f3e2ffd3ba593",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_resources.py": "sha256:35b994e4ee545f7c44c800a7926617dbc166c1d97e7fe9f2d2d1f29b6e9ed30d",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_synchronization.py": "sha256:f46ddfbd1b0f36bad627f67a803ffcd305eaf08f2a800ca1c0cf0fbc74274f67",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_subprocesses.py": "sha256:b649a43ca12411a88c0fc0bd59164196682339844345b65db5ee9efae9dacb61",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_asyncio_selector_thread.py": "sha256:d8f77114cddcb34d8aa7a052a696ef9914fbabb6acade4d6e45801c44b1f941a",
+    ".venv/lib/python3.12/site-packages/anyio/_core/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_signals.py": "sha256:9a34c107685328d3d1954d088678a379079da563861110e23234a5250b05aee8",
+    ".venv/lib/python3.12/site-packages/anyio/_core/_streams.py": "sha256:15ccc5c08803a6790ad1b3835895cca6c50961dbc00f4e24694686cc953c0cad",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/pangomarkup.py": "sha256:2f88d4ea83b5f14a8432a5de3791643ed922b17ad7b97abdc1c79c832ffa773a",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/other.py": "sha256:1eaeaa6383ce059fe5940591af583348ef54a1e60f38d94b3012bad11916e1b8",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/img.py": "sha256:e35b92634a4a83d56628962b1ee6af095820d33fa683cd69dbc404324b707f5a",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/rtf.py": "sha256:610616f0d4eb0785df3a32db433badc83e23df94e2985359d13dfd7444fd0cea",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/terminal.py": "sha256:abb8cb2da9e57b7dde099903af80a81c037e7470457f50c1862e0570143cff51",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/svg.py": "sha256:a24b174fe6674c70ec9f55ad5a006cf55eea98a16cc002b1ee3577eed6f6b586",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/bbcode.py": "sha256:96f1b5444649bf4a4ce9531ef90c0b4aea34625d516bf5f9d7087dddf5bc0369",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/html.py": "sha256:a9ee0feaa215e3ad87919a2f4bcb39c4a2b26173d042f523cfa5a3ec75f50b16",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/__init__.py": "sha256:a8f1b8ab972e69944606096610954b3f8483bf8dd0237b4052c923df433e98e6",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/terminal256.py": "sha256:3e903fa004c70a28775138eb6df2aa21151cbecca9fd3781686c379292317810",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/irc.py": "sha256:85d3aa02f174d9b23c098f3fb6eb67529b4166958404bcd502a4b8fd8034b5ec",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/_mapping.py": "sha256:d42c37ec5b9094d69c9f144a9ad94f5f89f22e85fdfedb64a39670b1c354659e",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/groff.py": "sha256:6a71777cd6c3630c0e969a4e528293660e05cf33db66b1388dc24231de3dff58",
+    ".venv/lib/python3.12/site-packages/pygments/formatters/latex.py": "sha256:710984d4d8f813dab93745d0241aa973a74bb6ee5434eb58ab7a653f2097d479",
+    ".venv/lib/python3.12/site-packages/pygments/filters/__init__.py": "sha256:d37658748626c6758287b80d5c3ee5110f3af437f89331e7386338e222716a7f",
+    ".venv/lib/python3.12/site-packages/pygments/styles/igor.py": "sha256:40efcce7e675c48c559eeb045382d9af8553fbe9d311156df9ca5f6e73afe329",
+    ".venv/lib/python3.12/site-packages/pygments/styles/dracula.py": "sha256:1fe10cd5633723177638163d6f3a0e6ca978233766862adf0d515b27d5ac8b44",
+    ".venv/lib/python3.12/site-packages/pygments/styles/staroffice.py": "sha256:a5e13190806a3e4461a971695bdf67e3db7aa4cc1e848fe90d8554990c2481d0",
+    ".venv/lib/python3.12/site-packages/pygments/styles/tango.py": "sha256:01fd16553c691ff714747affb9aebd2438a34cb239686d519814c5ee8d8a4e09",
+    ".venv/lib/python3.12/site-packages/pygments/styles/bw.py": "sha256:7b8168e8ac9ac7669186a2ac8ecaaf8b6096ea5914f509e32a83eb1126408fe2",
+    ".venv/lib/python3.12/site-packages/pygments/styles/native.py": "sha256:a1acc42546ee687aaa399479bf1fa32214cf230edd0ba4199cac56fb12ebedfb",
+    ".venv/lib/python3.12/site-packages/pygments/styles/zenburn.py": "sha256:031ee205b333bd540d4e94f761d33008490bfa72179e9afad1a56b4782e96baa",
+    ".venv/lib/python3.12/site-packages/pygments/styles/rainbow_dash.py": "sha256:60fd873d55c92e63b2f18cfca7cbb919b900cae2b12e5366bba21364131ad4c7",
+    ".venv/lib/python3.12/site-packages/pygments/styles/gh_dark.py": "sha256:c9be04381018b10f60e481843aac99e4b288f8c51bc33df697d581e4470c2da0",
+    ".venv/lib/python3.12/site-packages/pygments/styles/default.py": "sha256:5852c3b9c2894bf69ce49aaeb668256f3e084dce234d34043a7a8b20ca52b6d0",
+    ".venv/lib/python3.12/site-packages/pygments/styles/fruity.py": "sha256:9ab3438b1a77f502288ad441a3ec8c3abf2d9d82c0c06774108330d80e8677c8",
+    ".venv/lib/python3.12/site-packages/pygments/styles/abap.py": "sha256:4fb01dd76d4a8f3f196eea61ca1ba550bc17caf5ee6d24ba0b3734303385889f",
+    ".venv/lib/python3.12/site-packages/pygments/styles/sas.py": "sha256:111f898d9814db01095a4e4ad3a8870053e35580f588c92f8e3134ae534eb766",
+    ".venv/lib/python3.12/site-packages/pygments/styles/lightbulb.py": "sha256:0a70efd661755f99359ac56f452fdd891e2d929d3a13f8e0d2d2bd71d1c41424",
+    ".venv/lib/python3.12/site-packages/pygments/styles/paraiso_dark.py": "sha256:af1e7f8f8827651cb68fede10211665a99e39ddf957f3dd9edf7301174541a6d",
+    ".venv/lib/python3.12/site-packages/pygments/styles/lovelace.py": "sha256:bd9f92f6d4be4143b07c0d111d8061493444de1d5953e6d99ee316eceea4b32c",
+    ".venv/lib/python3.12/site-packages/pygments/styles/vim.py": "sha256:756a82542d984f8e5d2d2a4c4f02c13e4298811b13d7e7057fb647a1cd8f4290",
+    ".venv/lib/python3.12/site-packages/pygments/styles/onedark.py": "sha256:517acccd5bc0f4e54fece84243980bd02699ae4e63a3f23ce07266ecb10de464",
+    ".venv/lib/python3.12/site-packages/pygments/styles/stata_light.py": "sha256:616ee2878b5e5e812e50722638adab192095c5f9e3e37b6570a3d752cac39118",
+    ".venv/lib/python3.12/site-packages/pygments/styles/algol.py": "sha256:eafe995cbc4f26c9bfd6a3ea3aee62840b9685593ae3835d3d73dc66a88e4d32",
+    ".venv/lib/python3.12/site-packages/pygments/styles/vs.py": "sha256:ec725e861b621c4e6789b8c2debdd7f9a607066e4171c2f7dcb80eff86a71225",
+    ".venv/lib/python3.12/site-packages/pygments/styles/borland.py": "sha256:57ca930fc4ab4b4c0ba21a76b9d222ae58a36c77cfa08956664629ab149d912c",
+    ".venv/lib/python3.12/site-packages/pygments/styles/inkpot.py": "sha256:6c9bcd5a292a9c058b8f1d801f8b7fb56e234744ecad4c951571553c07ce8243",
+    ".venv/lib/python3.12/site-packages/pygments/styles/arduino.py": "sha256:a051798237db40d06280ac45842ee08942075a5d22782b2186c9bd531088cea8",
+    ".venv/lib/python3.12/site-packages/pygments/styles/stata_dark.py": "sha256:37a8a65b292a1e84f976b3a7fac551533b7501930a1b71c753e43b2cacf6779d",
+    ".venv/lib/python3.12/site-packages/pygments/styles/friendly_grayscale.py": "sha256:7a5d84f34e03124299e80a57b77379153987024221aa4263fa89a113513c99d1",
+    ".venv/lib/python3.12/site-packages/pygments/styles/solarized.py": "sha256:55db4b62143bc438ff8931cffc492beab01d31c1377d14ab8259e05526a5eb73",
+    ".venv/lib/python3.12/site-packages/pygments/styles/trac.py": "sha256:fa1e6253e2e34a6b7e750ef2e635f02792d0f40051e500f94653d18e19f39aff",
+    ".venv/lib/python3.12/site-packages/pygments/styles/monokai.py": "sha256:dc2c09266fd854689bcc58bc9e12bf6f977870dce057ccfe2fa4730b551503b4",
+    ".venv/lib/python3.12/site-packages/pygments/styles/nord.py": "sha256:b7b7d98f4e0b520b0b687a62a3ae85a8e18c29bedad950b7b5e5259889cf7d18",
+    ".venv/lib/python3.12/site-packages/pygments/styles/perldoc.py": "sha256:f9ed53e1004440d13f975ed1616f96068c0da6b836b8bfe11638520dc68c8833",
+    ".venv/lib/python3.12/site-packages/pygments/styles/paraiso_light.py": "sha256:8844636d845e9aa82c8acbfff538da9c18a0e1b27ffbcd31473e41e69ba131cd",
+    ".venv/lib/python3.12/site-packages/pygments/styles/emacs.py": "sha256:8846163e042b0d093845d0dff3e83b8f89ada05473a36c5c2af644d72b3d9895",
+    ".venv/lib/python3.12/site-packages/pygments/styles/coffee.py": "sha256:d23c5d72d08429b47502acc0e7d7c540ae2c541744aeb464182527e9f3c5e2c8",
+    ".venv/lib/python3.12/site-packages/pygments/styles/pastie.py": "sha256:9a729e6c5889d9da3d03fc133eae2d2ad830f9342aa5bd253f790d6de990dada",
+    ".venv/lib/python3.12/site-packages/pygments/styles/material.py": "sha256:7b2c80689829d459e3978fbf0f7f7f975c07e425b85b455649c4374348ed0205",
+    ".venv/lib/python3.12/site-packages/pygments/styles/xcode.py": "sha256:1e607a68f931be6a38cdae438a384b6f90174b2bfa51b5a7c0e5284543416990",
+    ".venv/lib/python3.12/site-packages/pygments/styles/manni.py": "sha256:769b090b565e7acd1ef487168aba96b92cd0c700f48c86e3845aae336ddd9963",
+    ".venv/lib/python3.12/site-packages/pygments/styles/__init__.py": "sha256:daf8062a76f2b749dffc248312d3211f1a693d200faf68da7f39791625c5b86b",
+    ".venv/lib/python3.12/site-packages/pygments/styles/friendly.py": "sha256:4b8dd731ccd6e77b4a7ed99aac42f8fa74eba0f55d37a93c7db36b20dcd1fd05",
+    ".venv/lib/python3.12/site-packages/pygments/styles/algol_nu.py": "sha256:e7cd4b7f975bdf4de0ef30dbef3f9596f1a514da5b5cc225027ad1071b631adb",
+    ".venv/lib/python3.12/site-packages/pygments/styles/colorful.py": "sha256:a2991f39c8c54ed0e7f45b72ea880cee8905301e9b034891d15b537413c4f4d1",
+    ".venv/lib/python3.12/site-packages/pygments/styles/murphy.py": "sha256:1ec3ddf349ce6dbdcebf7fbbc8941b9c9af7cfd982cb3df43e39ff9e45a4318a",
+    ".venv/lib/python3.12/site-packages/pygments/styles/_mapping.py": "sha256:ea5a2f154136f6dcfa12c5775d8638860a3327bab524bedc7cedd43a58274bcc",
+    ".venv/lib/python3.12/site-packages/pygments/styles/rrt.py": "sha256:bece299d6c26308411d1e19cce9d3a0186b3b18891d0a15c462454cd27f7ad77",
+    ".venv/lib/python3.12/site-packages/pygments/styles/gruvbox.py": "sha256:fd066d46af72d6cdcd6000c7a9e93e0d710b42ab9e3a75435ef589ff56931a0a",
+    ".venv/lib/python3.12/site-packages/pygments/styles/lilypond.py": "sha256:8120a26b33cf59f47ff7e055e416077bafb6812a2be2f3879f3de7c85408d900",
+    ".venv/lib/python3.12/site-packages/pygments/styles/autumn.py": "sha256:3fd217e6eb630ef74981ebccd24346c04fb0bd5cac461d6580c9233b57610c31",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/tls.py": "sha256:199d65bd9f0f524d7e2d386ad4aba2a9212732a255aa21e8fc0fb5e9a2ae24e7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/berry.py": "sha256:bc87d3e2c06d9ba6a8eb859d364253549992d3406215d116bdbde86c15c1797f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_lua_builtins.py": "sha256:32c0d5f6c11b26780aa17499bb4c576b01af77a5e315fd76e67b9704da1f7dd5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/c_cpp.py": "sha256:d95890a0b636d98eb17735c39b0cf7d2b31c8a3ec47a636ae2fa5312c7e5eec8",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/maple.py": "sha256:3818ce0cd2e0a9a9f2c39db6084ee7f6d85972d5a2e3b52e6b684f05f8fb285e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_cocoa_builtins.py": "sha256:69beacabe8b2e4b6a913570d63297c3c95cb83a108357c7e94c45bc0445d298b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/templates.py": "sha256:9dd24c76e7b7dea43fb61b28aed02b6b57e6ffeb3330de344b96d95c12d8e78c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/igor.py": "sha256:4afe4418125e2b2d143b297af8617794179ea1602b55c30326d42d976457458a",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ml.py": "sha256:b210cf8160114f34c48460de6e557b656da3eb2644781898ab1db3db84833fb0",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/shell.py": "sha256:b22e8c027e92ee91dfc97eb9364c10763c6d2ed12ed4ce25ecada5507bf2cd6c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/roboconf.py": "sha256:97a05e2484be64051bdf3739184b9521bd1e76b4693c598a75f7c4071ef86718",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/go.py": "sha256:ca71d54adc365d42459548934b852a63ae5f2e4bdc24130dce862d48d4a5fc15",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/snobol.py": "sha256:057ff554f5198be724282625176b2db50a6b1766cb5073a2f1b961227147bfdb",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/mojo.py": "sha256:8a63a583c9900a82b08bfaecb8c8a27d9af3b00b12a93d8a7240acfcc579b951",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/hare.py": "sha256:782ad13f072cc172fe6474d6365844d40d391bdaf1cd2db4fc8a9275dbf633d6",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/devicetree.py": "sha256:4e283eb534aba661b36c6c4dda46b830c4e20b7e38ae86aff40e21a1cf68fe4c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/tal.py": "sha256:c5962686ff2606bf80de87a81647123fb9c36d7d6bdb590a3a786c2d3b4bddb1",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/cplint.py": "sha256:c0fb3f661d0e276fd451e17dfe6bbfafe5ffeb90c94963024ca3a63b28d62f3f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/wowtoc.py": "sha256:5e72d2497ee9fd1930648ce59985cef3bddde1bc97f7e03775fbf334be44a1cc",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/hexdump.py": "sha256:56f629fcd4da13ee8d52e486e0531ecf0723c5b3e7033d1f396333af76361a6e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/c_like.py": "sha256:ada7cb350a9c11b7fef7b5690ed48841949299d88c0f8a0161e12cec36720728",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/kusto.py": "sha256:a7251f58b7fd434430aaeef80f23c06d1876d2590f0cb8719c4c43d45565f19e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_vbscript_builtins.py": "sha256:4c5b72735d72be90ff3a536bac56dc08e26851891632adc47871c2a70ff324d7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_tsql_builtins.py": "sha256:330e949cc0728eed14f8e0604fc69fdc0e2eb5fad2d344e7e650e76b106d8fd7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/maxima.py": "sha256:85af9ff89cc692382002be64c6656aeffb894c27291ecb505a7b0b1d82213705",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/lisp.py": "sha256:6b9306726b6b59369e123ff952ff1830e0ebddd555eacd6fd7f48c061fc287d4",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_postgres_builtins.py": "sha256:4068369814d3860bf82dd5e3166e70aca68a9c253d0ee6e6262ea55c1ef2d8c8",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/j.py": "sha256:e7aa946ecd42ef029d67af96a4d9f11e7b4daacc56ae8aa23bb91e236ca8475a",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/usd.py": "sha256:b4ff641cf65425c13f7e53ef284b05ef04dc93816e416ef94bc10b8782182442",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/functional.py": "sha256:e26f499409dfa57c52910408acd3a86f6553c229fa84f2c0a96ba1bfd6959008",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/arrow.py": "sha256:7ba99bdc8c788cbed3306354a64f2245b272fd517b558d89d155249e5a3512f0",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_qlik_builtins.py": "sha256:dd99024838edc52c570c8f5eae28164cb49472dfdaa7f5b42ea7d98c578a4182",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/capnproto.py": "sha256:91cdeb4fde4691e426ad6d4b78fe473156fb364f2ca97916e8e26491620761b0",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/pawn.py": "sha256:69db1afbbb0fb8f93b98eee5074f1ab9a6c4a5e65d35ec15a93060e854bc9829",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/verification.py": "sha256:4084899a6cfb72661a5d9a615b9b28e0f7dd289a34add656ba3fdd7bae2669f9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_vim_builtins.py": "sha256:6c1ea474b14cdf7ba863eb00b6c46e5193a871c69ae200c0b1d160e16004b285",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/haxe.py": "sha256:fcccd02535b1d7c903f5b3ffb27881b2129bb4e643466e0e66789f68e830fda6",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/oberon.py": "sha256:b87d4590f79709f75dd0843ffbe4bc48750d69fd9d9e3890663b484fe8f1bb80",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/bqn.py": "sha256:b1ee16d973ec3624f7eb3d009bd5f9178c8d2eb42f308e57f26898e91f5210cf",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/special.py": "sha256:f20a5388b20214dc0871a866dbcda68bc36a8bfea0c1832c01f8c920cd81aba9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/int_fiction.py": "sha256:0548ef5e29548ae305f9eb971100f3419b38e639ff68bb35ede4ca71f129b6b2",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/gleam.py": "sha256:271e8b9d4a5657da668dd4982d432dd7a73751a999fafe57e8272e1215b17fef",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/praat.py": "sha256:b1f54077bcdf46c23e4dc0a8bae60c5a5714f04071030278c2487466e36c677e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/dns.py": "sha256:125cd2377204a11b3583a896327cd5215f07d31f56484175c018e6d9ad01cb11",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/gcodelexer.py": "sha256:b7c24c59a6838d66707468911b0ae9b18b5f8ca4e689bc2547238b0a2259f2ac",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/javascript.py": "sha256:9aec82559400b176e14fb207664a2a0242399b2851687cdee89300478cc82cdb",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/savi.py": "sha256:1c29658017b7af33ffefed9bd6149411b136758cf4f08cacc5ce837318f77f67",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/email.py": "sha256:34f9467362fa177296583a29dd93891a950ce8b0e7384a8a663d58246def3f63",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/boa.py": "sha256:56a605d5883f5dd0c0e6d2bf122ba8d6bafb79d881b0a513a41eb1cdafc1e5de",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/jslt.py": "sha256:50e570d49dee2be855456a26a052b68cc4bfc9eba8e62aa06be2e15d4248ebad",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_julia_builtins.py": "sha256:bbabf4c80cd98ea504363888439a8c7dcb28d6bffa111a866e3dda1f0167caa0",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/whiley.py": "sha256:302d95ee8d6cecb2282f2d0593e8bc3b2981a0dd1da4ad813e322b750c2c9d59",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/promql.py": "sha256:d387d2fd1e8705686928d7b758fa7f417808745bc9af9a7a2b14ad658c3bc875",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/factor.py": "sha256:1c152a35cc1de15a65630df449cb82f1881d8a9140622aa34605acc93d2ce314",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/other.py": "sha256:380957cecad50d4c7831adb97f21bdf14e4b681107cadf8b259d881ef3092566",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/codeql.py": "sha256:8405f9d6e59e1b9664f498574a73b13cc6b39c53a9697e199d91d9da4aeb3c69",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/comal.py": "sha256:d1f713c95e61dfaccf971a103d65867addb26988b91125e2169c7a11bb2a3f4d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/rita.py": "sha256:7c234494f8a4e9d0c867319df7a90a81d958e10aa9ff3548f3bc1a4c11cc05f8",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/procfile.py": "sha256:7e1453b6c73230c3dc3dbbf38f156d5e2c759989693bee09b9650bec36f810d2",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/graph.py": "sha256:5ff22c763c57667e69f43ab870b5f2ab0a380bc7a671803c34fe9567d65305a5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/console.py": "sha256:32b4c89170d843bd73d320dea706e93bd5b05cf4113c700500ebedfe782c7315",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/pointless.py": "sha256:80d72e861398f5c12920fc86163321d8322d341d540fc0a68dc79790344ca1d1",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/wgsl.py": "sha256:be00ed63fab8d93191bdcb324bbbe249a754f03dde1ef6ad7e808d36710fd331",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/parsers.py": "sha256:838b55bdfdfaca14ff687fdbef7ee8d28d63a288dc7fe5dc903d8774da0d6ec4",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/rego.py": "sha256:622d06e2c79c4d638bec25212cb0b327d800e922730c9a4f24d8a3de15e2c42d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/sophia.py": "sha256:3009162d8c611c935c737514cd60f75432f35516dfe8801ddaecf8abb0d8df02",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/scdoc.py": "sha256:f67eb84be6ced5d238c7ed8ace1da3ac333a804981e5823b721ea774f078f9cc",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_scilab_builtins.py": "sha256:137dd1d2692735cfb9799f5482eeeeec0bffbd4c40690a0c4ed771dcc71ecb15",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_googlesql_builtins.py": "sha256:9867ce1ae28a8d9a071c0019aba1e973af31d2a2b2731f925ffc060d27123982",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/foxpro.py": "sha256:9d5f32c844b7f50a0599336533cc65dccb5e3acbe6b7ac95d65eb1eb19d7a885",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/dylan.py": "sha256:7e2f264b29e2e1d9c63f9c7572b13a04a36a2d626ce1d0d676692eafe4db6cd7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/minecraft.py": "sha256:6c16cc6eabec5604df3bb081c5fd37a063ffa8e020af0d3a3d2cc7d5017bb71b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/gsql.py": "sha256:a734a3e4f778bed34b112fa921dc5a1b4bce553a94584f54b8e530d11ad8fa87",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/business.py": "sha256:3176289a342261a4e69d482343b2d4c63714d62da25438d97573d37aa3a50e33",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/nix.py": "sha256:33613e93ef85ee99deb8c00e69ef5a838b2b26c2a1589d5fd5f46e78ee8fb4a3",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/supercollider.py": "sha256:1feab03fab146a8b5e9ac5f1bae829ba2e8a9d4de3b487437d2ddb1addc9be1e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/algebra.py": "sha256:da24121b17d5b815c11c025dcdb6cfbeda6f44e6137f17cc8af0da824f727e1f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ambient.py": "sha256:f0d93c597e2aac877dce3ff3823241b854f8d324171b6397c45861177474d20f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/apl.py": "sha256:fa384f62c0554f87242fb0999ae90864d8bab5f68925b064dafbad95ddfbdabb",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/gdscript.py": "sha256:54d3b077b29c0d112fa0101fc3ae868f1c50ca03ec1c7d9a91dcd16cf34aaa84",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/elpi.py": "sha256:459a805737717c0fc1a819ad3078fc013c397fd7b6e1228bf9078ed7842e2a4e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/zig.py": "sha256:ab4b6ea65a511405124b6f6183f5e2447db60adbded841404f9c68ed334096b9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/lean.py": "sha256:a8ffe2c1443b3096750b9b37298056f16bbafaeb958f83c01b76b61a18e9f7d5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/thingsdb.py": "sha256:14d2a302b4b5bda74710ddd95da65d0cbaaf706e7d19b17a024e4cf1132c4cb5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/kuin.py": "sha256:9f694c8a76bc4ac9297c0d8a6cf6101705493921e0358bb5d14e69cf96226a31",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/crystal.py": "sha256:93c5f2f13a5f18a4cfbec3f55a293120b49c20b0fc897679a9c78b668a6c2d81",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_lasso_builtins.py": "sha256:60efdcfdfd39668c6ca47c42477a16402a5985b00953304906156ebb04e3af97",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ezhil.py": "sha256:b5b198b469ea64007c7df9f23dd78c3091ed29827b38072250546b47ff10a573",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/sas.py": "sha256:f6198662198aa3bae2f680a665db28105333eb3dc0c0a0f82dc4d4227e769585",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/tlb.py": "sha256:bd6b05abf32b22bce01b6abea9dce9728362bfd2a4368c38c7d79bb3dfc70300",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/pddl.py": "sha256:6bc03691e085f6a350bd56508ab8015797c7e2eddc8ebb5af3e79927cb6cc666",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/mime.py": "sha256:97906c16469ddda809e8a0e0fc81c8ea7534028d18f447308d8a183fcbd00fe8",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/bibtex.py": "sha256:b207c5a97c8dc82c5138721ef02d20adeebdaf36c00c02e7a43b536aa1df49ab",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/hdl.py": "sha256:da3617ddf45667d98067f404475587e7c4af25a39d610b743a63b1a375f624ad",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/modeling.py": "sha256:dbfb9c545cbb678ca82b1f7413df80488f6de2dd4b228790df21daae1821cfe7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/inferno.py": "sha256:72354cc8e83a8e127a9d85f7df767a29a082792d293551efe164f1c85198f138",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/graphics.py": "sha256:21eaeec6f1104755acbbe6322e90239149e2b0b0f352b93671dd315eb0c26e3c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ride.py": "sha256:d7383b90660f29121e932b996377fa395a91957cab5feb11fad1c45f533d9f3e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/prolog.py": "sha256:e18bcf65b0052d635931b661bed22e95689bd0f40b03f4c1f7782390dcb01510",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/unicon.py": "sha256:f43f868a528ea8811aa3018799dbc746386aca2811937db401102bf86fec9dec",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/mosel.py": "sha256:1c460e9998803617bd55d913a41b7b9a13e2fed3c6054915b27cd38761d57552",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/mips.py": "sha256:429801a0c3f3b24d6df747081745bf115f9067c2f08136a94be7d2212c597057",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/numbair.py": "sha256:2993b0f7a4e3ec6972f9ff45f0d03eb5d19de77488b795206e9a2466c7e7cd63",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/perl.py": "sha256:b98323e9a9993dac0b7fe2a320283d2cb539f800cacea1182aa8bb5579ef9b49",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/qvt.py": "sha256:ae94f9a03e1ac0428cb37b8109b365cd8d730b3ec055ea8cf818a42d3407a3c9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/rell.py": "sha256:d20652b48f79dda16314cc8c557fd429fc199b3577ba3dd39e5ff9176d013f1d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/chapel.py": "sha256:4af6573498a35b482b7854e80c7650d327a8e3fde78b24f1df5233ff22dcb5c9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/qlik.py": "sha256:f5be90fba8d779eada211716b6c2ac61608e94185f9a337320de3da54bcc47e2",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/css.py": "sha256:3958ec7742a7f69347ea296d4b88a48f2f679e294f942571f95019dba9f7509f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/compiled.py": "sha256:3d18a6cbb79bdb078fed7e9b12e933d496922ee4001133b7e0aee66872c66f10",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/asc.py": "sha256:0af1528bb1580d6e9ebbee6888a19cd0c377685d575590e8148e7ede61e90439",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_sql_builtins.py": "sha256:7cba61a2707ac2fe8e8adf336a7262131811a0bbd9a055b897d94d1fe3d362fc",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ncl.py": "sha256:4595e4c4e2be887b292d7fec1554f4c1ce47eaffa96b890a8213fbf5f24640f4",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/clean.py": "sha256:fe85774db9aba65dd2d6984f312ea0c8c5b21991a3e96cb4abc69da5fe6fba76",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/textedit.py": "sha256:57e2238747942d35adc774bfeaf4fb25cca340ef82362ae901b12991cccb1821",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ldap.py": "sha256:ff26b8fc89e7488463f9162319a816159243cb535d810528710cd55a3891a7af",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/varnish.py": "sha256:20d0ad61ba25d7257f357321e7508c0d90da7041e0881dd2991dc7e6e5be1647",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/theorem.py": "sha256:73e7a0ead2185946f149882b3ad2d97c5c6ba3883dd49700230ac82462cfa285",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/fortran.py": "sha256:a2ebce1dd31b8f9ea3e3436b8f6d560917f8acd2a9bb0a61c66b65515b27ce17",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/math.py": "sha256:36ca65e8866d0b287d7a089851a85ba164a6cb8709095654071c959c2b85d5a8",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ampl.py": "sha256:20ab8c544e9a5ec6b84baaa9b9cfc3bc4b09989a722833606b4f413c52ef6310",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/vip.py": "sha256:a4ce711687aefb618f5aa015cd925eeb13d8afa5893e5a33548e74f3848743cd",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/yang.py": "sha256:c88bf0b5e1d60562f6fbccd9b1c9c23c93a7ab7acc39787997126e8f2c00fd9a",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/pony.py": "sha256:1caa9fe409e050e75737537556f4a0d234e3dcd500cc604e3dd5f04856a6be63",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/futhark.py": "sha256:982536caf968245e4b37bb9113ff2b095a80f07008367cb4e075d5c634a23388",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/rebol.py": "sha256:090de931a033eb850caa2415ad8a111273a08d4e503de17f1f769a1cd755442f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/smalltalk.py": "sha256:ab9d8d1de825de98e7d6332425603d2749ce03f0395735142d900f81bfbab8d5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/tnt.py": "sha256:30d6137e48b1d31e4bd690d5f15f3318b4bb194f33edbb7ec298816a9d96d3d5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/dotnet.py": "sha256:1a6a1a3b14a821391874051a549d19d5141ae8cbdc471875810dd7c6012ce17f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/configs.py": "sha256:603048595fd1d928916f409bc6897e4bc45189e0df020fd871385cd41999f742",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/rust.py": "sha256:eea0f7286562afeb5459ffdb3c1b78117f25f5a2167bc4db94c08523be68a2b7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_sourcemod_builtins.py": "sha256:f2ab292f108bb1f37d27b37449665136cd00faa24e20644100968d31e59a3814",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/asm.py": "sha256:8c7277083b6f1e0bb8857e2456fbc9c9c8852d633a1406050cf1bfce3053cab7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ul4.py": "sha256:8e833e512d3ed811164471cae9ec99f98fbedf4e9881b32b7af318d2183c4136",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/erlang.py": "sha256:d9a525541545b50751d90212b0378a4ce3e31ab57baf5724c972f5eca268b7d7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ada.py": "sha256:9b63bb758cc955cde2b9281a0be4e2f86877086f899a9662b7f0cf669bb52083",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/graphviz.py": "sha256:0d1356c1eb4459ab090ed88b91daa42ac4070ebc89e56f34c140f63c4ea8282b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/esoteric.py": "sha256:b6627d3dad7062d62047ac83aa0a77cc362e5cf1735f0ed22d31ce1ff784de9d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/fantom.py": "sha256:c3d214d71eb50a875decec6fe43a6f5659153e7fdb7ef54b88ff007b7ebad333",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/data.py": "sha256:3212d7a195d831916698a96a2fc455e73a7e794c156f4c85ceccb35d8ae92a2c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/markup.py": "sha256:e133117ee8d7bce13dc625b04e24ff7ead656aee1d292a1761a73585630b611b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/jsonnet.py": "sha256:fd3ed8d7ab16ee716e028185bb2594282ad4c89002e054d6655a1e4add264d79",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/wren.py": "sha256:da5873c294b6ef15ba9c4458fcd78e0e034df57ea607bbe5de875748f9e0a98f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/solidity.py": "sha256:a73d03674c621f0b9f85b43d85d08fac732303b34cb1aea1c59d673be0386371",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/phix.py": "sha256:9c4596b79f8ea080daa70e0827f70d2f5f5387c66db7a3884207aea2055e775d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_php_builtins.py": "sha256:f60f962d3dea6d21a8950241ff83d2e855bfafb1d55c15af239396c4ab5bc289",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/prql.py": "sha256:5c985df1da4458f0482a6417c7fd3dfb3d4dca8b4b5c8b24a6ecd7dfa1f2907a",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/archetype.py": "sha256:6ee847d961edc41a30cbf283e523e6e6f807a662e828c755f6d80cb3f6c4e315",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/macaulay2.py": "sha256:84b343b354ddb9bb9dbeaaa8bd837a6b835ef498e753816f344e8413684f9fc4",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/python.py": "sha256:efd03fc89aa3547a7f65e4b5ad8f0f71ce1cc19ffbfb323659691e52666052b0",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/q.py": "sha256:d826c962046ef2ecfcc0e4a9e4532bd3ce8a082ec88d246620e0d5634b8aac20",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/nimrod.py": "sha256:2fc5b0e4251a3fea23cb0a106579e30b4f26e417bae1f0729d27f969618868fc",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/haskell.py": "sha256:b2be60ab753bc6dd03d818b8d71753b016a9a275faa2d3f5a8fc91302bb133b1",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/x10.py": "sha256:efba40ca886dbfd3c5c0fbc93c682af95c3cb445e8f529f2d4c9d37211694d32",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/sgf.py": "sha256:c9afec1b84cebc35b0cc433a7088b8d1749b8644ee1c2aafa3eb879cd61f8b94",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/amdgpu.py": "sha256:28c0cb75bfb568af5125a36c4a43f2894dc3404fc7763045d296b0ff28893110",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_stata_builtins.py": "sha256:ca687c1b111c6ba7920a01e7aac2eab22f4eadf46a627b793bcc817a29c9ec31",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/dax.py": "sha256:37ee5fc6e9017c5b45093d8b268ca0d5526c7e57561f15ca2d8dd93cb9cfae28",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/monte.py": "sha256:253c7e8d2ac52a5591c00d6ace13ddeb8ec44c648497084fe1832556b7d7c97f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/asn1.py": "sha256:30b6a439e04591d84a2abe36787173a27a46213109c51fc6a1df2faa358fbdae",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ooc.py": "sha256:1c48d61dd403564eed45bfd3b846f5fc2e6a8bea5e270c3260154085fe3d312d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/nit.py": "sha256:c70bb63f8f47bbc63110bee6829579596170e8e605d62260f4356773b1f54979",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_usd_builtins.py": "sha256:486a7f78f7f656e92dac5579f6ae9d7f8993cb1655ec0658b344c91525a80402",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/r.py": "sha256:873814507f600acaaac131bd782b7525531df515b4772e8863f8d3bd19ed17e5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/func.py": "sha256:66339eae3de78c971a1a71d673f9e95a3c5be03e4efae7710512bb44b1c489b5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/diff.py": "sha256:fbadbb966b98a49dae51550cfe8ad51a05c91972011925476e696a7e508479a3",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/testing.py": "sha256:185e52a5a9c6c2380a2a861aae2df649db5d3965975e37bcc555f9f99cd38cb8",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_ada_builtins.py": "sha256:7596fe96876c48ce8be5e98b9602e0fab0a59b61ee9af9c72bbd827ad9d245d0",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/rnc.py": "sha256:3cd7e79d396766336fbc6df704d302a8fcdd03d2d9118bc3b06a1a0ddff69a7f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/make.py": "sha256:c005742914574c014c9622df00a5c38a1408136540554bd68c567ecae33b6b4f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/csound.py": "sha256:eca1e826ff30b6e21ef5daae7ace261459102d42dc190db776067f2817747ff9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/elm.py": "sha256:5e3dc795b51312411417085e9b8342ba3c79e6d4364d2eb5fca71fe8108f1c02",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/meson.py": "sha256:669355a7b9521f0247123ee9c17946732f4b7ed75ce8c3202623a86364e77ccf",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/bdd.py": "sha256:29eb8ecd704b251c71336815eda32e62c755fda2451f206e17ca6d0695b10f93",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_asy_builtins.py": "sha256:ce0e787c6860cd65d0524ebea99e8e5b91932fd7783ab9c1f12250923ac3d31b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/bare.py": "sha256:01da8bf59db49ddd1b84d19689e94b8401de8fa57cffc9b539652408ead2071f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/floscript.py": "sha256:4dccae0a2bfd6c06fcf71d7feff66aea7521b1db07005d833ec299ea6d56d4d5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/smithy.py": "sha256:86a1089a8e01fa2d2175d368d6bd24e5e1cb3a502bb515b85b93ec2c1765964e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/matlab.py": "sha256:418541740f8844d72e5a080124d0bd969ab78e05ffd70f46430a6ff74ed57d93",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/text.py": "sha256:caaea638bcf73e2cca34c9b8fd8f141e7f6f11e05fa846395bedccedd9358d8b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/basic.py": "sha256:36a37121e1e18c152d7a7c02749f3c596104dcdedad7a0c0f60d7f0f599d985d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/fift.py": "sha256:43d38b262be9e2782a16ca3b00f0af5fce61fa085d6e9f59aa93fc18a1f0b353",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ecl.py": "sha256:5c9eba3d4f448e45c9c00e1fd4e7c2d1175f3f8f6ff0deb64595e715554060da",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/objective.py": "sha256:28c13e27450bd87258024d9f1cd85fec0a507b85c5f061faa863af600d703d2e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/jmespath.py": "sha256:ef6e8f0e946bd60d8acbfc79a5939185b5e87d7c647ebe475d0f1e1cc857e718",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/srcinfo.py": "sha256:3078f4d9507b58fdc07283b3d5655802a34cff7a052e311a01d6b4ef99175415",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/dalvik.py": "sha256:d1fe66079cbc834975203da5889ff9a8cd8d8f247f481b3b724b880de35b6e3f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/freefem.py": "sha256:66664b2182d7b422b6916a86cc19ab929ef27213b2eef81f6a8ada7d49149752",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/installers.py": "sha256:8a82b62543d2264f6f72ca1edcd012bccb7ea5a5ddd7f367ddef1699aa89ec21",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/typst.py": "sha256:66d577ecd0900a84aa10aac085f7ee66d529d640da84a431f0fc4c2eb4761ba9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/slash.py": "sha256:9a8961e6c346f14b617877df4068e31cbc55b72836a02a7807c72f803c9fd34e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/html.py": "sha256:3baaa4a723b2947da7d598b5ab396606c2045b7d517efcc19fb8ca4da011d8b4",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/julia.py": "sha256:174b70320d222c134375e76ca091b8467e4ba0c72256ef5cb9fc9455dc4a40f6",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/idl.py": "sha256:5b64111f58fd2cc68dbc2e636fa3243f874b628fce414ea5425080950bde147e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/tablegen.py": "sha256:af2bb3c3e02b2ddbe5639e582419fa79b3b30e8dcbf149db479c5c641f3132ca",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/felix.py": "sha256:0ef3ceb3f126e9f16d5014026995961d6827bc015e06b0def7b0b2f57c90f29b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/webmisc.py": "sha256:1a74934877ec0141b2e43605feac0598cb3269b9f34ecb5a106f7a16e6f9ddf9",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/__init__.py": "sha256:1b876da84e5030402aa1a683d6bc126597aea8a84cc92e2eb65333d6cce4ad38",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_scheme_builtins.py": "sha256:3b7051b6de6cb931126d9fdb491790e83d2bd06fd2abf8b8c0271491d52b752d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/webidl.py": "sha256:31031a645b2496e076f65306a6218fd9fe9fce88dae2f57c16da02185407e9f3",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/forth.py": "sha256:e1ed0e09f24670496442b1c89e640cb9cbec23d7658ee3f1e05620dfc7728e7a",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/rdf.py": "sha256:14cd79e1f0759717cea52a5e5ba6d639595de64241804b98c93f6e76df8470ad",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_mysql_builtins.py": "sha256:4aa895615562aed9cde254a0b5f7913f1b55a5cba68d4bef52af67f0939bb90e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_luau_builtins.py": "sha256:60b523d9b719d026f448190894d5d61c518350592975d389c7eba4ad9c7570c7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/robotframework.py": "sha256:f2cd54ec695d87344f191eddf3facc486d19273f593a6f8b1aa0531882f0b765",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/pascal.py": "sha256:e1d7b05e4c1cd767ff8a231f74d0ea6f16ffa2a0045f6742cdbe55219eb6579e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/textfmts.py": "sha256:5928890f334a09c3ac0684d4e0d098537ded8b96471a2d0fc76f5e1a34faa41d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/web.py": "sha256:60caf1a0794a950c1f14995a7bdfd3f45d55a74dd803b216b2682a2f387aa602",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/carbon.py": "sha256:fccfb461ba1f8d932b2486a25caa13eb0a64777ffa7c5abe39d499ed5f7ad48e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/grammar_notation.py": "sha256:64661cc214af3a8970d49edc03d3dcee1569708b1e95a0a0c70b2f01fe724607",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/actionscript.py": "sha256:91b1e1a0397b26357344432fd54bb160144968faf11c39261000b908e98e215c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/tact.py": "sha256:61b39660da77d366413cce5a7dfccce3e0ae749e31459c896fefef4830a8cc2a",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/stata.py": "sha256:2a88e693158794493e1ef9b1237d776b9da7cc7fc91cda9fbfaaf78c9a050f2f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/jvm.py": "sha256:71fe55ecd38b22f076b3b44cf708211126110a8083cab1a346e3e663c6df180c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/graphql.py": "sha256:45613f91f5540c4027bfff926323a2f4825492ceb536f39a92651f58e968af3a",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/iolang.py": "sha256:90c50152a56f747941efd7b3d291593d17f43608840b649db585307639db13dd",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/d.py": "sha256:79ee682263f505c1d867ddd4c17a07233c3a073b604775820afde4b2ed89fa8d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_openedge_builtins.py": "sha256:033175a3a78090c73abe7be6795a8d9d46545628f36cd6248f3ad476d0907b73",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/trafficscript.py": "sha256:d536b0a26e9b28933ebb59187b2db5c456877a9dc3f6497adab57745a1d2bdc2",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/apdlexer.py": "sha256:a6e4a92c159ebdc89273c1b4c20d98ff2408a0682a3deb345019291489aabcee",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/automation.py": "sha256:81d498b25916f6c6e50dcbcc78ad5acb5e6b6fdbd1b8ae7aa4f389cddc6522f8",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_css_builtins.py": "sha256:aa1982e2d4461b9df3bf3310135aa7efde0bbdb54e0d1b5569cc5608fde42240",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ptx.py": "sha256:74468d4917808c0ca623054cfcc9db758e217779ae2bbf6adb4d2163037bd9cc",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/blueprint.py": "sha256:756f8be5b148896c513c36ac85e7b610e6265c8447770b82675cb788df9aebfd",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/cddl.py": "sha256:ed6ae2daadb229ec56a34083eecd9cec0a0200c6ebc32104e9ffe0cf907ac756",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/openscad.py": "sha256:b5eda22fc5647d7ba5fcf617973f142b7fd0b4c8dd98d82dd181c2604bdd12d3",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/yara.py": "sha256:fc84b3864a3bbfd02127ed5c5883594b21b79b2daf24ec85487c528e6e157536",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_mapping.py": "sha256:61b4090757aa78693ba25e4d80c30f2eb0f7546753c204029774ef2f0b71c310",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/verifpal.py": "sha256:d226534166b017d7fb94566714d3d3c18462bba2ffdb93ed108f37b6e08098a6",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/sieve.py": "sha256:09747d4b59c67954e59f6bb947ad348718240262455554d34c187f9376b0fa99",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/teraterm.py": "sha256:60276f20b46af8574e27f1df888918553a07ddce88d9045b4281f5ed0e3d1f1f",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/teal.py": "sha256:a60a4f8bdc563ee992afe85e4a9181183714e6cdea374685523da66872c4dcc3",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_csound_builtins.py": "sha256:c2e5a2423984321695bec57c6ff79fb1e6e053460a228302d040a939abd30883",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/typoscript.py": "sha256:75602e398624d17e3113f7f12a0717cfeb0c6251b6c31411e26fddecf5b63d8b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/modula2.py": "sha256:7575b428d16edc44e0001b0f32c2217492340ca17e296b53f37d452accf6557c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/eiffel.py": "sha256:9b67953c31bd27e55789e09e3b2d12ef31cf8e2147401f45e9b388cbe2b73034",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/dsls.py": "sha256:6ba25dbf7c35685defa5026b9c5df630d1c097aa4466491e181d5c62ffb1d87c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/xorg.py": "sha256:2d4294f75b753a97375bf17ae141b3c749c1f87a8a94ddc29ffead173b79218c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/parasail.py": "sha256:a0f72cedf4583645748ac3d2466c3ed9c3df320cd3b4d3e2e9b24e9bbbeafbda",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/soong.py": "sha256:4d5a812732712f00840e66f9022c76fc056e6482d8c8f59c03315bcc834d4003",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_stan_builtins.py": "sha256:b08a0e360e138cb90637b01bd2d641d4733bb50d3bd7f676738d67f655d9974e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/agile.py": "sha256:0eefaf8e719910f1ee138d17c5330ef972ede7aa5870868a200c48c1c607147d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/sql.py": "sha256:cf3fd3159b5fe51dbd72f901146d4f0c9fb428aad8ec58c0f910e4cbe81f3659",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/vyper.py": "sha256:af0db20fd7362fbc8fb57a8a3ddd1177125264af9a25b5b98c46b48077ca10ed",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_mql_builtins.py": "sha256:0a472f3321d8878539ac6815e808128714674cebf4b66a846ce8957696852eab",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/lilypond.py": "sha256:a36eb8a2f19916b731f19c292915fe82350408ad70e53f13d27e8ba138cff765",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/smv.py": "sha256:0f9d489fd42bda758589c600397fdb2697858262770549045e7bd73e6034e03e",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/json5.py": "sha256:1b2799e7c0312a42498a21fb26e3e66a40d95eba296ba6c3905460b891e27ea5",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/resource.py": "sha256:443118ee24afda1810dd5f88d4378e2953ae98d2a016a6d5d8c7bff58db5a35d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/jsx.py": "sha256:3b47af1e2a32b9db562e156601746b21f9047792918a89201eef25f7f2a7f2c3",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/arturo.py": "sha256:1a492539a8842533b3f04d3377177f85dd735f0bfb958829f08265eee875de18",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/scripting.py": "sha256:73e8bf70c1616041d06596cb8099f48f2883e76bd679957150aeb0155d8589be",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_lilypond_builtins.py": "sha256:fbfe22e20a600e07051ef6993092f6b35ac8f5d48d636642eaf3baba5ec79a5d",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/tcl.py": "sha256:317300a36c0265eab9a11ed5cec35b6a66b0ba7fef30e93680e1039c693ac8e7",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/php.py": "sha256:53ac26c4f33ea52f92635377a9dbf479b5030712c7ebe10520571ab54be0ef8c",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/urbi.py": "sha256:8fcee4e9f7bad2465d6c9e80240e20f44d27a3510fd1bc49634e9454fd188275",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/_cl_builtins.py": "sha256:a01174d19909c83d782e462e47ad371031483328ad9337b5d9a4fb5330d82d8b",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/spice.py": "sha256:51cae32b62890c329212010e78b5d36b2a91c22ad676ccb0adf1fd32ac0f3c86",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/webassembly.py": "sha256:638f15741a7c6f8488d743c4b7c6e23a6fa0b5e62098d73f6d147e2afba57e74",
+    ".venv/lib/python3.12/site-packages/pygments/lexers/ruby.py": "sha256:0719dd1bede02e0ef0106bc80a234300cca0411f50b34c6b9aaec3c1fa0bbccb",
+    ".venv/lib/python3.12/site-packages/shellingham/posix/ps.py": "sha256:346983282ba484da7495a87060268c5e984161a55b85b891f41b44d0e913f2a5",
+    ".venv/lib/python3.12/site-packages/shellingham/posix/__init__.py": "sha256:a41ebdaadbd927fc887f8f27978f997d2df02f0c2e5ee9275ce6610670b64f5a",
+    ".venv/lib/python3.12/site-packages/shellingham/posix/proc.py": "sha256:9d253122e412a2dbda0d6efa8b4a1340033d699f4f5c12c500492d5a58d2282a",
+    ".venv/lib/python3.12/site-packages/shellingham/posix/_core.py": "sha256:fefd7c51a5dbcebe26b8d86bdfe987d4575276367f74e5d0aed532a2621b2984",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode5-1-0.py": "sha256:0b4f8f5b38aaa645647f73e43f3d8658dc22742ae379fe401d0181a6a4cf92e6",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode6-3-0.py": "sha256:1bd97c721bb63094f067f77fd2d987ecf060f0a6181da7ae24224d0871879037",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode15-1-0.py": "sha256:bb20992d8ae0d2aef01addfeb8176c174032ff1f0c4ccbc5a8ae9a30e925f6b0",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode4-1-0.py": "sha256:c88029406106ed5385618d8515fbce74fa6b13a5690eeb232e54e50b2e06fd1c",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode13-0-0.py": "sha256:0e891db802ed81a07e5af6a95bb5fb3e633791915b8270a8f627c835666db83b",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode5-0-0.py": "sha256:3e4108d71e111b05d29a0a878aef3c8f2cf5e15413f1b5a23ad043ac409a5598",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode6-2-0.py": "sha256:4dd4ce72d1b03be39854689fd43a1126fb1a408487c391171cfb79f1f8c1e798",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/_versions.py": "sha256:7ed20b4771b976a9a542608960da2fbb25df167789636787d91be9575f6dc981",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode15-0-0.py": "sha256:0c11e45794a2f6f9adbff3225ba3663d06fcc9478fe0dfbd84db768ee66be191",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode6-0-0.py": "sha256:8617008a9a8a53cd5d67861b0d72254fb2842bdc8d1bf2f1fb918b80d4c5ef98",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode10-0-0.py": "sha256:154b2d60f6700c5d79044b80111a971ea20fbc2d4a63548bdb4a8b8fdf7d173a",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode16-0-0.py": "sha256:e621a96dccd543b043d901986fa93587f39d20b4175ee85cbc8e9d4052ca6cc7",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode12-1-0.py": "sha256:9167111a1d54570b262bda9f95f1ac3bf68cf00b8d84bb6125cb325c0390af22",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode12-0-0.py": "sha256:d171d74a35b9117b9ee907e097fbb46caecdb2d892766aab47f17f5aa86ce5b1",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode11-0-0.py": "sha256:8e9f1244a14194868731a7f101f84b894ec58b3c1d7203d5bf2b51de4485b59a",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode14-0-0.py": "sha256:362fb726719fe6c07890697c8a9f88caaa2e9be6b0263655d11a1236ea34caef",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode17-0-0.py": "sha256:3576e316c01a4d8763e9362093943d762b2fe342d91db79d146465ff8f3ff58d",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode7-0-0.py": "sha256:a68f461985bb8a5194f4cc0613a7e7cbe3a87ea6c3c1e950ae73889be22eb232",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/__init__.py": "sha256:e343e1005a776fcf323e746d4c6ea2f60e718fee70f7c0844f70b8229d4b2402",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode5-2-0.py": "sha256:80cf3caab8b7ffd6f4237ec318ad7e6a1fb449479dd959afc5475d0795192eda",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode6-1-0.py": "sha256:3ed509631c2d5394b6038e1863febd29aff04e4abe73b4026beca26e6907bc9b",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode8-0-0.py": "sha256:e0f8f223ec36523f71b5a9cd9599b577fda485c7ad31094879f6a85368e81a46",
+    ".venv/lib/python3.12/site-packages/rich/_unicode_data/unicode9-0-0.py": "sha256:03ea508ef9132025065c40ce89634ca9aeb3eafbf513ffc725f7f3bbbccb8bd7",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/text_join.py": "sha256:e72d4b2df3b4af85d2900edc24716e36492f7f763d264c81f02ca37709bbd45b",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/linkify.py": "sha256:9a342aa64fe51cb876371c3850568bc5ae3b1608be3879e60da9a58179e19afd",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/inline.py": "sha256:f685a67818491c4ef1e3ba0970df72a7a52c019b6b118fc0f9599fa0cbca95de",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/state_core.py": "sha256:1ea599094af97d6ef11ba8de4190dd3b4844f61c71ca5dfff9b6b080ecb9ec76",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/block.py": "sha256:d3f258d42532f87d8ea2816d204640002b6ea0650ca21831a3867a03f5229d28",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/smartquotes.py": "sha256:8b32bd7d2cae4f303ecc0506911933f4ac300905a8e34891a9c08aa8e8456c41",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/normalize.py": "sha256:0099b87de9ad149fd006733477387450da934c993d2ba28cb7044f6a2a1916a3",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/replacements.py": "sha256:087ef99a27beb5dcdd2ca42d301b824dc5c09758a37a075919f6d5fd593bb2dd",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_core/__init__.py": "sha256:4051817bd4d48e745024353bc58e12418a71c931cdc20f1b7934b05e93464631",
+    ".venv/lib/python3.12/site-packages/markdown_it/cli/parse.py": "sha256:d941b1f5074f74c1a9a7a0ae0dd39523c04ecd0f66fe9812c73ace2a8e28425b",
+    ".venv/lib/python3.12/site-packages/markdown_it/cli/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    ".venv/lib/python3.12/site-packages/markdown_it/helpers/parse_link_destination.py": "sha256:bbec715953f7835b3b0b56d0b9022d898c83ad8a181c9cd76995cf82bfa8ea66",
+    ".venv/lib/python3.12/site-packages/markdown_it/helpers/parse_link_label.py": "sha256:3c81c6e99326dc1530d1ada6d7b9421aa36b977bdacfdd75b6ea06be2583dc8e",
+    ".venv/lib/python3.12/site-packages/markdown_it/helpers/__init__.py": "sha256:607db3edd4b459473ff65e753163efacbb45a013e1e092c6c39f0eba119108ad",
+    ".venv/lib/python3.12/site-packages/markdown_it/helpers/parse_link_title.py": "sha256:8e42e861030a35e5fd6ef5901e4692ae8884a36ec7ca590450d9a3f31051969e",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/linkify.py": "sha256:89f1fab1be7013c3c6316130f52af8c740e13157cd3840427c54b02a59763beb",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/autolink.py": "sha256:a4fa2a258f22f7d56d167eca814ccc69c90c7aad61cadce2a15bd6b3e5503d1a",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/backticks.py": "sha256:27b6dece38cdc625e52aabc77347c99076701fbfb69c1b1756370ac9d93c1383",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/image.py": "sha256:59bb20ee38273ad2972305c63493a51bb3914e190c90156897122d0b4a61e82d",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/escape.py": "sha256:286ba5c2b3f9167a9933b19763c95fee9c95bf4624479f6d6990de1dbe5c98a8",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/fragments_join.py": "sha256:cbad6c1ec13e382cbf6e1c2f8882e549390b93998458a7235351e6a302f2476a",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/link.py": "sha256:da80fe7c0741d31cb10d1b592d38f32de59bcc9d64f5b6cf5509a885be7c46e2",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/newline.py": "sha256:df6f6bd15dda0e3ccdb4972fcc0de5b05623ce006b4a12c0579b9ff61c102ff3",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/strikethrough.py": "sha256:38eb1485e7262170d34adef1ef4f3c4fa2fbcf84de7f1506a5ebcad3b5494330",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/text.py": "sha256:24b17a4fb0f1054c4d2a364f575107a3076e57b13d0357b795598896eecdbe51",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/__init__.py": "sha256:aaa1d993af9813c45cd76aba3f1bd52816b1bf6c2665e7a8e391f55cc47f571b",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/balance_pairs.py": "sha256:e7380188689da9d8969adec8a3f72e64e621e441447d7ad845c7bc4578399bba",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/html_inline.py": "sha256:48183a1d1d0746a09dae491e73475f398b90740ab27de2d114b790820b608ef8",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/emphasis.py": "sha256:eda0cb671d0995e92ebdbbb7b845130e1269d346743e3ea0e02dfe54b848f02a",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/entity.py": "sha256:084f00206322e62b046b6e1136c7a8d304664d36a3e582db81315d0e605eb005",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_inline/state_inline.py": "sha256:5ef86391a94afd548eb3c4f6af8051cc690d5a993da4e1300e0948cdacc8bdc4",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/hr.py": "sha256:402a18e6422669046f17b3f23fc3a859fb7a03c2551f5bfa30dfb41d1f489298",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/paragraph.py": "sha256:f69982c00ede32ee0b05d5787d62b30b811dc1a3a8686c3691f79849088bc9ef",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/list.py": "sha256:4161da17166b8680db0170639bdb1c442881b820f196fd89048f5582c1f2678c",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/reference.py": "sha256:b9ed6a65b51a50fd0622fc138e1ea70f552d0a28fcbb0b0832e616d710647247",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/fence.py": "sha256:5120ea8731132d3c830ce93ca9c0f135feb5805810c16ce999fcb657e637b75a",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/table.py": "sha256:f2731df4e34639f7c447b05799cf646db87190b8eda57efd7552d1d226ad1a73",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/html_block.py": "sha256:c00f296f7e0bb59af50642004e018a4012065f98d034e930665f54184aaf6f93",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/blockquote.py": "sha256:1f86d7caa71af3bcad51b0815c8109189c1b3d3121e0fd5189f5a5706d98eeb6",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/lheading.py": "sha256:7d6a04b94a3b4b6b2faf950c2a6c9032487486179800783680c336eba32882ce",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/__init__.py": "sha256:cb53e56a32385f60b961ab8eb20a63e67fbcbd7dfb25ea5d8c0c2eceeaed256e",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/code.py": "sha256:893031bf4535f8c0e1cfcf0cd66d698b6bf33a110c48444eb17328d90abefa45",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/heading.py": "sha256:e0b875e6bc2856c4231358558696e189d43493dc4a1e28608c079849bc203b99",
+    ".venv/lib/python3.12/site-packages/markdown_it/rules_block/state_block.py": "sha256:1e8c2c432cb98465226c7e0745958a7cb2255de0d49ee58bee4a45d3ead2c283",
+    ".venv/lib/python3.12/site-packages/markdown_it/presets/default.py": "sha256:15f295508d071f733efeacba470a2d2d2b5d0b83c0680c44ec3ab4fca42d46d7",
+    ".venv/lib/python3.12/site-packages/markdown_it/presets/commonmark.py": "sha256:ca07dbd11ed643f668c903f775ff81d049d832a357095392c3d48074c8ec1a8c",
+    ".venv/lib/python3.12/site-packages/markdown_it/presets/__init__.py": "sha256:ba7456fbc5eb5e06335e9a3ac445e3ed1fc1992297c151d9f04955877c7453e0",
+    ".venv/lib/python3.12/site-packages/markdown_it/presets/zero.py": "sha256:a245d64c1108fb69e6c31e5729e0a3c489d17fae680b5d606a1b5197e40db473",
+    ".venv/lib/python3.12/site-packages/markdown_it/common/entities.py": "sha256:1184429942fb654d454462d25d094fc77e7a958f04501745cb1f7a79219ce9dd",
+    ".venv/lib/python3.12/site-packages/markdown_it/common/html_re.py": "sha256:16080012ff482fc80742ab064e41dc7f7df7ad3a23c06d03409307f6856ed1f5",
+    ".venv/lib/python3.12/site-packages/markdown_it/common/utils.py": "sha256:a4c82f30e137656f81749ec77eece55cd2b20f522f93b8c712b73627f07c2793",
+    ".venv/lib/python3.12/site-packages/markdown_it/common/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    ".venv/lib/python3.12/site-packages/markdown_it/common/html_blocks.py": "sha256:4176d40cca0df655cb818164d830589659cb885ba42fa7479f65fdf18e967b0b",
+    ".venv/lib/python3.12/site-packages/markdown_it/common/normalize_url.py": "sha256:6af3979cb77dc70e63535ab93cb7ed8c033da6f1b1f25f500c4926652cab3208",
+    ".venv/lib/python3.12/site-packages/_pytest/_io/terminalwriter.py": "sha256:2b4a41d697c0beb281585011292a1b438c168b4a5d9a205a19bddafeffc00234",
+    ".venv/lib/python3.12/site-packages/_pytest/_io/pprint.py": "sha256:18b04a2fa7669d1afdd869d53243733242aac74f0ea7bb5d2527a1dc07b0a276",
+    ".venv/lib/python3.12/site-packages/_pytest/_io/saferepr.py": "sha256:1e1c7917eef98b3d3785d93e58ef3a066cbd441b911ecb898fe614ce8cdfae0a",
+    ".venv/lib/python3.12/site-packages/_pytest/_io/wcwidth.py": "sha256:714109ef8521c1e202c1b2af536aba9e865c3600f442504407d09f6a41986aa0",
+    ".venv/lib/python3.12/site-packages/_pytest/_io/__init__.py": "sha256:a642c5dbd54416be8396bdde3ad24bf2c7f8ed12c5b7525fe17d436413e56267",
+    ".venv/lib/python3.12/site-packages/_pytest/mark/expression.py": "sha256:df4ad2eb9c8c09d7e7d545a208fff88a67f349e584b4ffeacf8ff6255dd8d7e5",
+    ".venv/lib/python3.12/site-packages/_pytest/mark/__init__.py": "sha256:dfc1fbc21da4dd264c64d6700213db1c1c693f161b9fec33995b465188a0bf37",
+    ".venv/lib/python3.12/site-packages/_pytest/mark/structures.py": "sha256:92b950eec1145149858f2df28e85c0d017224e052992532d2ea4e528eb04c1a7",
+    ".venv/lib/python3.12/site-packages/_pytest/config/compat.py": "sha256:7630edfd74cfc170c88279e8a6d8b6655aeab70ccee6115688c86053976020ce",
+    ".venv/lib/python3.12/site-packages/_pytest/config/exceptions.py": "sha256:e959bdcb3c143b12469b5ed93066f0ebdbff8b4ee64f52a607010d336b1c2a19",
+    ".venv/lib/python3.12/site-packages/_pytest/config/argparsing.py": "sha256:7438f0b58f6785343d435e196dd53e106c2840a645b95641d4fb34c1c960e7fa",
+    ".venv/lib/python3.12/site-packages/_pytest/config/findpaths.py": "sha256:d22abddac47a73a81504569cc0c356fa0145ce57ef58d3b8e9d5fdc77f609c88",
+    ".venv/lib/python3.12/site-packages/_pytest/config/__init__.py": "sha256:2ea44f1539ed6b72eb61402d4633b92e9fef99895c41ac6347860690516e46cf",
+    ".venv/lib/python3.12/site-packages/_pytest/_py/path.py": "sha256:72a0a7d1a9b32a1a92aa25b55b3b782aabc52369dc281cc69f011152c5a90bfd",
+    ".venv/lib/python3.12/site-packages/_pytest/_py/error.py": "sha256:90643b17cfdf67a615061031faef669134014f1d2a231c6754c0b40a088e77bd",
+    ".venv/lib/python3.12/site-packages/_pytest/_py/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    ".venv/lib/python3.12/site-packages/_pytest/assertion/truncate.py": "sha256:daf394de44b88546610c32f45dacf5a4cee85bfd74c0c7342776ff9446d2cd02",
+    ".venv/lib/python3.12/site-packages/_pytest/assertion/rewrite.py": "sha256:376adab93672026552858ffaca009cbef553f082f2e4dee87ace75e7966d4b10",
+    ".venv/lib/python3.12/site-packages/_pytest/assertion/__init__.py": "sha256:3a39c99b88fa5478306232af5bc77e28579f8c474e48e345178cf5d28f6bede8",
+    ".venv/lib/python3.12/site-packages/_pytest/assertion/util.py": "sha256:6102f243b9d81d0bb4ba2e52781eb6281d0a8eeb9e1721f0821193fe9d5d7e63",
+    ".venv/lib/python3.12/site-packages/_pytest/_code/source.py": "sha256:56f37358761f4fde923b5dbc9bbb5f21d6a0677e72ba0e3a6d67e05c7ff9569f",
+    ".venv/lib/python3.12/site-packages/_pytest/_code/__init__.py": "sha256:04a6e8c286100032a300999359d43c49240b6c106c874f9d663dd31a3b67eb23",
+    ".venv/lib/python3.12/site-packages/_pytest/_code/code.py": "sha256:2968ebe99705f2206bc8e1c0d5dc9183206b7c34a94cbc713af8cdd47dc49f1e",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/connection.py": "sha256:f5ec4639bdcf07e329d93d7eb1c91278bdadfad27ff7e357a2657c8a19960a05",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/connection_pool.py": "sha256:6be4fc2d3b14c5ceebd16c356ad7c7483a163e34347c0f1497b4b7f85d0c8fbd",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/socks_proxy.py": "sha256:cde8195bd4a7aa3dbff7dd831496bcfc2a6939506454be0083076e4644ad6a44",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/http2.py": "sha256:031538ca172aebc067e6fa9d258b625ca6148fb9ef8586f1cf7bf8ad3e319ef0",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/http_proxy.py": "sha256:fda97fe9cacab8466edb0cafbb8f7745922625d0499e3e6818a3632ce24bd99a",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/__init__.py": "sha256:2410c8817b7995ad4b089d6c2d078a863285a4b9e936bf12beceb3da78b77e08",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/http11.py": "sha256:205a1b0f531de491652462969e1d7f4377a98a452bc88f2aa34f6ff0c8892040",
+    ".venv/lib/python3.12/site-packages/httpcore/_sync/interfaces.py": "sha256:b275ce378daf5031cee49049be8f03e155a4d966ade38cf63975c70eb8db97de",
+    ".venv/lib/python3.12/site-packages/httpcore/_backends/anyio.py": "sha256:c7c3e01215d10bc6d5aac77393f609c7c63a77d4ee6f4e82b944b09db9adaa86",
+    ".venv/lib/python3.12/site-packages/httpcore/_backends/trio.py": "sha256:2c7bb8fccaf932cc109a64f7c84e282e07fd6ff2497de552e018c3c5e25ced1a",
+    ".venv/lib/python3.12/site-packages/httpcore/_backends/base.py": "sha256:69286045d6673264611561deb63ba694cef77fc2b3d58380c8250fff8907b250",
+    ".venv/lib/python3.12/site-packages/httpcore/_backends/sync.py": "sha256:6e113877d88af549b176c76c826d847ca9d76819acd9682019853eee3994ba35",
+    ".venv/lib/python3.12/site-packages/httpcore/_backends/auto.py": "sha256:cced77e8f2999ac6930caf87464f38780f8c520f3fdb025fe0dbe62b8df6022a",
+    ".venv/lib/python3.12/site-packages/httpcore/_backends/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    ".venv/lib/python3.12/site-packages/httpcore/_backends/mock.py": "sha256:7abf53e37eae49eecd2eb7e22dae31e8dbaa8398af43af770b1598096b206c7e",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/connection.py": "sha256:e8e70f5ea3047dcd01537f3ffa21d4343775bca4937365154f4f57a8d6ff04e9",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/connection_pool.py": "sha256:0ce210dacd9909ff6a7f0c61ccca6b4cf2ea08bf0ec465e2285eaa447c6f5726",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/socks_proxy.py": "sha256:94b2a02e58203df84596a8b438378190e5afb7d0a0841054caab27b14d6dc7a4",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/http2.py": "sha256:6b35f57dc9ad5da2308e9bad165678bddf7627cc708c639af5ac7d408bf8dfde",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/http_proxy.py": "sha256:db3564ae5bfe0ecfab5866aa69796b84426201014fa36dc14f71aafec5a80575",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/__init__.py": "sha256:116765dafe2d867007cc9a6a8d4e21d9af03522180bcd896ae48a2f697e14dfd",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/http11.py": "sha256:faa33d6d5ecf8d2405e6fc6cdfbf9e5173881706c88cf7196cd962b97f53b41c",
+    ".venv/lib/python3.12/site-packages/httpcore/_async/interfaces.py": "sha256:8d389a58bf37a60a460bdce2bfdd197f068a34c987c2639a97368a8ae4f1013a",
+    ".venv/lib/python3.12/site-packages/httpx/_transports/default.py": "sha256:03379a454c95c0271c4f2c8d25ec437f49f57457f3cf2769748420bf0ecf2e79",
+    ".venv/lib/python3.12/site-packages/httpx/_transports/base.py": "sha256:9194bf54c6d58987c5e7bd29a205022756ee973fb26df2f9d4faacf7292d79b5",
+    ".venv/lib/python3.12/site-packages/httpx/_transports/wsgi.py": "sha256:35c3d7dd76a9fc4c0215958efce692c9036e227098c7540c35b3bc1807a2ea36",
+    ".venv/lib/python3.12/site-packages/httpx/_transports/asgi.py": "sha256:1d17e20d830fb78c101f6805807660e1cfa2dec6e5a3a6cbe464ea7044fec73f",
+    ".venv/lib/python3.12/site-packages/httpx/_transports/__init__.py": "sha256:19b52805200ea7bcfe97ef63e5884c851dc3308727e8554b863d3bd8edcd9e7a",
+    ".venv/lib/python3.12/site-packages/httpx/_transports/mock.py": "sha256:3d3a34779ebb4484d7c46ae48ba90deffebbc300317f088c0dcb972626428c4a",
+    ".venv/lib/python3.12/site-packages/packaging/licenses/_spdx.py": "sha256:596ec35e2ca0ebcba9fd8343ff0a51625af548786257815f24b41f7e08613314",
+    ".venv/lib/python3.12/site-packages/packaging/licenses/__init__.py": "sha256:fc9c745d1883ff9f296a5b169f22eb2ee879f59a4608f20f5cb29d668f4e26f4",
+    "src/warden/ca.py": "sha256:d5282819c5d29386fd59a7dc46d1abdc01e99fc6838a1a6637f90868389fe557",
+    "src/warden/inventory.py": "sha256:9401db92d7cbf3bea962b97e83ef2c252a19c69ab94ce4836ba58f68638cb311",
+    "src/warden/memory.py": "sha256:ecf5f7ccabb669b56bfca3a109b10bbe8437bdd2ea30a47a4c08570f97d7be2a",
+    "src/warden/case_inputs.py": "sha256:1334b0cd9897e763cfea2d306e997c659f3f284ecc3f9612140c2104835da7c7",
+    "src/warden/audit.py": "sha256:6b5b8fe053064d3905294bfde1b691fcca8a0806c889e52a49494470d29c24a0",
+    "src/warden/case_type.py": "sha256:7b659b8d682863cd28df24025be4b10dd7ca3df724350a22d360c6af9615bca7",
+    "src/warden/vault.py": "sha256:860b8c9f498b3955b363a74dd74087b6d0c399599ef22b951a076ee33c95929f",
+    "src/warden/taint.py": "sha256:8c3d161d18d429d026aad715ac01e2d33e0f4e84ac03fbaea3cea15017ad39a1",
+    "src/warden/case_run.py": "sha256:6bc06faf727db42810e4db2ab228cf60f52ede1e48d2b65d03d0a67492bd3c97",
+    "src/warden/vault_hints.py": "sha256:0d158ffcc3a93d5442df5fbe13d4c1e3b3159dd60301530bbdae6db9bc9c709e",
+    "src/warden/access.py": "sha256:258d45d2f84b54b2464373ad4d7d6df6ff95b8e8d60f5e85ceb2d962fcfa8a61",
+    "src/warden/clock_attribution.py": "sha256:5fcf07a2525a6a250442e14b6f6229f7db2a6ca02fc6aac23cdaa4c1a78c63eb",
+    "src/warden/case_plan.py": "sha256:9352ae8683d1181980c4ff38524582e4be448d33c85b558f60582c1e5bb5bbaa",
+    "src/warden/caller_identity.py": "sha256:747edfaceecd470981949253bda0c3bd2f487d40a9a2f77c2cc1eff3f34f04f7",
+    "src/warden/policy.py": "sha256:aac46f538e986731cd841581c91efe004b8c1940966b954ef635780a719dada4",
+    "src/warden/case_receipt_state.py": "sha256:a2cda7f187e77bd76d4d209505638de44a587fae0bc033ec75c23ee9ea9f73bc",
+    "src/warden/config.py": "sha256:8a857faa3811b00303d4d5c904d69255ebdaff3239e8516f97e6606e53b46924",
+    "src/warden/openbao_caller.py": "sha256:7e6d07827d00eae7de3b2367c97bdcda1a13d6559627201a4ba09a0e42d46a17",
+    "src/warden/doubles.py": "sha256:5460e07f5bd0f51a81d3f3c0ac84efde65ca9130b1039f94ee22ca484976a9de",
+    "src/warden/posture.py": "sha256:1bb60c4dd4634ea42cb130ae1325d7415adf43096906bde2515396c368256e33",
+    "src/warden/cli.py": "sha256:196cd829d3dbfbd2333598a983687bde1f9bcdfadef95b2fd1d237c4a5f060a9",
+    "src/warden/proxy.py": "sha256:69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da",
+    "src/warden/plan.py": "sha256:001b3197e644221344d52e6b1594eb8eae78d10e73d18ed31273505909f3916b",
+    "src/warden/worker.py": "sha256:d7c2b391b36033d44d8c6841b9bce18a05c74b41ef2910b91689820b6a1cb44e",
+    "src/warden/mask.py": "sha256:0876412d453fa84109dc8ee0468449f40cf4d3421b056f30fc205f0f59ec494b",
+    "src/warden/models.py": "sha256:f4100b02c5d96d537980e00d4b874159cd5822ba8219f1f533a2516912b7bd85",
+    "src/warden/__init__.py": "sha256:047e0feba479474235f0707a207655ecfddfb33cd4f54069134419b8ca4ea24a",
+    "src/warden/scorecard.py": "sha256:0fa5aef34aeb004fa7fcfabc287759cc47421ca5244c1f31fc467b22a653353c",
+    "src/warden/desk.py": "sha256:2499120392a5a1c0fd8f423d5b5c787c75a4efb9a986a1b7bcb85eae13423e85",
+    "src/warden/routing/scaffold.py": "sha256:5079c8e51f8d487eae3f322a66324bd70cefb637bb28f46c861032de8ec54aa2",
+    "src/warden/routing/models.py": "sha256:b85372b2572a49af62e9534f26a33963b894633c7cd43dd2a28416b8959cba3e",
+    "src/warden/routing/__init__.py": "sha256:e9124811ebe11ad32c98ab462b2eed634d4ddca08792981d0f353b223a239902",
+    "src/warden/routing/catalog.py": "sha256:5b95810df9e6102a33d3a116a096cd75292c8572bad721fe6baa772caacc9bc3",
+    "src/warden/scripts/ops_ssh_wrapper.py": "sha256:e8c289882f2ad439d2eb32f9a871967420fefaffe745c9271c1a2e948fbdfe50",
+    "src/warden/scripts/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+  },
+  "summary": [
+    "........................................................................ [ 99%]",
+    "....                                                                     [100%]",
+    "796 passed, 4 deselected in 75.62s (0:01:15)"
+  ],
+  "guard": "scripts/run_unit_tests.py; empty temporary HOME, no inherited credentials, reviewed subprocess inventory; no provider I/O",
+  "production_or_native_acceptance": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-canonical-full-attempt1.txt b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-canonical-full-attempt1.txt
new file mode 100644
index 0000000..2bad161
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-canonical-full-attempt1.txt
@@ -0,0 +1,14 @@
+"/home/worsch/ops-warden/.venv/bin/python" -I scripts/run_unit_tests.py --phase-memory-root "/home/worsch/phase-memory" --netkingdom-root /tmp/custodian-keycape-current-client-r1/net-kingdom-source -q
+........................................................................ [  9%]
+........................................................................ [ 18%]
+........................................................................ [ 27%]
+........................................................................ [ 36%]
+........................................................................ [ 45%]
+........................................................................ [ 54%]
+........................................................................ [ 63%]
+........................................................................ [ 72%]
+........................................................................ [ 81%]
+........................................................................ [ 90%]
+........................................................................ [ 99%]
+....                                                                     [100%]
+796 passed, 4 deselected in 75.62s (0:01:15)
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-full-attempt1.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-full-attempt1.json
new file mode 100644
index 0000000..7550ad6
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-full-attempt1.json
@@ -0,0 +1,116 @@
+{
+  "returncode": 2,
+  "seconds": 70.46,
+  "command": [
+    "make",
+    "test",
+    "UNIT_PYTHON=/home/worsch/ops-warden/.venv/bin/python",
+    "PHASE_MEMORY_REPO=/home/worsch/phase-memory",
+    "TEST_ARGS=--netkingdom-root /tmp/custodian-keycape-current-client-r1/net-kingdom-source -q"
+  ],
+  "source": "/tmp/custodian-keycape-current-client-r1/warden-source",
+  "source_sha256_at_start": {
+    "scripts/build_flex_auth_registry.py": "sha256:8074c845be00405024ee4d9b02987b872c2dc324cb94a67037e269ccc006f003",
+    "scripts/check_policy_caller_identity.py": "sha256:6b3050ef2799297e95952a05f47d87e966e256e7f23c5dfae70659aa458f8c15",
+    "scripts/check_tunnel_cert_readiness.py": "sha256:acb2576f0a28161b58954ba264946163a99a3b4ff93789ee783443355d115c17",
+    "scripts/check_flex_auth_manifest_coverage.py": "sha256:7b75451b41a79c858462de93d70b6eb4da31db31b8cd5f636b0fa2d866eef17c",
+    "scripts/report_workload_join.py": "sha256:3df0d33e680a9f3bff82cdebe8ff5528deb09e103cdcf7f376c1b1b7cd051361",
+    "scripts/check_secret_posture_conformance.py": "sha256:10c1f752d8831671d57ab5149e847413ef8a83bf407f5e8fce45cbc180848efe",
+    "scripts/check_layer_conformance.py": "sha256:7262fae9fae7ed454c0765cc6859e83a74e59ef6eade849991e0b8ab9c66757b",
+    "scripts/emit_high_risk_paths.py": "sha256:5e95f7ba6d00f923adc41913e3ca6063209416e3133955d69ad59920149fd9fe",
+    "scripts/check_agent_read_boundary.py": "sha256:d8ce6f0793c33ec9cc0200ce907b6fc9c0e7dfcc181415831d051ea712d6f7ed",
+    "scripts/check_principals_drift.py": "sha256:f6ef9b036e398d59740057ddeeffbad964acb793cab280abe8188ace55832696",
+    "scripts/report_coverage.py": "sha256:2bf180427a2878cc2ec09e69d2e4ceca09d3e53316678c2c40aa61314459bfe2",
+    "scripts/run_unit_tests.py": "sha256:86880094b33114fdefb26691140b5c9a516cdba5fe6ddabd70fd5b7f18e9d2aa",
+    "tests/test_models.py": "sha256:81b2416654a3abcb2431d7867914d594a9ee15f49b8f59ed8d7d7c0d7aa78350",
+    "tests/test_principals_drift.py": "sha256:17bcfec0fc25584739b04c59d83ff10e407a3af81d21e99aae83a35d31084f85",
+    "tests/test_flex_auth_registry.py": "sha256:7b1eba1aed31f74112455524ea928129e4ad03bd9688500cb2077b7df9d6b0a5",
+    "tests/test_scorecard.py": "sha256:830ebc26b1337202641eaa28d7da61c513231a272805de02c3f2a7ff15f2e95d",
+    "tests/test_policy.py": "sha256:208ca1ba567e86e4fb1b40206c0e030d7592edab937bdc4232367890852dfb31",
+    "tests/test_doubles.py": "sha256:ffc3d792d5571c420c21ee301d3fa74ec45937c8e374211453d7027fe0b1f100",
+    "tests/test_case_current_session_reference.py": "sha256:6196cda7e70457e898b2558a2348fcf0f7af50f8f66748582f934c29d1523813",
+    "tests/test_ca.py": "sha256:1358b78a33079185e6ff69b27cdfcb21db10a6ce5c44321a21b43165a4428ede",
+    "tests/test_case_attended_boundary.py": "sha256:4615e653f06144305ea1a84e98bc6260e16ed41ef9e5db2d0f162ef9f723ef2d",
+    "tests/unit_isolation_probe.py": "sha256:726d3e01ae21c1379588e1f08459449908cc8a75ffea1b337c33a1a888c66f59",
+    "tests/test_openbao_configuration_routing.py": "sha256:597c3092827b684cb86986a12e489d6fd609b62dc739a33b7dd42e59c9879721",
+    "tests/test_case_1_3_integration.py": "sha256:4862c5a004075eb18733d354bee7dda3f55e04a6ee8ecb44b76166347c121158",
+    "tests/test_routing.py": "sha256:43998fccf67b1f0d1a6c8bde1a4768a32f8418fb72a8eda5bf321dd96c097d35",
+    "tests/test_case_type.py": "sha256:5a217a172e7e2ffbea66f1beee9a1c18bf5e97f9fb25b83cb96b6ba976cbb2a5",
+    "tests/test_layer_conformance.py": "sha256:3edf0a0d49c3560278a564c477834335cfaf5243341cb9345f0d4bf8994db56c",
+    "tests/test_vault.py": "sha256:3c3b16739cc16651eaf4409e00d44b5a9bce92b710e75b98913b61a4fd00fe6f",
+    "tests/test_plan.py": "sha256:405906b207d8f7469b6135782b357f5a35e4e31ed0426fd56cedfd02d43c1392",
+    "tests/test_case_admission_modes.py": "sha256:9110d6b6286cf0f85268d4970d1fd403250da3f04351d70b1fd2d9d7a93e2d89",
+    "tests/test_policy_http_refusal.py": "sha256:443f214ffbcc454cbfdc9752e8622593816139f2d8538c6c535e9902559a842e",
+    "tests/test_posture.py": "sha256:dde12cfcd8a951be4a122e2eb9730f70a588a257e437dfed23c0c05461b5a6b6",
+    "tests/test_audit.py": "sha256:74efa3dcfdb05e21b28b0d22c8770133fcea001c66cc7a80bd9e6af2c87636ba",
+    "tests/test_memory.py": "sha256:300d9d9c6cd98eea1292eb70a01b28849cb5696690a2504f524123934180220e",
+    "tests/test_safe_unit_runner.py": "sha256:5408e7face98b01b92da077b0b2d115fcb370ec46e572ad5a69e3d0c10df8433",
+    "tests/test_config.py": "sha256:ef4e8bea2ebbc689e822cf10fd27bd2bd9b5271a93eb2039e2e0a236ebbabac3",
+    "tests/test_case_original_context_consistency.py": "sha256:10c5187cbc49222017319249ccb408816497ec6e006859d23003f3b2b375445b",
+    "tests/test_desk.py": "sha256:b655023ae57e4e889c87802d47c19efddc575154f89516343761212694eeb092",
+    "tests/test_tunnel_cert_readiness.py": "sha256:d2bf6f1bf6d7cc50b86a28fd8a52959e513ea1b6dd15a0326f7028af52653b44",
+    "tests/test_scaffold.py": "sha256:3126d8ea447fdb0685ba40d0bb031e2635bff26b0eb057c6bc7cdd5851a4aa2e",
+    "tests/test_inventory.py": "sha256:895d2032cd4927ab9ec94253286e2605695c3261c1e4b4aaf67c9ee2cf3461cb",
+    "tests/test_worker.py": "sha256:9584572486bafb0de585aed8433add7f60f7947527684f64cef4498bb84efb6b",
+    "tests/test_integration.py": "sha256:b27529b3c794639c21a778265c589ba3c87bb82e7ce280bddb38ed64ea398d4b",
+    "tests/test_workload_join.py": "sha256:8ef0891daf4b7ac520430a514690364917110628edc760911a850195cffbdd4a",
+    "tests/test_case_receipt_state.py": "sha256:6ca261660744ea187b7a7aa79cfa5e0d05e7e53af72f9c12d6c9ed375a4130e9",
+    "tests/test_taint.py": "sha256:5909a29b43e24b0cdc7d8752b789679f175a6614ba021e62cf82ffde1bf5455c",
+    "tests/test_case_run.py": "sha256:32a277175cfa9f496a2850289f6ad8d5afdf47d33c4747dd7ec552e951fd7b39",
+    "tests/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "tests/test_case_inputs.py": "sha256:6bf84eafbc4399831b35aa58e755574c8da9ddcbf1d0532eccf649d37779533d",
+    "tests/test_agent_read_boundary_check.py": "sha256:cda637e2ab179cec155989d203ec6e74ae7489a3d68d55f85ab0d6764c829443",
+    "tests/test_openbao_caller.py": "sha256:3ec471cc61f4c968c89e74f482de1a6cd70ec861387a61d2219e970651a521ee",
+    "tests/test_posture_conformance.py": "sha256:29ba461285f8a1812a9f0d1c6759f5ce8f969ad3d8f4e5b47c49aafff0368b04",
+    "tests/test_access.py": "sha256:89c8e57929a83da409ddd327bd0b3a5b48399c888523e3e599510b437853873d",
+    "tests/test_proxy.py": "sha256:9e464043e85f450c0130acfe64b362ee0714483ed2e6fbc2bea6edfac7cdb83e",
+    "tests/test_mask.py": "sha256:51588dff08546f7f4d7761b4203b647dfe23121fe0a94de78f2900450d444fee",
+    "tests/test_case_plan.py": "sha256:944bc2a725ca1b7a10f4516c3ceed65f99627057dd15a859da4f8ffb3d97e71f",
+    "tests/test_reuse_surface_caller_gate.py": "sha256:c17b36a7e2de1c832737d65b36c45a8c5e3bdd820fa96c5faed3d269053a511e",
+    "tests/test_policy_fetch_evaluator.py": "sha256:122f6ce39d01e78d46abd2ffae0a2a2021a9dbe4189f2181679f9539cca8683c",
+    "tests/test_cli.py": "sha256:4b9d32c990dd5b0e5ed7b81bf17577e09458fac2006e01e59caadd99d761ac56",
+    "tests/conftest.py": "sha256:40ae0e4e7e57e5daa13f2997b27b7fa30ac86ec7ac1800e3e65a2247d7e3edfd",
+    "src/warden/ca.py": "sha256:d5282819c5d29386fd59a7dc46d1abdc01e99fc6838a1a6637f90868389fe557",
+    "src/warden/inventory.py": "sha256:9401db92d7cbf3bea962b97e83ef2c252a19c69ab94ce4836ba58f68638cb311",
+    "src/warden/memory.py": "sha256:ecf5f7ccabb669b56bfca3a109b10bbe8437bdd2ea30a47a4c08570f97d7be2a",
+    "src/warden/case_inputs.py": "sha256:1334b0cd9897e763cfea2d306e997c659f3f284ecc3f9612140c2104835da7c7",
+    "src/warden/audit.py": "sha256:6b5b8fe053064d3905294bfde1b691fcca8a0806c889e52a49494470d29c24a0",
+    "src/warden/case_type.py": "sha256:7b659b8d682863cd28df24025be4b10dd7ca3df724350a22d360c6af9615bca7",
+    "src/warden/vault.py": "sha256:860b8c9f498b3955b363a74dd74087b6d0c399599ef22b951a076ee33c95929f",
+    "src/warden/taint.py": "sha256:8c3d161d18d429d026aad715ac01e2d33e0f4e84ac03fbaea3cea15017ad39a1",
+    "src/warden/case_run.py": "sha256:6bc06faf727db42810e4db2ab228cf60f52ede1e48d2b65d03d0a67492bd3c97",
+    "src/warden/vault_hints.py": "sha256:0d158ffcc3a93d5442df5fbe13d4c1e3b3159dd60301530bbdae6db9bc9c709e",
+    "src/warden/access.py": "sha256:258d45d2f84b54b2464373ad4d7d6df6ff95b8e8d60f5e85ceb2d962fcfa8a61",
+    "src/warden/clock_attribution.py": "sha256:5fcf07a2525a6a250442e14b6f6229f7db2a6ca02fc6aac23cdaa4c1a78c63eb",
+    "src/warden/case_plan.py": "sha256:9352ae8683d1181980c4ff38524582e4be448d33c85b558f60582c1e5bb5bbaa",
+    "src/warden/caller_identity.py": "sha256:747edfaceecd470981949253bda0c3bd2f487d40a9a2f77c2cc1eff3f34f04f7",
+    "src/warden/policy.py": "sha256:aac46f538e986731cd841581c91efe004b8c1940966b954ef635780a719dada4",
+    "src/warden/case_receipt_state.py": "sha256:a2cda7f187e77bd76d4d209505638de44a587fae0bc033ec75c23ee9ea9f73bc",
+    "src/warden/config.py": "sha256:8a857faa3811b00303d4d5c904d69255ebdaff3239e8516f97e6606e53b46924",
+    "src/warden/openbao_caller.py": "sha256:7e6d07827d00eae7de3b2367c97bdcda1a13d6559627201a4ba09a0e42d46a17",
+    "src/warden/doubles.py": "sha256:5460e07f5bd0f51a81d3f3c0ac84efde65ca9130b1039f94ee22ca484976a9de",
+    "src/warden/posture.py": "sha256:1bb60c4dd4634ea42cb130ae1325d7415adf43096906bde2515396c368256e33",
+    "src/warden/cli.py": "sha256:196cd829d3dbfbd2333598a983687bde1f9bcdfadef95b2fd1d237c4a5f060a9",
+    "src/warden/proxy.py": "sha256:69649bcf8979e4ed7f9104e927b458827a355c4846143367f4cd49c8b89b96da",
+    "src/warden/plan.py": "sha256:001b3197e644221344d52e6b1594eb8eae78d10e73d18ed31273505909f3916b",
+    "src/warden/worker.py": "sha256:d7c2b391b36033d44d8c6841b9bce18a05c74b41ef2910b91689820b6a1cb44e",
+    "src/warden/mask.py": "sha256:0876412d453fa84109dc8ee0468449f40cf4d3421b056f30fc205f0f59ec494b",
+    "src/warden/models.py": "sha256:f4100b02c5d96d537980e00d4b874159cd5822ba8219f1f533a2516912b7bd85",
+    "src/warden/__init__.py": "sha256:047e0feba479474235f0707a207655ecfddfb33cd4f54069134419b8ca4ea24a",
+    "src/warden/scorecard.py": "sha256:0fa5aef34aeb004fa7fcfabc287759cc47421ca5244c1f31fc467b22a653353c",
+    "src/warden/desk.py": "sha256:2499120392a5a1c0fd8f423d5b5c787c75a4efb9a986a1b7bcb85eae13423e85",
+    "src/warden/routing/scaffold.py": "sha256:5079c8e51f8d487eae3f322a66324bd70cefb637bb28f46c861032de8ec54aa2",
+    "src/warden/routing/models.py": "sha256:b85372b2572a49af62e9534f26a33963b894633c7cd43dd2a28416b8959cba3e",
+    "src/warden/routing/__init__.py": "sha256:e9124811ebe11ad32c98ab462b2eed634d4ddca08792981d0f353b223a239902",
+    "src/warden/routing/catalog.py": "sha256:5b95810df9e6102a33d3a116a096cd75292c8572bad721fe6baa772caacc9bc3",
+    "src/warden/scripts/ops_ssh_wrapper.py": "sha256:e8c289882f2ad439d2eb32f9a871967420fefaffe745c9271c1a2e948fbdfe50",
+    "src/warden/scripts/__init__.py": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+  },
+  "summary": [
+    "FAILED tests/test_agent_read_boundary_check.py::TestGeneratedArtifact::test_artifact_is_current",
+    "1 failed, 793 passed, 4 deselected in 69.56s (0:01:09)",
+    "make: *** [Makefile:47: test] Error 1"
+  ],
+  "guard": "scripts/run_unit_tests.py; empty temporary HOME, no inherited credentials, reviewed subprocess inventory; no provider I/O",
+  "production_or_native_acceptance": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-full-attempt1.txt b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-full-attempt1.txt
new file mode 100644
index 0000000..1720e3d
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-full-attempt1.txt
@@ -0,0 +1,40 @@
+"/home/worsch/ops-warden/.venv/bin/python" -I scripts/run_unit_tests.py --phase-memory-root "/home/worsch/phase-memory" --netkingdom-root /tmp/custodian-keycape-current-client-r1/net-kingdom-source -q
+..........................F............................................. [  9%]
+........................................................................ [ 18%]
+........................................................................ [ 27%]
+........................................................................ [ 36%]
+........................................................................ [ 45%]
+........................................................................ [ 54%]
+........................................................................ [ 63%]
+........................................................................ [ 72%]
+........................................................................ [ 81%]
+........................................................................ [ 90%]
+........................................................................ [ 99%]
+..                                                                       [100%]
+=================================== FAILURES ===================================
+________________ TestGeneratedArtifact.test_artifact_is_current ________________
+
+self = <tests.test_agent_read_boundary_check.TestGeneratedArtifact object at 0x7855681a9a90>
+
+    def test_artifact_is_current(self):
+        import subprocess
+    
+        result = subprocess.run(
+            ["python3", str(REPO / "scripts" / "emit_high_risk_paths.py"), "--check"],
+            capture_output=True, text=True, timeout=60,
+        )
+>       assert result.returncode == 0, (
+            f"{result.stdout}{result.stderr}\n"
+            "Re-run scripts/emit_high_risk_paths.py and commit the result."
+        )
+E       AssertionError: STALE: /tmp/custodian-keycape-current-client-r1/warden-source/registry/generated/high-risk-data-paths.yaml does not match the catalog. Re-run without --check.
+E         
+E         Re-run scripts/emit_high_risk_paths.py and commit the result.
+E       assert 1 == 0
+E        +  where 1 = CompletedProcess(args=['/home/worsch/ops-warden/.venv/bin/python', '-I', '/tmp/custodian-keycape-current-client-r1/war...-source/registry/generated/high-risk-data-paths.yaml does not match the catalog. Re-run without --check.\n', stderr='').returncode
+
+tests/test_agent_read_boundary_check.py:117: AssertionError
+=========================== short test summary info ============================
+FAILED tests/test_agent_read_boundary_check.py::TestGeneratedArtifact::test_artifact_is_current
+1 failed, 793 passed, 4 deselected in 69.56s (0:01:09)
+make: *** [Makefile:47: test] Error 1
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-original-api-refusal.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-original-api-refusal.json
new file mode 100644
index 0000000..7002728
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-original-api-refusal.json
@@ -0,0 +1,15 @@
+{
+  "base_revision": "git:b593c879831378db7dc62adfabdfedf2d44ddd38",
+  "command": [
+    "make",
+    "test",
+    "UNIT_PYTHON=/home/worsch/ops-warden/.venv/bin/python",
+    "PHASE_MEMORY_REPO=/home/worsch/phase-memory",
+    "TEST_ARGS=tests/test_case_current_session_reference.py -q"
+  ],
+  "exit_code": 2,
+  "failed_new_checks": 8,
+  "cause": "existing Executor.admit does not accept original_session_reference; original current-session ref is also hashed into immutable journal pins",
+  "retained_in": "tool transcript; preceding published Warden source remains authoritative baseline",
+  "native_authority": false
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-progress-receipt.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-progress-receipt.json
new file mode 100644
index 0000000..5dce46c
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-progress-receipt.json
@@ -0,0 +1,14 @@
+{
+  "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
+  "id": "e0bdfe62-b2aa-4d40-8b70-2286749932cf",
+  "topic_id": null,
+  "task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89",
+  "decision_id": null,
+  "event_type": "note",
+  "summary": "Published Warden 08c098e6: original_session_reference preserves exact original journal/pins separately from fresh current caller authentication; no missing-intent backfill, business replay or uncertainty clearing. Canonical guarded full suite 796 passed/4 deselected; actual built KeyCape HTTPS fixture passed across fresh owner processes with synthetic case/target. Exact four-file replay, primary projection/remote main and all existing task bindings verified; original WORK-RECORDS worktree/index preserved. WARDEN44-T03 remains progress for native evidence/adapter admission. No catalog lane, credential, runtime authority or deployment changed.",
+  "detail": null,
+  "author": "codex",
+  "session_id": null,
+  "created_at": "2026-10-18T09:39:20.725952Z",
+  "workstream_id": "f7e81013-6868-5d99-8528-ba75a442eca9"
+}
diff --git a/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-progress-request.json b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-progress-request.json
new file mode 100644
index 0000000..c12ad07
--- /dev/null
+++ b/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/warden-progress-request.json
@@ -0,0 +1,7 @@
+{
+  "summary": "Published Warden 08c098e6: original_session_reference preserves exact original journal/pins separately from fresh current caller authentication; no missing-intent backfill, business replay or uncertainty clearing. Canonical guarded full suite 796 passed/4 deselected; actual built KeyCape HTTPS fixture passed across fresh owner processes with synthetic case/target. Exact four-file replay, primary projection/remote main and all existing task bindings verified; original WORK-RECORDS worktree/index preserved. WARDEN44-T03 remains progress for native evidence/adapter admission. No catalog lane, credential, runtime authority or deployment changed.",
+  "event_type": "note",
+  "author": "codex",
+  "workplan_id": "f7e81013-6868-5d99-8528-ba75a442eca9",
+  "task_id": "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
+}
diff --git a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
index 3d2fea1..8ba0978 100644
--- a/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
+++ b/workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md
@@ -78,6 +78,34 @@ bootstrap callers and approved exception evidence. Reuse owner work where it
 already covers the finding. Record new concrete uncovered implementation work
 before closing this task. Never populate secret values or invent owner approval.
 
+2026-10-18 shared-client/inverse continuation: KeyCape `08c083ba` publishes
+one producer current-token implementation, its generated Go adapter and private
+current/revoke/independent-inactive CLI commands. Explicit trust/identity/status
+joining, per-check trust/credential rereads, post-response lifetime/key checks
+and exact token-digest output binding pass 724 full race test/subtest results
+with six existing native/external skips. A deliberate generated-consumer-only
+change fails the ordinary parity checker. KEY42-T04 records source completion;
+independent issuer/profile review and native admission remain open.
+
+Warden `08c098e6` separates immutable original session provenance from the fresh
+current session needed for an exact existing inverse. It verifies original
+journal/intent/pins and current identity without granting replay or clearing
+uncertainty. Its actual canonical guarded suite passes 796 tests, four deselected.
+The cross-owner fixture uses the actual HTTPS issuer, built CLI, generated Go
+consumer and Warden kernel: 45 assertions across fresh owner processes pass,
+including current/revoked checks, original business replay refusal, exact synthetic
+effect restoration and independent inactive cleanup readback. Case/catalog/owner
+attestations and target are synthetic; no real Forgejo/native acceptance is claimed.
+
+All 19 KeyCape and four Warden source delta postimages replay exactly from their
+published bases; compiled integration runtime/export bytes match. Original API,
+fixture-mode and archive-only metadata failures are retained. Source and evidence:
+`docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/`.
+NK48/Apps retain current authenticated operation/inverse effect/approval bindings,
+ongoing HTTP/API/Git/SSH, private journal custody/retention and all release-writer
+exclusion. All sixteen gates, G01–G13 and 116 ledger entries remain in scope;
+no coordinator task or native gate closes. Completion audit advances to r5.
+
 2026-10-18 current-token producer continuation: actual owner contracts confirm
 that legacy KeyCape JWT validity is expiry-only and Warden's injected session
 verifier does not supply a current revocation source. Prepared an explicit,