docs: record completed factory verifier identity milestone

docs/assessments/2026-09-09-helixforge-verifier-admission.json

@@ -0,0 +1,137 @@
+{
+  "owner_repositories": [
+    {
+      "repo": "railiance-platform",
+      "commit": "c6dc4286e2c51f1f243f8231f7f508fba7d12916",
+      "remote_matches": true,
+      "worktree_clean": true
+    },
+    {
+      "repo": "net-kingdom",
+      "commit": "303a584bd0d46b8efe34458e51f84380e7fee46e",
+      "remote_matches": true,
+      "worktree_clean": true
+    },
+    {
+      "repo": "key-cape",
+      "commit": "0f5535eed95f1223c83a28f5a0bd6fa594cecae8",
+      "remote_matches": true,
+      "worktree_clean": true
+    },
+    {
+      "repo": "prj-helixforge-factory",
+      "commit": "f5e80db53faf4bfc6169496b7a129acc6d60d644",
+      "remote_matches": true,
+      "worktree_clean": true
+    }
+  ],
+  "source_hub_parity": {
+    "tasks": [
+      {
+        "task": "KEY-WP-0013-T02",
+        "status": "done",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": [
+          "description"
+        ]
+      },
+      {
+        "task": "RPF-WP-0035-T05",
+        "status": "progress",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T01",
+        "status": "wait",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T02",
+        "status": "progress",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T03",
+        "status": "wait",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T04",
+        "status": "wait",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T05",
+        "status": "wait",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T06",
+        "status": "wait",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T07",
+        "status": "wait",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      },
+      {
+        "task": "HFACT-WP-0001-T08",
+        "status": "wait",
+        "needs_human": false,
+        "source_fields_match": true,
+        "supported_patch_fields": []
+      }
+    ]
+  },
+  "milestone": {
+    "ccrs_verified": 2,
+    "keycape_service_registration_task": "done",
+    "factory_identity_integration_task": "wait",
+    "automated_tests": 71,
+    "fresh_human_login": "passed",
+    "custody_versions": [
+      1,
+      1
+    ]
+  },
+  "live_readback": {
+    "deployment_generation": 38,
+    "ready_replicas": 1
+  },
+  "progress_events": [
+    {
+      "workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f",
+      "task_id": "607897c5-bad9-55e5-86df-7802f592d6e8",
+      "progress_id": "5a464f19-4c38-4b10-96d0-2c6a3924315b"
+    },
+    {
+      "workplan_id": "975db491-5412-5e27-8e34-14a2417bb039",
+      "task_id": "e15d62c9-e5da-5721-a135-87c050f7851c",
+      "progress_id": "0ff5f488-d404-4d1d-8517-cd843c035ae7"
+    },
+    {
+      "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
+      "task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823",
+      "progress_id": "3174a97f-42ae-446c-a931-3dd0291dff12"
+    }
+  ],
+  "live_evidence": "net-kingdom:docs/evidence/2026-09-09-keycape-verifier-admission.json"
+}

docs/assessments/2026-09-09-helixforge-verifier-admission.md

@@ -0,0 +1,52 @@
+# HelixForge: verifier identity milestone accepted
+
+The approved CCR-2026-0017/0018 rollout is complete. Both credential requests
+are verified, and KEY-WP-0013-T02 is done. The factory programme remains active;
+this closes its verifier identity prerequisite.
+
+Two independent version-1 credentials now reach KeyCape through their approved
+OpenBao policies, Kubernetes roles and ESO stores. Both stores are Valid and
+both ExternalSecrets are SecretSynced. The pinned KeyCape image has one ready
+replica. Both service clients passed live signature, exact claim and 900-second
+lifetime checks, wrong-secret rejection and excess-scope denial. Existing human
+OpenBao login passed before and after replacement. Attended sessions self-revoked.
+
+Native custody checks proved sibling-path and parent-listing denial, wrong
+service-account and namespace rejection, outside-namespace store refusal,
+reader revocation and coding-agent deny precedence. The signing key and unrelated
+configuration bytes were preserved. No credential value entered Git or Hub records.
+
+The work removes recurring manual steps: named reviews are recorded once;
+provisioning, verification and recovery are executable; a failed rollout can
+resume without regenerating credentials. Failed attempts exercised compatible
+configuration/image rollback and exposed three verification assumptions that
+are now corrected: containerd manifest identity, verifier execution location,
+and small clock differences. The workstation also needs its explicit Railiance
+kubeconfig. These are observed improvements to the procedure, not measured
+staff-hour savings or evidence of sustained factory throughput.
+
+Validation comprises 71 automated tests, a disposable pinned-image HTTPS exercise
+running the exact native verifier, live custody/client checks and a fresh human
+login. Future issued-at timestamps use KeyCape's existing 30-second bound;
+expiry and not-before remain strict. Initial provisioning did not exercise
+natural JWT expiry or actual predecessor rotation.
+
+The next critical-path records are:
+
+1. RPF-WP-0035-T05: separate client-side credential admission and delivery.
+2. AUDIT-WP-0009-T09 and APPROVAL-WP-0002: audit custody, deployed approval
+   startup and real claim/consume acceptance.
+3. SECRETS-WP-0009-T03: native credential delivery with expiry/revocation proof.
+4. HFACT-WP-0001-T01/T04/T05: exact factory actor/profile/grants and spend contract,
+   Railiance placement, then natural worker lifecycle and recovery proof.
+
+KEY-WP-0013-T05 retains the separate approval UI callback/MFA requirement.
+HFACT-WP-0001-T02 retains the known projection-field and idempotency defects;
+successful synchronization here does not fix those systemic issues. No paid
+factory execution or fourteen-day observation has started. Reuse-surface remains
+the first internal capability, Railiance Fabric the subsequent integration option,
+and vergabe-teilnahme the primary customer product repository.
+
+Authoritative evidence: [accepted verifier receipt](/home/worsch/net-kingdom/docs/evidence/2026-09-09-keycape-verifier-admission.json),
+[owner rollout and recovery](/home/worsch/net-kingdom/docs/keycape-approval-clients-rollout.md),
+and [current factory admission sequence](/home/worsch/prj-helixforge-factory/operations/identity-admission.md).