Record completed issuer pin and actionable custody review handoff

docs/assessments/2026-09-09-helixforge-issuer-pin.md

@@ -0,0 +1,61 @@
+# HelixForge critical path: issuer pin complete, custody reviews ready
+
+NetKingdom completed the stored upstream issuer prerequisite on 2026-09-09
+(2026-09-08T22:23:58Z). Its live configuration was missing `authelia.issuer`;
+the contained owner helper inserted the independently verified
+`https://auth.coulomb.social` value and read it back successfully.
+
+The Secret UID stayed the same and its resourceVersion advanced from `51346058`
+to `58713343`. Atomic UID/revision preconditions prevented a stale write. Every
+other configuration byte and Secret data entry, including the signing key, was
+preserved. The Deployment stayed at generation 29, image `main-153258b`, with
+one ready and available replica. No credential value entered output or evidence.
+
+The owner implementation extends the existing configuration helper with two
+issuer-only modes; its legacy client/LLDAP patch mode was not used. All thirteen
+tests passed, including concurrency, byte preservation and error containment.
+The read and write procedures are both exercised against the actual target.
+[Owner procedure](/home/worsch/net-kingdom/docs/keycape-upstream-issuer-pin.md).
+
+This closes one concrete prerequisite inside KEY-WP-0013-T02 and
+HFACT-WP-0001-T03. Those tasks still wait for custody and the compatible
+image/configuration rollout. A stored pin does not prove that the existing
+process reloaded it or that downstream login regression has passed.
+
+The next human dependency is now actionable in its existing owner record,
+RPF-WP-0035-T05. Both existing CCRs have pending review decisions:
+
+| Request | Pending decision | Required reviewers |
+| --- | --- | --- |
+| CCR-2026-0017 | `b533a271-b704-4c5c-98a2-9a5951aadfb6` | platform-operator, key-cape-owner |
+| CCR-2026-0018 | `efa90517-0cae-4eb6-a68d-5b0489c84d65` | platform-operator, key-cape-owner |
+
+[The review packet](/home/worsch/railiance-platform/docs/credential-lane-designs/keycape-approval-clients-review.md)
+sets out the exact paths, two separate policies/roles/stores, namespace and
+service-account binding, TTL, risks and excluded capabilities. Both CCRs validate
+and their generated policies match source. Both still refuse `apply-plan`
+because they are proposed. No owner review, custody activation or client-side
+credential access has been inferred from the user's continuation instruction.
+
+The generated plans still leave initial secret provisioning to a contained
+owner procedure. That procedure must be completed and exercised before the
+attended activation window; a successful capabilities preflight does not establish
+that it is ready. This remaining work stays with RPF-WP-0035-T05 and the linked
+KeyCape rollout, alongside their existing rollback and live acceptance duties.
+
+Efficiency has improved in two concrete ways: the issuer pin no longer requires
+manual configuration reconstruction, and the custody review is now a pair of
+linked decisions owned by one task instead of an unstructured cross-repository
+wait. No elapsed-time saving or factory throughput result is claimed. The
+fourteen-day operating observation remains unstarted.
+
+Final synchronization also cleared the sole already owner-archived NetKingdom
+duplicate after a [scoped review](2026-09-09-netkingdom-projection-review.json).
+Its history remains readable, and the canonical profile handoff remains waiting.
+Repo Manager's acknowledgement retry reused an idempotency key with a changed
+payload and received HTTP 409. The supported primary endpoint completed the
+reviewed operation using distinct request keys. HFACT-WP-0001-T02 retains the
+CLI fix and regression test; this receipt does not claim that defect is fixed.
+
+[Execution, synchronization and progress receipt](2026-09-09-helixforge-issuer-pin.json)
+contains the live evidence, published owner revisions and final Hub readbacks.