the-custodian/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1

Shared current-token client and fresh-session inverse source

KeyCape source 08c083bae9ff35fbaf028c36d72a95b57d2541b7 provides one issuer-owned current-token client, its generated Go export and the existing executable's private current/revoke/inactive commands. Warden source 08c098e64a9afd89e43f65436782ed2bb69cdfbd keeps original dispatch provenance while authenticating a fresh caller session for an exact existing run/inverse. These are source changes under the existing owner plans; neither deploys the proposed online issuer profile nor admits any operation, signer or credential.

Behavior and ownership

The client verifies signed token identity before reading its private client credential, performs a fresh HTTPS introspection, joins signed/status metadata, then checks lifetime and reloads signing trust after the response. It uses explicit CA/JWKS/client admission, bounded I/O, no redirects or environment proxy, no cached positive, and rereads credential/trust files. The CLI binds an owner-supplied exact token digest and writes exclusive private observations outside Git. Inactivity is explicitly scoped to the configured client; original ownership is separately required before treating that negative as cleanup. Authentication assurance, current groups, operation policy, approval and effects retain their existing owners.

The generated five-file public adapter contains the same authored client and JOSE bytes. Only the client's first package declaration changes. Both ordinary tests and the export checker reject drift. A controlled consumer-only mutation fails that checker. The current file profile is Linux/POSIX; no Windows ACL acceptance or independent Go 1.23 compiler run is claimed.

Warden's optional original_session_reference is an immutable reference, never current authentication. Readmission requires the original exact journal/intent, caller/owner/target/source and pins. The fresh session is revalidated before journal writes and callbacks. Missing/orphaned intents, changed principal/reference, revoked current sessions, business replay and uncertain-effect retries refuse. Default admission behavior and receipt schemas are unchanged. This does not provide Apps' native evidence verifier or exclusion of external release writers.

Evidence

Check	Result and scope
Final KeyCape full race suite	724 passing test/subtest results; six existing external/native skips, listed in full-attempt2.json
Focused current-client/CLI suite	63 passing results without skips, before the separately added human PKCE test
Warden canonical guarded full suite	796 passed, four deselected; actual Git metadata, empty HOME/credential guard
Built CLI + actual issuer + Warden	One integration test; 45 owner assertions in two actual Python owner processes; actual HTTPS handlers, private SQLite and disposable file effect
Generated standalone Go consumer	Four separate processes independently accept each current token and refuse it after revocation
Replay and equivalence	All 19 KeyCape and four Warden delta postimages replay exactly with fuzz zero; all unrelated archived files unchanged; 54 integration production Go/module files, generated adapter and Warden runtime match
Export counterexample	Unmodified export passes; one consumer-only change produces the intended drift refusal

owner-boundary-result.json explicitly records native_acceptance=false. The fixture's admissions, case/catalog/owner attestations and target are synthetic. Its tokens, client secret and private TLS/signing inputs stay inside fixture memory/tmpfs; no real credential, browser, user factor, Forgejo DB or release is used. It is not the required second real application or installation proof.

Earlier results remain intact: the first CLI fixture had two failures because its temporary parent directory did not meet the required 0700 mode; the corrected fixture passes without weakening production checks. The archive Warden full run had one generated-artifact metadata failure because git archive has no history. The actual checkout preserves the correct artifact and passes. The original Warden API does not support fresh-session provenance and failed the new checks; that refusal is retained. The initial publication attempt lacked owner-index filesystem permission; exact approved staging and ordinary hooks were then used.

Records and remaining acceptance

KEY-WP-0042-T04 records this source deliverable. Its existing T01 independent profile review and T03 native admission remain open. WARDEN-WP-0044-T03 remains progress; Apps RAPPS-WP-0016-T08/T09 and NK-WP-0048-T34/T42/T43 retain actual initiating/inverse identity, effect/approval integration, ongoing HTTP/API/Git/SSH, private journal custody/retention and every-release-writer exclusion. No catalog lane was activated. The knowledge pilot was reloaded: version 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, withheld for changed sources; current owner source/contracts were reviewed.

The full CUST-WP-0080 scope remains sixteen acceptance gates, G01–G13 and the 116-entry requirement ledger. This source result closes no native target gate. Owner application/publication receipts accompany the packet; private publication backups are operational workspace artifacts and are not part of the source capsule.