Record actual Forgejo chart compatibility and preserve exact any-of gate work

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

workplans/NK-WP-0048-security-case-types.md

@@ -1648,3 +1648,67 @@ in that packet. This records source
 fixture work, not native T03, owner assent, exact-type acknowledgment, PIN-1,
 composition/admission completion under T16 or the native first case under T06.
 T33 and T34 retain their existing issuer-store and consumer-inverse work.
+
+## T36 — Prove the actual Forgejo chart and claim-gate compatibility
+
+```task
+id: NK-WP-0048-T36
+status: done
+priority: high
+state_hub_task_id: "7ba71abd-3c85-53ce-9837-7b0653ec709c"
+```
+
+Completed 2026-10-17, public source and offline rendering only. Split from T16's
+consumer configuration obligation after inspecting the actual Apps chart
+12.5.0 and overridden Forgejo image 11.0.3. The existing `CLIENT_SECRET` key can
+be consumed unchanged through the chart's indexed OAuth environment reference;
+its `existingSecret` shortcut instead requests incompatible `key`/`secret`
+keys. The actual CLI and callback support one literal required-claim value,
+so they cannot express the first case's any-of set `forge-admins`,
+`forge-coulomb-owners`, `forge-coulomb-readers`. Joined strings and regexes do
+not implement that set. An invented plural Helm key renders but produces an
+unsupported CLI flag.
+
+Evidence: Custodian `docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1/`.
+The chart archive matches its official public index digest; exact upstream
+source and render checks are retained. Nine source/render tests pass, also
+independently reproduced by the coordinator with empty HOME, read-only public
+inputs, no host configuration and a network-disabled bwrap namespace.
+The full first-case preparer refuses rather than weaken the group gate.
+No actual OAuth source, deployment, credential, admitted acceptance or native
+login is produced. T37 owns the implementation gap; T34 retains the independent
+configuration/inverse/session/journal/exclusion obligations. T16 composition
+and T06 native first-case acceptance stay open.
+
+## T37 — Implement the exact any-of consumer gate through the proper owner
+
+```task
+id: NK-WP-0048-T37
+status: progress
+priority: high
+state_hub_task_id: "e493fb4b-52d2-54d4-a732-b42242855b3e"
+```
+
+Coordinator: NetKingdom; consumer implementation: Apps; issuer changes, if any,
+belong to KeyCape and its governing authorization contracts. Next action:
+implement and independently review a faithful supported consumer gate for the
+unchanged three-group access set, using T36's pinned chart/image evidence.
+The active source investigation prepares a backward-compatible Forgejo
+multi-value required-claim extension; it does not select or deploy a new image.
+
+An app-specific issuer allowed/denied claim is not automatically admissible:
+the single-PDP rule and KeyCape's role must be reviewed before moving policy
+into the issuer. Earlier negative-claim omission is also unsafe with the actual
+provider's ID-token/UserInfo merge: omission can retain a stale positive claim.
+Keep those adverse source findings; no KeyCape feature, policy authority or
+current client binding is inferred from that proposal.
+
+Done when actual owner source implements the exact set, tests cover each group
+alone, combinations, missing/malformed/nonmember/lookalike values and group
+add/remove behavior, existing local sign-in/account-linking/group references
+remain correct, and required owner reviews and exact source/case re-freeze are
+recorded under the existing immutability rules. Verify the real chart/CLI/source
+combination rather than Helm rendering alone. No joined value, single-group
+substitute, unmanaged umbrella group, permissive login or new kernel step may
+replace the accepted requirement. Actual consumer observations and governed
+configuration/inverse evidence remain T06/T34 acceptance work.