Record compiled any-of consumer source and actual release follow-through

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa

workplans/NK-WP-0048-security-case-types.md

@@ -1712,3 +1712,79 @@ combination rather than Helm rendering alone. No joined value, single-group
 substitute, unmanaged umbrella group, permissive login or new kernel step may
 replace the accepted requirement. Actual consumer observations and governed
 configuration/inverse evidence remain T06/T34 acceptance work.
+
+## T38 — Implement and independently compile the exact any-of source candidate
+
+```task
+id: NK-WP-0048-T38
+status: done
+priority: high
+state_hub_task_id: "2c32b963-a87c-50a1-91e1-b07ea1fe4960"
+```
+
+Completed 2026-10-17, source proposal and backend verification only. Split the
+completed implementation evidence from T37. The isolated seven-path Forgejo
+11.0.3 patch introduces a separate multi-value required-claim field and CLI
+flag, preserves legacy singular behavior, and requires current well-formed
+UserInfo groups before the existing provider merges ID-token claims. The
+original exact three-group access set and groups claim remain unchanged.
+No KeyCape authorization verdict, case/type acknowledgment or deployed image
+is introduced. Existing consumer enforcement still needs the governing
+architecture/owner review; this does not satisfy the target application's
+independent Access Engine decision requirement.
+
+Candidate: Custodian `docs/changes/netkingdom-target-2026-10-17/forgejo-required-claim-values-r1/`.
+Independent technical review: `forgejo-required-claim-values-review-r1/`.
+All 33 frozen packet digests and exact official-source pre/postimages match.
+The actual full patched backend executable compiles offline under verified
+official Go 1.24.3 in 304.79 seconds with sqlite/sqlite_unlock_notify tags.
+Eight source/provider fixture race tests, five actual package tests and three
+independent actual-package test functions pass; the latter include 14 named
+subtests. Full frontend/release/container build and native browser behavior are
+not claimed. The initial test-harness /dev/null Git-config failure is retained;
+its corrected scratch-only config does not modify candidate code.
+
+The technical review accepts exact source for owner integration review, with no
+formal owner assent. T39 owns reproducible release/package and image evidence;
+T37 retains architecture acceptance, actual owner integration and exact review/
+re-freeze. T34 retains real operation/inverse/session/journal/writer-exclusion
+bindings. T06's independent native first-case acceptance remains unchanged.
+
+## T39 — Package and review the actual consumer release and inverse prerequisites
+
+```task
+id: NK-WP-0048-T39
+status: todo
+depends_on: [NK-WP-0048-T38]
+priority: high
+state_hub_task_id: "513c43ae-05f2-5a65-9c80-a911b7d680b8"
+```
+
+Implementation owner: Apps; NetKingdom coordinates the existing T37/T16 case
+contract. Next action: prepare a reproducible full frontend/backend/container
+build from T38's reviewed official-source patch through Apps' existing owner
+build path, with exact source/toolchain/dependency/base-image/output pins and
+offline verification. Do not select, publish or deploy a replacement image as
+an implied consequence of backend compilation. Prepare the concrete owner
+source/release and native change proposal after verification.
+
+Resolve the actual persisted-source inverse before any image downgrade. Helm
+chart omission and values/revision rollback do not remove the OAuth source;
+the stock older image ignores the new list field and can weaken the gate.
+Authoritative before/post/current/inverse application-source state, existing
+secret/config preservation, fresh operation/inverse sessions, durable evidence
+and effective exclusion of all release writers remain T34 obligations. Existing
+linked users/external logins can make source deletion refuse; never delete users
+or preexisting/shared sources to force an inverse. Retain the extended image
+and reconcile rather than downgrade first. Exact capability/source evidence is
+in T38's `OWNER-INVERSE.md`; list/update/delete tools alone are not admission.
+
+Completion requires the actual owner package/build/image provenance and tests,
+the explicit architecture and owner dispositions (including the single-PDP
+application profile), a verified application-state inverse path or honest
+refusal/recovery contract, and an exact bounded deployment/verification/rollback
+proposal. The chart's runtime client-secret argv confidentiality also needs its
+owner boundary resolved; reference-only source does not prove it. Native go,
+deployment and independent browser/group/revocation observations remain existing
+T06/T16 and owner gates. No credentials, image deployment or new kernel step
+is authorized by this task.