NK-WP-0048-T06: write the Forgejo reference case (accepted)

security-cases/forgejo-netkingdom-oidc.yaml carries the founder's 2026-10-08
acceptance of the key-cape request; validates and renders plan-only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469893@bnt-lap001
Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb

security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py

@@ -161,3 +161,13 @@ def test_public_client_without_mfa_skips_delivery_and_mfa_checks():
     _, r = v.render_case(PUBLIC, as_implemented(), DECLS)
     checks = {c["id"] for c in r["verification"]}
     assert not {"secret-delivered", "mfa-pinned"} & checks
+
+
+def test_forgejo_reference_case_is_accepted_and_matches_the_example():
+    # The live reference case (NK-WP-0048-T06) is the example plus its acceptance.
+    case = yaml.safe_load((REPO / "security-cases" / "forgejo-netkingdom-oidc.yaml").read_text())
+    assert case["spec"]["parameters"] == FORGEJO["spec"]["parameters"]
+    assert case["spec"]["status"] == "accepted"
+    assert {b["role"] for b in case["spec"]["acceptance"]["by"]} == {"owner", "founder"}
+    assert msgs(v.validate_case(case, TYPE, require_implemented=False)) == []
+    assert msgs(v.validate_case(case, as_implemented())) == []

security-cases/forgejo-netkingdom-oidc.yaml

@@ -0,0 +1,33 @@
+# First KnownSecurityCase of oidc-browser-relying-party 1.0 (NK-WP-0048-T06).
+# Parameters are the request the founder accepted on 2026-10-08
+# (key-cape docs/forgejo-oidc-client-request.yaml, KEY-WP-0038-T01); that
+# acceptance carries over as this case's acceptance. One difference: custody is
+# derived by the type (platform/workloads/keycape/forgejo), not the request's
+# proposed platform/workloads/forgejo/netkingdom-oidc-client. The founder
+# acknowledged that derivation with the type (memo r4, 2026-10-09).
+apiVersion: netkingdom.io/security-case/v0.1
+kind: SecurityCase
+spec:
+  id: forgejo-netkingdom-oidc
+  type: oidc-browser-relying-party@1.0
+  status: accepted
+  acceptance:
+    at: "2026-10-08"
+    record: "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e"
+    by:
+      - {role: owner, name: "founder (for railiance-apps)"}
+      - {role: founder, name: founder}
+  owner:
+    repo: railiance-apps
+    person: founder
+  parameters:
+    client_id: forgejo
+    display_name: Forgejo source forge
+    redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
+    allowed_scopes: openid,profile,email,groups
+    client_type: confidential
+    mfa_required: "true"
+    access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers
+    initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick
+    consuming_service: forgejo
+    consumer_owner_repo: railiance-apps

workplans/NK-WP-0048-security-case-types.md

@@ -339,6 +339,19 @@ this reference case is live.
 
 This replaces the hand-built path proposed for KEY-WP-0038-T02.
 
+2026-10-09: case written, `security-cases/forgejo-netkingdom-oidc.yaml`, status
+`accepted`: the example's parameters plus the founder's 2026-10-08 acceptance of
+the key-cape request (owner and founder), with the custody-path derivation
+covered by the type's acknowledgment (memo r4). It validates and renders (plan
+`execution.permitted: false`; three attended steps on `key-cape-oidc-login`);
+it needs `--allow-unimplemented` until it is live, since it is the case that
+makes the type `implemented`. A test keeps it equal to the type's example.
+Still open before it runs: ops-mason renders and builds it (MASON-WP-0010-T02,
+T03, unblocked by T05), ops-warden plans and runs it (WARDEN-WP-0044-T02, T03),
+railiance-platform's `keycape-client-secret-generate` lane (asked by ops-mason
+`789feb39` and ops-warden `d9f889b1`, both unread), and a founder-approved
+identity-provisioner rollout containing 630ebfd.
+
 ```task
 id: NK-WP-0048-T07
 status: wait