NK-WP-0048-T06: write the Forgejo reference case (accepted)

security-cases/forgejo-netkingdom-oidc.yaml carries the founder's 2026-10-08
acceptance of the key-cape request; validates and renders plan-only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469893@bnt-lap001
Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb

security-cases/forgejo-netkingdom-oidc.yaml

@@ -0,0 +1,33 @@
+# First KnownSecurityCase of oidc-browser-relying-party 1.0 (NK-WP-0048-T06).
+# Parameters are the request the founder accepted on 2026-10-08
+# (key-cape docs/forgejo-oidc-client-request.yaml, KEY-WP-0038-T01); that
+# acceptance carries over as this case's acceptance. One difference: custody is
+# derived by the type (platform/workloads/keycape/forgejo), not the request's
+# proposed platform/workloads/forgejo/netkingdom-oidc-client. The founder
+# acknowledged that derivation with the type (memo r4, 2026-10-09).
+apiVersion: netkingdom.io/security-case/v0.1
+kind: SecurityCase
+spec:
+  id: forgejo-netkingdom-oidc
+  type: oidc-browser-relying-party@1.0
+  status: accepted
+  acceptance:
+    at: "2026-10-08"
+    record: "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e"
+    by:
+      - {role: owner, name: "founder (for railiance-apps)"}
+      - {role: founder, name: founder}
+  owner:
+    repo: railiance-apps
+    person: founder
+  parameters:
+    client_id: forgejo
+    display_name: Forgejo source forge
+    redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
+    allowed_scopes: openid,profile,email,groups
+    client_type: confidential
+    mfa_required: "true"
+    access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers
+    initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick
+    consuming_service: forgejo
+    consumer_owner_repo: railiance-apps