Prepare reviewed Forgejo consumer ESO scope and truthful recovery records

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/forgejo-consumer-generated-ccr-refinement.json

@@ -0,0 +1,64 @@
+{
+  "scope": "source-only _ccr target/auth/lifecycle projection; proposed successor public build remains refused",
+  "target": {
+    "domain": "infotech",
+    "tenant": "platform",
+    "workload": "forgejo",
+    "environment": "production",
+    "purpose": "The consuming service reads the same secret. No metadata, list, parent or sibling access."
+  },
+  "openbao": {
+    "mount": "platform",
+    "kv_path": "platform/workloads/keycape/forgejo",
+    "fields": [
+      "CLIENT_SECRET"
+    ],
+    "policy_name": "workload-kv-read-keycape-forgejo-forgejo",
+    "policy_file": "openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl",
+    "metadata_read": false,
+    "token_self_lifecycle": true,
+    "auth": {
+      "method": "kubernetes",
+      "mount": "kubernetes",
+      "role": "external-secrets-keycape-forgejo-forgejo",
+      "audience": "openbao",
+      "ttl": "15m",
+      "token_max_ttl": "15m",
+      "token_explicit_max_ttl": "15m",
+      "token_no_default_policy": true,
+      "policies": [
+        "workload-kv-read-keycape-forgejo-forgejo"
+      ],
+      "bound_claims": {
+        "service_account_names": [
+          "forgejo-keycape-forgejo-eso"
+        ],
+        "service_account_namespaces": [
+          "forgejo"
+        ]
+      },
+      "bound_claims_confirmed": false
+    }
+  },
+  "lifecycle": {
+    "deactivate": "Revert the consumer reference first; remove only independently proved case-created delivery objects, role and policy, preserving preexisting-matched and shared objects. Revoke issued reader tokens through owner custody or prove independently verified expiry before declaring deactivation; role/SA/store deletion alone does not revoke tokens. Recovery uses existing owner admission: no new login and no remint. Preserve authenticated creation/ownership/recovery receipts and stop on changed references, UIDs or ownership.",
+    "rotate": "roll-forward through the credential broker (mint-secret); never a read of the old value",
+    "compromised": "owner incident process; no automatic read, reseed or cleanup"
+  },
+  "live_apply": false,
+  "acceptance_inferred": false,
+  "current1.1_output_checks": [
+    {
+      "policy": "keycape-reader-policy",
+      "changed_fields": [],
+      "keycape_output_byte_semantics_preserved": true
+    },
+    {
+      "policy": "consumer-reader-policy",
+      "changed_fields": [
+        "target.workload"
+      ],
+      "keycape_output_byte_semantics_preserved": false
+    }
+  ]
+}