{
  "scope": "source-only _ccr target/auth/lifecycle projection; proposed successor public build remains refused",
  "target": {
    "domain": "infotech",
    "tenant": "platform",
    "workload": "forgejo",
    "environment": "production",
    "purpose": "The consuming service reads the same secret. No metadata, list, parent or sibling access."
  },
  "openbao": {
    "mount": "platform",
    "kv_path": "platform/workloads/keycape/forgejo",
    "fields": [
      "CLIENT_SECRET"
    ],
    "policy_name": "workload-kv-read-keycape-forgejo-forgejo",
    "policy_file": "openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl",
    "metadata_read": false,
    "token_self_lifecycle": true,
    "auth": {
      "method": "kubernetes",
      "mount": "kubernetes",
      "role": "external-secrets-keycape-forgejo-forgejo",
      "audience": "openbao",
      "ttl": "15m",
      "token_max_ttl": "15m",
      "token_explicit_max_ttl": "15m",
      "token_no_default_policy": true,
      "policies": [
        "workload-kv-read-keycape-forgejo-forgejo"
      ],
      "bound_claims": {
        "service_account_names": [
          "forgejo-keycape-forgejo-eso"
        ],
        "service_account_namespaces": [
          "forgejo"
        ]
      },
      "bound_claims_confirmed": false
    }
  },
  "lifecycle": {
    "deactivate": "Revert the consumer reference first; remove only independently proved case-created delivery objects, role and policy, preserving preexisting-matched and shared objects. Revoke issued reader tokens through owner custody or prove independently verified expiry before declaring deactivation; role/SA/store deletion alone does not revoke tokens. Recovery uses existing owner admission: no new login and no remint. Preserve authenticated creation/ownership/recovery receipts and stop on changed references, UIDs or ownership.",
    "rotate": "roll-forward through the credential broker (mint-secret); never a read of the old value",
    "compromised": "owner incident process; no automatic read, reseed or cleanup"
  },
  "live_apply": false,
  "acceptance_inferred": false,
  "current1.1_output_checks": [
    {
      "policy": "keycape-reader-policy",
      "changed_fields": [],
      "keycape_output_byte_semantics_preserved": true
    },
    {
      "policy": "consumer-reader-policy",
      "changed_fields": [
        "target.workload"
      ],
      "keycape_output_byte_semantics_preserved": false
    }
  ]
}