WARDEN-WP-0026 T01: capabilities-safe lane verification + incident note

T01 (done): canonical capabilities-based verify pattern in the fleet promotion
checklist (catalog-lane-promotion.md) and applied to the railiance-backup and
forgejo-admin lane playbooks. Verification proves allow/deny via
`bao token capabilities` against the KV v2 data path, never `bao kv get`; a denied
default-policy token-create is a pass, not a privileged-fallback trigger.

T07 (progress): lessons-learned note for the 2026-07-16 CCR-2026-0004 disclosure
(three root causes). Live re-verify + rotation block remain (depend on T06).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

wiki/playbooks/forgejo-admin-api-token.md

@@ -95,6 +95,30 @@ After CCR approval and policy apply:
 
 ---
 
+## Verify the lane (capabilities-safe — never read the value)
+
+Prove allow/deny with `bao token capabilities`, **not** `bao kv get -field=…`.
+`bao kv metadata get` (above) is fine — it shows versions, not values. Reading the
+data field to "confirm" it is the anti-pattern
+(`wiki/playbooks/catalog-lane-promotion.md#capabilities-safe-lane-verification`).
+
+```bash
+# Positive: lane OIDC identity can read the data path
+bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read
+bao token capabilities "$(bao print token)" platform/data/workloads/forgejo/forgejo-admin
+#   → expect: read
+
+# Negative: default-only identity is denied
+DEFAULT_TOKEN=$(bao token create -policy=default -field=token)   # if denied, that IS the pass — do NOT fall back
+bao token capabilities "$DEFAULT_TOKEN" platform/data/workloads/forgejo/forgejo-admin
+#   → expect: deny
+```
+
+Confirming the PAT works against Forgejo is a separate, value-using action — fetch
+`--field API_TOKEN` into an env var and call `/api/v1/user`; never paste the token.
+
+---
+
 ## Consumers (downstream wiring — after lane verified)
 
 | Consumer | Repo |