Cancel withdrawn approval operator reader without inventing auth

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml

@@ -3,9 +3,20 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Client-side read of the approval-engine-operator client secret
-status: in_flight
+status: cancelled
 created: '2026-09-09'
-updated: '2026-09-09'
+updated: '2026-09-10'
+cancellation:
+  owner: approval-engine
+  reason: >-
+    Requesting owner withdrew the combined lifecycle operator client: no
+    presenter exists and no client-side reader is wanted. Human approval belongs
+    to informed-decision; any future service presenter needs a narrow new request.
+    Completed verifier custody CCR-2026-0018 remains unchanged.
+  source_ref: >-
+    approval-engine@849c75bb094613ff6ac1a1d4cda56a745520c5a1:docs/keycape-service-registrations.md#approval-engine-operator
+  recorded_at: '2026-09-10'
+# Historical omissions retained so cancellation does not invent an auth binding.
 in_flight:
   missing_fields:
   - openbao.auth
@@ -85,10 +96,11 @@ access_frontdoor:
   catalog_id: approval-engine-operator-client
   selector: approval-engine operator client secret
   resolvable: false
-  readiness: pending-review
+  readiness: disabled
 delivery:
-  surface: undetermined
+  surface: none
   target: >-
+    Cancelled on owner withdrawal; the following alternatives were never admitted.
     Not determined. The delivery surface follows the actor: an attended operator
     implies a protected workstation file, an in-cluster component implies an
     ExternalSecret into the eventual approval-engine namespace, and an agent