Cancel withdrawn approval operator reader without inventing auth

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

schemas/credential-change-request.schema.yaml

@@ -84,6 +84,21 @@ workload_kv_read:
       - rotate
       - compromised
   conditional:
+    status=cancelled_with_in_flight_declaration:
+      required:
+        - in_flight.missing_fields
+        - in_flight.blocking_reason
+        - in_flight.owner
+        - cancellation.owner
+        - cancellation.reason
+        - cancellation.source_ref
+      allowed_missing_fields:
+        - openbao.policy_file
+        - openbao.auth
+      access_frontdoor:
+        readiness: disabled
+        resolvable: false
+      note: Retain abandoned omissions without inventing a binding; all other validation and apply refusals remain.
     status=in_flight:
       required:
         - in_flight.missing_fields