Cancel withdrawn approval operator reader without inventing auth

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

scripts/credential-change.py

@@ -191,8 +191,16 @@ def reject_secret_text(text: str, field: str) -> None:
 
 def validate_workload_kv_read(ccr: dict[str, Any], errors: list[str], warnings: list[str]) -> None:
     in_flight = ccr.get("status") == "in_flight"
+    abandoned_incomplete = ccr.get("status") == "cancelled" and "in_flight" in ccr
     missing_fields: set[str] = set()
-    if in_flight:
+    if abandoned_incomplete:
+        cancellation = require_object(ccr.get("cancellation"), "cancellation", errors)
+        for field in ("owner", "reason", "source_ref"):
+            require_string(cancellation.get(field), f"cancellation.{field}", errors)
+        frontdoor = ccr.get("access_frontdoor") or {}
+        if not isinstance(frontdoor, dict) or frontdoor.get("readiness") != "disabled":
+            errors.append("cancelled incomplete request requires disabled front door")
+    if in_flight or abandoned_incomplete:
         declaration = require_object(ccr.get("in_flight"), "in_flight", errors)
         listed_missing = require_list(
             declaration.get("missing_fields"), "in_flight.missing_fields", errors
@@ -504,7 +512,15 @@ def render_summary(ccr: dict[str, Any], warnings: list[str]) -> str:
         )
     else:
         missing = ", ".join(ccr.get("in_flight", {}).get("missing_fields", []))
-        lines.append(f"  in flight; declared missing: {missing}")
+        label = "cancelled; retained omissions" if ccr.get("status") == "cancelled" else "in flight; declared missing"
+        lines.append(f"  {label}: {missing}")
+    if ccr.get("status") == "cancelled" and ccr.get("cancellation"):
+        cancellation = ccr["cancellation"]
+        lines.extend([
+            f"Cancellation owner: {cancellation['owner']}",
+            f"Reason: {cancellation['reason']}",
+            f"Source: {cancellation['source_ref']}",
+        ])
     lines.extend(
         [
             "Access front door:",