Cancel withdrawn approval operator reader without inventing auth

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_credential_change.py

@@ -134,6 +134,62 @@ class CredentialChangeTests(unittest.TestCase):
         _ccr, errors, _warnings = credential_change.validate_ccr(path)
         self.assertTrue(any("openbao.policy_file" in error for error in errors))
 
+    def cancelled_incomplete_ccr(self) -> Path:
+        source = REPO_DIR / "credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml"
+        path = self.unapproved_ccr(source)
+        data = credential_change.load_yaml(path)
+        data["status"] = "cancelled"
+        data["access_frontdoor"]["readiness"] = "disabled"
+        data["cancellation"] = {
+            "owner": "requesting-owner", "reason": "No consumer requires this reader",
+            "source_ref": "owner/docs/reader-decision.md@reviewed-commit",
+        }
+        credential_change.dump_yaml(path, data)
+        return path
+
+    def test_cancelled_incomplete_request_validates_but_cannot_apply(self) -> None:
+        path = self.cancelled_incomplete_ccr()
+        ccr, errors, warnings = credential_change.validate_ccr(path)
+        self.assertEqual(errors, [])
+        payload = credential_change.status_payload(ccr, warnings)
+        self.assertFalse(payload["apply_allowed"])
+        self.assertFalse(payload["frontdoor_resolvable"])
+        self.assertIn("got cancelled", " ".join(payload["apply_blockers"]))
+        self.assertIn("cancelled; retained omissions", credential_change.render_summary(ccr, warnings))
+        with self.assertRaises(SystemExit):
+            credential_change.command_apply_plan(type("Args", (), {"ref": str(path)})())
+
+    def test_cancelled_incomplete_request_requires_owner_evidence(self) -> None:
+        for field in ("owner", "reason", "source_ref"):
+            with self.subTest(field=field):
+                path = self.cancelled_incomplete_ccr()
+                data = credential_change.load_yaml(path)
+                del data["cancellation"][field]
+                credential_change.dump_yaml(path, data)
+                _, errors, _ = credential_change.validate_ccr(path)
+                self.assertTrue(any(f"cancellation.{field}" in e for e in errors))
+
+    def test_cancelled_omissions_do_not_bypass_other_guards(self) -> None:
+        for label in ("frontdoor", "path", "undeclared", "present", "unsupported", "reactivate"):
+            with self.subTest(label=label):
+                path = self.cancelled_incomplete_ccr()
+                data = credential_change.load_yaml(path)
+                if label == "frontdoor":
+                    data["access_frontdoor"]["readiness"] = "ready"
+                elif label == "path":
+                    data["openbao"]["kv_path"] = "platform/*"
+                elif label == "undeclared":
+                    data["in_flight"]["missing_fields"] = ["openbao.auth"]
+                elif label == "present":
+                    data["openbao"]["auth"] = {"method": "oidc"}
+                elif label == "unsupported":
+                    data["in_flight"]["missing_fields"].append("target")
+                else:
+                    data["status"] = "approved"
+                credential_change.dump_yaml(path, data)
+                _, errors, _ = credential_change.validate_ccr(path)
+                self.assertTrue(errors)
+
     def test_core_hub_runtime_lane_is_split_and_agent_denied(self) -> None:
         path = (
             REPO_DIR