Close CCR drift and high-risk policy gaps

schemas/credential-change-request.schema.yaml

@@ -21,6 +21,7 @@ required_top_level:
 
 allowed_statuses:
   - draft
+  - in_flight
   - proposed
   - needs_changes
   - approved
@@ -68,10 +69,6 @@ workload_kv_read:
       - auth
     openbao.auth:
       - method
-      - mount
-      - role
-      - bound_claims
-      - bound_claims_confirmed
       - policies
     access_frontdoor:
       - type
@@ -87,8 +84,35 @@ workload_kv_read:
       - rotate
       - compromised
   conditional:
+    status=in_flight:
+      required:
+        - in_flight.missing_fields
+        - in_flight.blocking_reason
+        - in_flight.owner
+      allowed_missing_fields:
+        - openbao.policy_file
+        - openbao.auth
+    openbao.auth.method=token:
+      required:
+        - openbao.eso_policy_name
+        - openbao.eso_policy_file
+        - openbao.auth.token_secret
+        - openbao.auth.bootstrap_script
+        - openbao.auth.ttl
+        - openbao.auth.kubernetes_followup
+      note: Transitional ESO token auth; delegated applier does not create the token.
+    openbao.auth.method=kubernetes:
+      required:
+        - mount
+        - role
+        - bound_claims
+        - bound_claims_confirmed
     openbao.auth.method=oidc:
       required:
+        - mount
+        - role
+        - bound_claims
+        - bound_claims_confirmed
         - allowed_redirect_uris
       allowed_redirect_uris: non-empty list of OpenBao callback URIs accepted by the role
       groups_claim: requires openbao.auth.oidc_scopes to include groups