Prepare reviewed Forgejo consumer ESO scope and truthful recovery records

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/proposals/2026-10-11-forgejo-consumer-eso/CCR-2026-0042-proposed-body.yaml

@@ -0,0 +1,110 @@
+id: CCR-2026-0042
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: 'forgejo-netkingdom-oidc: proposed dedicated consumer ESO reader (oidc-browser-relying-party@1.2)'
+status: proposed
+created: '2026-10-09'
+updated: '2026-10-11'
+requester:
+  agent: ops-mason
+  reason: Source-only owner refinement of existing CCR-2026-0042. Proposed type/case1.2 and full run source require
+    new exact acknowledgment; original approvals do not authorize this reader role or native delivery. Historical
+    body retained by exact file hash and provenance below.
+review:
+  required: true
+  required_approvers:
+  - platform-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: forgejo
+  environment: production
+  purpose: Dedicated namespace-local ESO reference identity delivers CLIENT_SECRET to Forgejo; the Forgejo workload/default
+    SA does not authenticate directly to OpenBao.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/keycape/forgejo
+  fields:
+  - CLIENT_SECRET
+  policy_name: workload-kv-read-keycape-forgejo-forgejo
+  policy_file: openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
+  metadata_read: false
+  token_self_lifecycle: true
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: external-secrets-keycape-forgejo-forgejo
+    audience: openbao
+    ttl: 15m
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+    policies:
+    - workload-kv-read-keycape-forgejo-forgejo
+    bound_claims:
+      service_account_names:
+      - forgejo-keycape-forgejo-eso
+      service_account_namespaces:
+      - forgejo
+    bound_claims_confirmed: false
+access_frontdoor:
+  type: external-secrets
+  catalog_id: forgejo-keycape-client
+  readiness: pending-review
+  resolvable: false
+risk:
+  classification: high
+  notes:
+  - Rendered from proposed SecurityCaseType/case 1.2 source, not an acknowledged successor. Retained read-only native
+    ESO image/CRD/RBAC and Forgejo identity observations support preparation only; bound claims remain unconfirmed
+    and apply blocked. The new sixth consumer role/auth path requires fresh informed-decision acknowledgment under
+    SecurityCaseTypes canon section 6; acknowledged type 1.1 and accepted case 1.1 do not authorize it.
+  - Exact read on one KV path; no metadata, list, parent or sibling access.
+  - Dedicated reference identity separates consumer and KeyCape role bindings, but common ESO controller already
+    has clusterwide TokenRequest and Secret permissions; no controller compromise isolation is claimed.
+  - ESO v0.16.1 TokenRequest expiry is 600 seconds and its fallback reads legacy SA token references; proposed dedicated
+    SA has no legacy tokens and automount false.
+  - Native publication requires exact1.2 acknowledgment and independent owner changes/created-only receipts; no
+    live grant is issued by this draft.
+verification:
+  positive:
+  - policy workload-kv-read-keycape-forgejo-forgejo grants read on platform/data/workloads/keycape/forgejo only
+    (capabilities check)
+  negative:
+  - a default-only identity has no read capability on the path
+  - sibling GET and parent LIST are denied
+  activation_conditions:
+  - case acceptance present
+  - bound claims confirmed by the platform owner
+lifecycle:
+  deactivate: First revert consumer reference and remove only proved-created target/delivery objects; revoke issued
+    reader tokens or await verified expiry, then delete created role and finally policy. Preserve shared/matched
+    objects.
+  rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
+  compromised: owner incident process; no automatic read, reseed or cleanup
+security_case:
+  case: forgejo-netkingdom-oidc
+  type: oidc-browser-relying-party@1.2
+  render_digest: sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35
+  acceptance_record: PENDING exact proposed1.2 owner/founder acknowledgment; original1.1 acceptance is not transferred
+  accepted_at: null
+  accepted_by: []
+historical_request:
+  path: credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml
+  sha256: a36ab567839c12660c8ca468c8e4c6a67e367c92ae2ae51851b8e34c35a277f3
+  security_case:
+    case: forgejo-netkingdom-oidc
+    type: oidc-browser-relying-party@1.0
+    render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
+    acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
+      type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
+    accepted_at: '2026-10-08'
+    accepted_by:
+    - owner
+    - founder
+proposed_refinement_readiness:
+  owner: railiance-apps
+  blocking_reason: Concrete identity and supported ESO design are prepared; native metadata apply/delivery remains
+    unapproved. Existing ORGREF-WP-0002 coordinates consumer handover and break-glass gates.

docs/proposals/2026-10-11-forgejo-consumer-eso/reader-role.json

@@ -0,0 +1,16 @@
+{
+  "bound_service_account_names": [
+    "forgejo-keycape-forgejo-eso"
+  ],
+  "bound_service_account_namespaces": [
+    "forgejo"
+  ],
+  "audience": "openbao",
+  "token_policies": [
+    "workload-kv-read-keycape-forgejo-forgejo"
+  ],
+  "token_no_default_policy": true,
+  "token_ttl": 900,
+  "token_max_ttl": 900,
+  "token_explicit_max_ttl": 900
+}

docs/proposals/2026-10-11-forgejo-consumer-eso/workload-kv-read-keycape-forgejo-forgejo.hcl

@@ -0,0 +1,15 @@
+# workload-kv-read-keycape-forgejo-forgejo: CCR-2026-0042, from ops-mason SecurityCase forgejo-netkingdom-oidc
+# (oidc-browser-relying-party@1.0, render sha256:fb8b114d...). Platform-generated from the CCR:
+# the case render omitted the token self-lifecycle stanzas that token_self_lifecycle requires.
+
+path "platform/data/workloads/keycape/forgejo" {
+  capabilities = ["read"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}