diff --git a/credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml b/credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml
new file mode 100644
index 0000000..de7aafc
--- /dev/null
+++ b/credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml
@@ -0,0 +1,86 @@
+id: CCR-2026-0041
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.0)'
+status: proposed
+created: '2026-10-09'
+updated: '2026-10-09'
+requester:
+  agent: ops-mason
+  reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render
+    sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08:
+    key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged
+    via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance
+    replaces a fresh executive summary.'
+review:
+  required: true
+  required_approvers:
+  - platform-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: keycape
+  environment: production
+  purpose: KeyCape reads its client secret only through ESO. No metadata, list, parent or sibling access.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/keycape/forgejo
+  fields:
+  - CLIENT_SECRET
+  policy_name: workload-kv-read-keycape-forgejo-eso
+  policy_file: openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl
+  metadata_read: false
+  token_self_lifecycle: true
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: external-secrets-keycape-forgejo
+    audience: openbao
+    ttl: 15m
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+    policies:
+    - workload-kv-read-keycape-forgejo-eso
+    bound_claims:
+      service_account_names:
+      - external-secrets
+      service_account_namespaces:
+      - external-secrets
+    bound_claims_confirmed: false
+access_frontdoor:
+  type: external-secrets
+  catalog_id: forgejo-keycape-client
+  readiness: pending-review
+  resolvable: false
+risk:
+  classification: high
+  notes:
+  - Rendered from an acknowledged SecurityCaseType; shape reviewed with the type, names checked against live structure.
+  - Exact read on one KV path; no metadata, list, parent or sibling access.
+verification:
+  positive:
+  - policy workload-kv-read-keycape-forgejo-eso grants read on platform/data/workloads/keycape/forgejo only (capabilities
+    check)
+  negative:
+  - a default-only identity has no read capability on the path
+  - sibling GET and parent LIST are denied
+  activation_conditions:
+  - case acceptance present
+  - bound claims confirmed by the platform owner
+lifecycle:
+  deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-eso (case rollback)
+  rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
+  compromised: owner incident process; no automatic read, reseed or cleanup
+security_case:
+  case: forgejo-netkingdom-oidc
+  type: oidc-browser-relying-party@1.0
+  render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
+  acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
+    type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
+  accepted_at: '2026-10-08'
+  accepted_by:
+  - owner
+  - founder
diff --git a/credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml b/credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml
new file mode 100644
index 0000000..7733c3e
--- /dev/null
+++ b/credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml
@@ -0,0 +1,74 @@
+id: CCR-2026-0042
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: 'forgejo-netkingdom-oidc: consumer-reader-policy (oidc-browser-relying-party@1.0)'
+status: in_flight
+created: '2026-10-09'
+updated: '2026-10-09'
+requester:
+  agent: ops-mason
+  reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render
+    sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08:
+    key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged
+    via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance
+    replaces a fresh executive summary.'
+review:
+  required: true
+  required_approvers:
+  - platform-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: keycape
+  environment: production
+  purpose: The consuming service reads the same secret. No metadata, list, parent or sibling access.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/keycape/forgejo
+  fields:
+  - CLIENT_SECRET
+  policy_name: workload-kv-read-keycape-forgejo-forgejo
+  policy_file: openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
+  metadata_read: false
+  token_self_lifecycle: true
+access_frontdoor:
+  type: none
+  catalog_id: forgejo-keycape-client
+  readiness: pending-review
+  resolvable: false
+risk:
+  classification: high
+  notes:
+  - Rendered from an acknowledged SecurityCaseType; shape reviewed with the type, names checked against live structure.
+  - Exact read on one KV path; no metadata, list, parent or sibling access.
+verification:
+  positive:
+  - policy workload-kv-read-keycape-forgejo-forgejo grants read on platform/data/workloads/keycape/forgejo only
+    (capabilities check)
+  negative:
+  - a default-only identity has no read capability on the path
+  - sibling GET and parent LIST are denied
+  activation_conditions:
+  - case acceptance present
+  - bound claims confirmed by the platform owner
+lifecycle:
+  deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-forgejo (case rollback)
+  rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
+  compromised: owner incident process; no automatic read, reseed or cleanup
+security_case:
+  case: forgejo-netkingdom-oidc
+  type: oidc-browser-relying-party@1.0
+  render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
+  acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
+    type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
+  accepted_at: '2026-10-08'
+  accepted_by:
+  - owner
+  - founder
+in_flight:
+  missing_fields:
+  - openbao.auth
+  owner: railiance-apps
+  blocking_reason: railiance-apps binds this reader to forgejo's own identity in its deployment path (hand-over).
diff --git a/openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl b/openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl
new file mode 100644
index 0000000..a02a426
--- /dev/null
+++ b/openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl
@@ -0,0 +1,15 @@
+# workload-kv-read-keycape-forgejo-eso: CCR-2026-0041, from ops-mason SecurityCase forgejo-netkingdom-oidc
+# (oidc-browser-relying-party@1.0, render sha256:fb8b114d...). Platform-generated from the CCR:
+# the case render omitted the token self-lifecycle stanzas that token_self_lifecycle requires.
+
+path "platform/data/workloads/keycape/forgejo" {
+  capabilities = ["read"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}
diff --git a/openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl b/openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
new file mode 100644
index 0000000..8a2478d
--- /dev/null
+++ b/openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
@@ -0,0 +1,15 @@
+# workload-kv-read-keycape-forgejo-forgejo: CCR-2026-0042, from ops-mason SecurityCase forgejo-netkingdom-oidc
+# (oidc-browser-relying-party@1.0, render sha256:fb8b114d...). Platform-generated from the CCR:
+# the case render omitted the token self-lifecycle stanzas that token_self_lifecycle requires.
+
+path "platform/data/workloads/keycape/forgejo" {
+  capabilities = ["read"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}