Record native ESO result and prepare scoped self-token amendment

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

credential-change-requests/CCR-2026-0032.yaml

@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Informed Decision create-only requester workload read
-status: approved
+status: proposed
 created: '2026-10-04'
 updated: '2026-10-04'
 requester:
@@ -46,6 +46,16 @@ review:
       approval. Attended OpenBao OIDC/MFA and native verification remain required;
       broader lifecycle cutover and separate issuer rotation are not approved by this
       record.'
+  - at: '2026-10-04T21:21:12.702154+00:00'
+    reviewer: codex
+    decision: amendment_proposed
+    comment: Prior approved metadata was applied and verified by attended helper exit
+      0. ArgoCD delivered the three objects, but native ESO validation receives 403
+      at auth/token/lookup-self. Propose adding only lookup-self read and revoke-self
+      update, as required by existing ESO reader pattern. Exact KV path, bound identity,
+      audience, TTL and no-default-policy remain unchanged. This amendment requires
+      founder approval and attended administration; prior approval is retained in
+      history.
 target:
   domain: financials
   tenant: platform
@@ -78,6 +88,7 @@ openbao:
       service_account_namespaces:
       - informed-decision
     bound_claims_confirmed: true
+  token_self_lifecycle: true
 access_frontdoor:
   type: external-secrets
   catalog_id: informed-decision-sitting-requester-eso