the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1

Apps chart projection r1: concrete references, unsupported exact group gate

This isolated packet is based on Apps 944b30ad63ab054cc24617e374e177d34cd572da and NetKingdom befb0bc68cd25b625804fce559476eefd702521d proposed 1.3. It does not establish accepted case/source authority, owner acknowledgment or integration. Canonical Apps/NetKingdom/KeyCape source, workplan status and seven kernel steps were not changed. No commit, credentials, production/native/cluster call or paid/model operation was used. The only external reads were public upstream chart/source downloads. No HOME configs were inspected.

The actual chart 12.5.0 archive matches the digest in its official public index. Its default appVersion is 1.25.4, but actual Apps values override the image to Forgejo 11.0.3. Real offline Helm template rendering proves the existing CLIENT_SECRET delivery can be consumed unchanged through an indexed deployment.env secretKeyRef and a public OAuth client key. It also proves existingSecret would request incompatible key/secret keys and an invented list field survives Helm while becoming an unsupported CLI flag.

The full first-case preparer intentionally refuses: Forgejo 11.0.3 supports one exact required-claim value, whereas this case requires any of three groups. No joined value, regex, group subset or weakened gate is emitted. See OWNER-CHANGE.md for exact pinned source evidence and the concrete owner proposal, including the separately required review/re-freeze. KeyCape currently has no configurable union claim implementation.

apps-source.patch is an exact isolated Apps proposal with only the safe preparatory ENABLE_AUTO_REGISTRATION: false, ACCOUNT_LINKING: login public values delta and a pure offline projection module. It adds no actual OAuth source to the real case. Local sign-in and all other values/references are preserved. The module has no I/O or dispatcher and refuses activation. Its single-group rendering path is a synthetic compatibility control, never an alternative first case or an operational backend. The existing prior forgejo_configuration_prepare.py generic backend is neither replaced nor represented as chart-compatible activation.

Nine offline tests cover source pins/decoded source, complete unrelated value preservation, other OAuth sources and secret refs, indexed collisions, unknown fields versus actual CLI, existingSecret mismatch, exact first-case refusal and unconditional dispatch refusal. The actual Helm chart archive and pinned public source are retained for repeatable offline review; the private helper is neither run nor simulated with a secret. No full upgrade manifest is claimed because DB/admin private values are intentionally absent. Source evidence and a literal comparison table are not a running Forgejo callback/login proof.

Run the retained review suite from any directory with Python/PyYAML and the existing Helm binary (the suite creates an empty HOME and isolated Helm paths):

python3 tests/test_forgejo_chart_projection.py

The suite is packet-scoped review evidence. The Apps patch contains the module and policy delta; tests/fixtures remain in this packet, not an assertion that owner integration has occurred. validation.json retains the failed initial fixture selector run as well as final verification; no failure is counted as a successful native trial. Durable operation/inverse sessions, authenticated configuration journal, release-wide writer exclusion and consumer login/group probes remain separately open. activate() remains unavailable irrespective of caller-supplied approval/session/journal flags.