Bind reset observation to accepted account and prepare operator steps

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3

docs/release/native-password-reset-review-2026-10-30.md

@@ -154,8 +154,8 @@ classification has been inferred from these fixtures.
 Owner T11 records this completed rehearsal; T10 retains the supported runtime path.
 Before an executable proposal, obtain owner-authorized, value-free classification
 of the intended reset subjects and current bind memberships. Review a service-owned
-password-write grant against SI-3 and its complete non-LLDAP-admin reach, and a
-separate supported recovery route for directory administrators. Preserve the
+password-write grant against SI-3 and its complete non-LLDAP-admin reach, and, if the accepted subject is a directory administrator, a
+supported recovery route for that subject. Preserve the
 existing human-admin separation and MFA requirements. A role change alone is not
 a complete proposal, and no runtime grant or policy exception is approved here.
 
@@ -167,3 +167,42 @@ scenarios still pass; the full `make check` gate passes 546 tests with zero
 failures/errors/skips. These checks add neither productive acceptance nor a
 current membership observation. Existing expiry/browser/app proof retains its
 separate scope; this matrix does not retest the complete issuer/MFA journey.
+
+
+## Current-role observation for the accepted account
+
+The October6 acceptance record names **tegwick**
+(`history/20261006T185411Z-personal-workspace-acceptance.md`). Decision
+8770d4ea-8538-4f88-a9f8-8bcfb0542603 corrects the earlier inference that a new route
+for all directory administrators must precede this consumer's remedy. Check
+tegwick's current membership first. If it is an LLDAP administrator, its supported
+recovery path is required; otherwise retain the administrator exclusion under
+existing NetKingdom recovery ownership. The admitted password-write scope still
+requires explicit review. This preserves the accepted workflow and adds no grant.
+
+The fixed-subject observer is prepared and tested (owner T12); actual observation
+is owner T13. Run these commands in your own workstation terminal:
+
+```bash
+install -d -m 700 /home/worsch/.local/state/net-kingdom/reset-authority
+python3 /home/worsch/net-kingdom/sso-mfa/k8s/lldap/reset-authority-observe.py \
+  --receipt /home/worsch/.local/state/net-kingdom/reset-authority/roles-20261031.json
+```
+
+Enter the **human admin account's password** at the hidden prompt. The tool already
+selects tegwick, svc-authelia and admin; it asks for no username, token or backup
+credential. Do not paste the password into chat. Return only its JSON result.
+The existing NetKingdom bind helper uses this human-held input for authenticated
+reads; the new observer reuses its bounded transport without credential discovery.
+
+Expected status is `current_reset_roles_observed`. It creates a mode0600 local
+receipt, signs in as admin and performs three read queries. It changes no group,
+password, declaration or deployment, sends no reset email, and grants nothing.
+TLS failures and unexpected/missing users refuse; do not bypass verification.
+An existing receipt refuses without overwrite. A successful result proves current
+role metadata only, not Authelia reset success, app authorization or acceptance.
+
+Evidence: reset-observer-preparation-2026-10-31.json. The observer and shared
+transport pass92 checks; four native owner cases pass and the final observer node
+passes with unchanged directory metadata and verified fixture cleanup. Production
+observation has not been performed during preparation.

docs/release/reset-observer-preparation-2026-10-31.json

@@ -0,0 +1,77 @@
+{
+  "schema": "netkingdom.reset-observer-preparation.v1",
+  "status": "tested_ready_for_attended_read",
+  "owner_task": "NK-WP-0054-T12",
+  "operator_return_task": "NK-WP-0054-T13",
+  "consumer_task": "CSOC-WP-0015-T06",
+  "accepted_subject": "tegwick",
+  "acceptance_source": {
+    "repo": "coulomb-social",
+    "path": "history/20261006T185411Z-personal-workspace-acceptance.md",
+    "sha256": "15ac9e1af4d0cb16b854d1ecf5fa89b634b1479174b02143b5c341cb3b5df2c3"
+  },
+  "technical_binding_decision_id": "8770d4ea-8538-4f88-a9f8-8bcfb0542603",
+  "queries": [
+    "human admin role",
+    "svc-authelia roles",
+    "tegwick roles"
+  ],
+  "private_input": "human admin password via terminal only",
+  "directory_mutations_available": false,
+  "production_observation_performed": false,
+  "password_reset_attempted": false,
+  "grant_approved": false,
+  "target_url": "https://lldap.coulomb.social",
+  "planned_private_receipt": "/home/worsch/.local/state/net-kingdom/reset-authority/roles-20261031.json",
+  "gates": {
+    "unit_and_transport": {
+      "tests": 92,
+      "failures": 0,
+      "errors": 0,
+      "skipped": 0,
+      "junit_sha256": "7ee639ba82c7100d7805cc01ca5c2a6c502550eac4abdb252ad3c7d8b1ac232b"
+    },
+    "native_split_regression": {
+      "tests": 4,
+      "failures": 0,
+      "errors": 0,
+      "skipped": 0,
+      "junit_sha256": "b35645a61c52f45d0e826e3986145212f45d4abc065026b42bd651f6f4b5fb41"
+    },
+    "final_native_observer": {
+      "tests": 1,
+      "failures": 0,
+      "errors": 0,
+      "skipped": 0,
+      "junit_sha256": "251831ae820081aa6e935d08c4e7854a1ad5cf840b8a41ae8af4add5f5406f2a"
+    }
+  },
+  "native_fixture": "pinned owner LLDAP fixture; synthetic credentials, loopback-only published ports; container and volume removal verified",
+  "lint": "passed",
+  "sources": [
+    {
+      "path": "sso-mfa/k8s/lldap/reset-authority-observe.py",
+      "sha256": "9f19c5551e2a93319c04c1b2fd0ddc0f7757fdff96ad18b81d7ee7bb393b75b9"
+    },
+    {
+      "path": "sso-mfa/k8s/lldap/lldap_admin.py",
+      "sha256": "5e39e2eac53846a97cd25151c0a4af1ffc0230db881a6325efb66de6a51bfc36"
+    },
+    {
+      "path": "identity-provisioner/provisioner.py",
+      "sha256": "a303a25d3b3876485c796a9ba0836ddaf0a0bec155b609790e028882ad983138"
+    },
+    {
+      "path": "identity-provisioner/group_provenance.py",
+      "sha256": "405e08eaaab7c21d618dff4db5970607806f32ab6c461effb81c737e32182b10"
+    },
+    {
+      "path": "tests/test_reset_authority_observer.py",
+      "sha256": "348fab447a4182357bf3f7d058b05c7d6088ae084d8e433e76ce5c39c513e152"
+    },
+    {
+      "path": "sso-mfa/k8s/lldap/test_bind_split.py",
+      "sha256": "ae69051a3df4596fe220306d88a28b2c12e42fbfe3587e02135e3684eb5f354a"
+    }
+  ]
+}