Verify attended reset-role receipt for accepted personal account

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3

docs/release/native-password-reset-review-2026-10-30.md

@@ -206,3 +206,17 @@ Evidence: reset-observer-preparation-2026-10-31.json. The observer and shared
 transport pass92 checks; four native owner cases pass and the final observer node
 passes with unchanged directory metadata and verified fixture cleanup. Production
 observation has not been performed during preparation.
+
+
+### Attended observation received
+
+The founder completed the read at12:57:44Z on October31. Independent local receipt
+verification confirms its private custody, exact subject/endpoint and all four
+prepared source hashes. svc-authelia has only strict-readonly and no additional
+groups. tegwick has no built-in directory privilege role and one other group.
+Thus the directory-admin exclusion does not block the accepted personal flow on
+this observed state. Owner T13 is complete; T10 prepares the reviewed transition,
+including the full non-admin reach established by the native matrix. No grant,
+reset, app authorization or productive acceptance is contained in this receipt.
+Do not rerun the completed observer command. Evidence: reset-role-observation-
+2026-10-31.json and reset-role-return-verification-2026-10-31.json.

docs/release/reset-role-observation-2026-10-31.json

@@ -0,0 +1,52 @@
+{
+  "schema": "netkingdom.reset-role-observation.v1",
+  "status": "current_reset_roles_observed",
+  "observed_at": "2026-10-31T12:57:44.913538+00:00",
+  "endpoint_sha256": "21b7c63da95eb01178305e49af9b3143295607b8ad68c522d1fa9545b7ef4d9f",
+  "selected_subject_sha256": "835958a092b4fcddf93eadb83dc2d21519ed1aeab570d04a3d798a4c0f24c0ba",
+  "human_admin_role_verified": true,
+  "bind": {
+    "builtin_roles": {
+      "lldap_admin": false,
+      "lldap_password_manager": false,
+      "lldap_strict_readonly": true
+    },
+    "other_group_count": 0,
+    "matches_reviewed_service_name_filter": true,
+    "application_authority_assessed": false
+  },
+  "selected_subject": {
+    "builtin_roles": {
+      "lldap_admin": false,
+      "lldap_password_manager": false,
+      "lldap_strict_readonly": false
+    },
+    "other_group_count": 1,
+    "matches_reviewed_service_name_filter": false,
+    "application_authority_assessed": false
+  },
+  "bind_has_multiple_builtin_roles": false,
+  "membership_changed": false,
+  "password_reset_attempted": false,
+  "grant_approved": false,
+  "application_access_verified": false,
+  "credential_values_recorded": false,
+  "sources": [
+    {
+      "path": "sso-mfa/k8s/lldap/reset-authority-observe.py",
+      "sha256": "9f19c5551e2a93319c04c1b2fd0ddc0f7757fdff96ad18b81d7ee7bb393b75b9"
+    },
+    {
+      "path": "sso-mfa/k8s/lldap/lldap_admin.py",
+      "sha256": "5e39e2eac53846a97cd25151c0a4af1ffc0230db881a6325efb66de6a51bfc36"
+    },
+    {
+      "path": "identity-provisioner/provisioner.py",
+      "sha256": "a303a25d3b3876485c796a9ba0836ddaf0a0bec155b609790e028882ad983138"
+    },
+    {
+      "path": "identity-provisioner/group_provenance.py",
+      "sha256": "405e08eaaab7c21d618dff4db5970607806f32ab6c461effb81c737e32182b10"
+    }
+  ]
+}

docs/release/reset-role-return-verification-2026-10-31.json

@@ -0,0 +1,18 @@
+{
+  "schema": "coulomb.reset-role-return-verification.v1",
+  "status": "attended_role_receipt_verified",
+  "observed_at": "2026-10-31T12:57:44.913538+00:00",
+  "private_receipt_sha256": "bde2c45eda858ea317febfabefe1bd254b62c218c66fd4fb0cbec41db61fb788",
+  "private_file_owner_mode_single_link_verified": true,
+  "exact_endpoint_and_accepted_subject_verified": true,
+  "all_four_prepared_source_hashes_verified": true,
+  "bind_role": "lldap_strict_readonly",
+  "bind_other_groups": 0,
+  "accepted_subject_is_lldap_admin": false,
+  "accepted_subject_has_other_groups": 1,
+  "grant_approved": false,
+  "password_reset_attempted": false,
+  "owner_task": "NK-WP-0054-T13",
+  "owner_task_id": "278d5ba8-1c2a-58d9-a24e-2233af2c1aef",
+  "consumer_task": "CSOC-WP-0015-T06"
+}

workplans/CSOC-WP-0015-communication-runtime-acceptance.md

@@ -287,6 +287,16 @@ JSON return. The concrete command and limits are in the native-reset review;
 reset-observer-preparation-2026-10-31.json binds sources/tests. T06 remains progress;
 no actual directory-role observation, password change or grant is claimed.
 
+2026-10-31 attended role return: founder supplied the12:57:44Z observation.
+Independent private-file and source-hash verification passes; owner T13 is done.
+svc-authelia has only strict-readonly, while the accepted tegwick subject is not
+an LLDAP administrator (one other group, name not disclosed). This resolves the
+classification dependency. T10 can prepare the reviewed password-manager transition;
+its broad non-admin reach remains part of admission. No directory-admin recovery
+route is needed for this accepted flow on the observed roles, and no new policy,
+password change or productive reset acceptance is inferred. Evidence:
+reset-role-observation-2026-10-31.json and reset-role-return-verification-2026-10-31.json.
+
 ## Completion
 
 Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.