Assess password reset owner return after directory bind split

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3

docs/release/native-password-reset-review-2026-10-30.md

@@ -95,3 +95,22 @@ expiry/replay, KeyCape, user-engine HTTP and the actual app callback using an
 explicit synthetic password-manager bind. See native-recovery-browser-review-2026-10-31.md.
 That new proof does not grant production reset authority or rewrite this API-only
 receipt's scope.
+
+
+## Owner return assessed on October 31
+
+The bind split and its post-split restore drill are now complete under
+NK-WP-0054-T05. Their checks cover sign-in and MFA, not password replacement.
+The founder receipt records svc-authelia as strict-readonly. Current read-only
+metadata finds that bind in the ConfigMap and both deployed images exactly match
+this isolated proof. No current directory membership or production reset was
+queried, so this is an unresolved reset-authority return rather than a live
+failure claim. See reset-owner-return-assessment-2026-10-31.json.
+
+The same owner workplan now carries T09 (completed evidence assessment) and T10
+(supported reset authority, reviewed execution and native/recovery acceptance).
+CSOC-WP-0015-T06 consumes T10. T05 remains complete for its original migration
+scope. Previous personal reset acceptance does not establish behavior after the
+bind changed; no new grant is inferred from either the old approval or the
+synthetic password-manager success. Preparation may proceed independently of the
+pending application image and backup installation.

docs/release/reset-owner-return-assessment-2026-10-31.json

@@ -0,0 +1,111 @@
+{
+  "schema": "coulomb.reset-owner-boundary.v1",
+  "observed_at": "2026-10-31T12:27:58.389484+00:00",
+  "configmap_uid": "7af1fa0d-1bd4-47e1-8873-0f620788ef3f",
+  "configmap_resource_version": "82819079",
+  "configuration_sha256": "0a8bca50641a4c6f27830f476c2c9f413fc3795711becccb8344ee4d6c376e80",
+  "bind_is_svc_authelia": true,
+  "reset_disabled_in_config": false,
+  "deployments": {
+    "authelia": {
+      "uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
+      "generation": 31,
+      "observed_generation": 31,
+      "ready_replicas": 1,
+      "images": [
+        "docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54"
+      ]
+    },
+    "lldap": {
+      "uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
+      "generation": 9,
+      "observed_generation": 9,
+      "ready_replicas": 1,
+      "images": [
+        "docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d"
+      ]
+    }
+  },
+  "directory_memberships_read_here": false,
+  "password_reset_attempted": false,
+  "secret_read": false,
+  "email_sent": false,
+  "runtime_changed": false,
+  "status": "reset_authority_return_incomplete",
+  "owner_bind_split_task": "NK-WP-0054-T05",
+  "owner_bind_split_status": "done",
+  "owner_followthrough": "NK-WP-0054-T10",
+  "consumer_task": "CSOC-WP-0015-T06",
+  "owner_membership_receipt_at": "2026-10-30T18:53:16.176849+00:00",
+  "owner_receipt_bind_groups": [
+    "lldap_strict_readonly"
+  ],
+  "owner_restore_drill_proves": [
+    "independent retrieval",
+    "directory login",
+    "Authelia first factor",
+    "by-user MFA",
+    "cleanup"
+  ],
+  "owner_restore_drill_proves_password_change": false,
+  "deployed_images_match_isolated_reset_proof": true,
+  "isolated_readonly_reset_result": "HTTP 200/KO; old password accepted; replacement refused",
+  "isolated_password_manager_reset_result": "ordinary fixture user changed password; directory group creation refused",
+  "production_password_reset_failure_claimed": false,
+  "current_membership_unknown_since_owner_receipt": true,
+  "prior_personal_reset_acceptance": "preserved as historical; does not prove post-split reset",
+  "knowledge_orientation": {
+    "version": "0.2.7",
+    "digest": "22b7294e24137c0a350764b9cf37f3d4f2e9f35eb7c97a287d9c89477ef24d7a",
+    "cards": [
+      "start",
+      "identity"
+    ],
+    "source_status": "verified-files",
+    "authority": "orientation only"
+  },
+  "sources": [
+    {
+      "repo": "net-kingdom",
+      "commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
+      "path": "workplans/NK-WP-0054-service-identity-policy.md",
+      "sha256": "1b5411a38583edede8124881825f252b2498335de22559e23d52c787d9c9581a"
+    },
+    {
+      "repo": "net-kingdom",
+      "commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
+      "path": "docs/evidence/2026-10-30-nk54-bind-split/10-verify.json",
+      "sha256": "b6318e9239623a09d3f6eac1208b0fd7c7a3d3facf55a4c31c8f628454e42ebb"
+    },
+    {
+      "repo": "net-kingdom",
+      "commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
+      "path": "docs/evidence/2026-10-31-identity-restore-drill/drill.json",
+      "sha256": "47a5a88bdc8a7494d9e5e6687372398367931dca84e38d7de9f6290375caffa2"
+    },
+    {
+      "repo": "net-kingdom",
+      "commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
+      "path": "tools/bootstrap-recovery/isolated-authelia.py",
+      "sha256": "6139294f6ebdcbaad35934f04b11177d8cf89d134506a730f0c0ebbb3a4967be"
+    },
+    {
+      "repo": "net-kingdom",
+      "commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
+      "path": "sso-mfa/k8s/lldap/bind-split.py",
+      "sha256": "4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3"
+    },
+    {
+      "repo": "coulomb-social",
+      "commit": "a786a8050db92807d0f16e637043fbd191ab9335",
+      "path": "docs/release/native-password-reset-2026-10-30.json",
+      "sha256": "0666b35773ee3888e12d8d8d877bd8690c9c41b6f98096bf3c5a50195be2294f"
+    },
+    {
+      "repo": "coulomb-social",
+      "commit": "a786a8050db92807d0f16e637043fbd191ab9335",
+      "path": "docs/release/native-recovery-browser-2026-10-31.json",
+      "sha256": "4d3b644cdf0e76e8ff775a79d8845831f7573a1e2e716e60dd53416343b6e3ba"
+    }
+  ]
+}

workplans/CSOC-WP-0015-communication-runtime-acceptance.md

@@ -245,13 +245,27 @@ Acceptance scope split from T04: current Case B, UC-010 registration and UC-011
 
 ```task
 id: CSOC-WP-0015-T06
-status: todo
+status: progress
+depends_on: [NK-WP-0054-T10]
 priority: high
 state_hub_task_id: "e17a6d09-1fdd-5fa1-a36d-763802e37f7f"
 ```
 
 Remaining owner admission from T04 is canonical NK-WP-0054-T05. Isolated native Authelia/LLDAP reset and full browser integration are proven, including read-only-bind refusal and successful scoped password replacement. Obtain and assess the owner native authority/runtime return; preserve MFA/TLS/directory boundaries and link acceptance here. Do not create a duplicate provisioning lane or infer a live grant from the synthetic proof. Evidence: `docs/release/native-recovery-browser-review-2026-10-31.md` and `native-password-reset-review-2026-10-30.md`.
 
+2026-10-31 owner-return assessment: NK-WP-0054-T05 is now done and its founder
+bind migration plus restore drill have been inspected. They prove sign-in/MFA,
+not post-split password change. Current native ConfigMap uses svc-authelia; both
+Ready native images match our isolated proof, and the dated owner receipt assigns
+strict-readonly. This establishes an unclosed reset-authority requirement, not a
+claimed production reset attempt. NK-WP-0054-T09 records the completed assessment;
+T10 now owns supported reset authority, preparation, explicit admission, native
+return and recovery verification in the same owner workplan. T06 advanced to
+progress for this assessment and consumes T10; it cannot close on T05's done label.
+Evidence: docs/release/reset-owner-return-assessment-2026-10-31.json. No credential,
+mail, password, directory grant or live configuration was changed. Prior personal
+reset acceptance is preserved with its original date and scope.
+
 ## Completion
 
 Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.