coulomb-social/docs/release/native-password-reset-review-2026-10-30.md

Native password-reset bind prerequisite

WP-0015-T04 remains open. An isolated native Authelia/LLDAP test identifies a directory permission prerequisite before the full UC-009 browser journey can be accepted. It does not change the existing personal reset acceptance, prove the currently installed bind's privileges or authorize any live permission change.

The inspected NetKingdom source assigns svc-authelia to lldap_strict_readonly in sso-mfa/k8s/lldap/bind-split.py. The Authelia ConfigMap binds as that account. The owner rehearsal checks first-factor login, which succeeds under this role. Password reset needs a separate write operation; first-factor success cannot establish recovery readiness.

scripts/rehearse-native-password-reset.py now runs the actual pinned Authelia 4.39.28 and LLDAP 0.6.2 binaries against a fresh synthetic directory. It tests the read-only role and then the password-manager role on a dedicated fixture account, with a fresh Authelia store for each case. No owner checkout is changed.

Check	Strict read-only bind	Password-manager bind
Human first-factor login	Succeeds	Succeeds
Native reset notification generated	Yes	Yes
Valid reset-link identity verification	Succeeds	Succeeds
Password change	Refused; HTTP 200 with status: KO	Succeeds; HTTP 200 with empty body
Old directory password afterward	Still accepted	Refused
Replacement directory password afterward	Refused	Accepted
Consumed reset-link replay	Refused	Refused
Reset without verified challenge	Refused	Refused
Interactive Authelia login as service bind	Refused by the service-account filter	Refused by the same filter
Directory group creation using the service identity	Refused	Refused

The test checks native response status and actual directory authentication. An HTTP 200 alone would misclassify the read-only failure. Usable handles, cookies, passwords and notification text remain private and are absent from the public receipt. The password-manager result concerns an ordinary synthetic human; it does not establish privileged-account recovery or every directory right.

Authelia's LLDAP integration documentation requires the bind to support password changes when reset is desired. The pinned native reset handler performs that update after identity verification. These native test results confirm the boundary without relying on a protocol double.

Isolation and repetition

python3 scripts/rehearse-native-password-reset.py \
  --output /tmp/fresh-native-reset-receipt.json

The command requires the three retained image digests named in its source; it never pulls. The product image supplies only the Python standard-library probe; its application entrypoint and Django are not started. The test uses the default local Unix Docker socket, a unique network-none directory container, and Authelia/probes sharing only that container's loopback namespace. Backend containers are inspected before fixture import: read-only root, nonroot UID, dropped capabilities, no new privileges, bounded CPU/memory, no published ports, no devices and exclusively private tmpfs mounts. The probe also checks that only loopback exists and no external IPv4 routes exist.

Only generated synthetic credentials are delivered through pipes into tmpfs. There is no live configuration, production data, key custody, SMTP provider, external DNS reachability, host mount, persistent volume or network bridge. Native notifications use Authelia's private filesystem notifier, not an SMTP/inbox delivery claim. The API probe emulates the local proxy's forwarded headers and secure-cookie transport; it is not browser or TLS verification. All backend/probe containers are removed and their absence checked, including on failures. Failed fixture startup leaves only a private redacted diagnostic on the workstation.

Retain the JSON receipt with its adjacent .sources.txt manifest. The JSON binds that manifest's hash; the manifest contains only canonical filename/content digests. Existing outputs refuse. Assertions must be enabled. Negative CLI checks prove that optimized assertions and either existing output refuse without overwriting evidence. Ruff and the native rehearsal pass. The full make check gate was also rerun:396 passed, zero failures/errors/skips, including required browsers.

Required owner return and remaining journey

Keep the bind's read and password-reset responsibilities explicit. NetKingdom must review a supported narrow reset authority or another supported recovery path under its existing NK-WP-0054-T05 bind-split work, including any privileged account limits. Do not silently promote the production bind to directory admin or infer that the synthetic password-manager grant is approved for production. The source-role mismatch is retained on the existing WP-0015-T04; it is not a new credential request or a duplicated provider implementation task.

After that owner return, complete isolated native browser reset/expiry/replay, local mail-sink delivery, KeyCape/client/tenant isolation and real app login. The current test proves the native reset prerequisite only. It proves no OIDC issuance, MFA ceremony, TLS/browser flow, application session or productive runtime/permission acceptance. UC-009 remains established: false.

October31 follow-through: the separate native browser gate now exercises SMTP, expiry/replay, KeyCape, user-engine HTTP and the actual app callback using an explicit synthetic password-manager bind. See native-recovery-browser-review-2026-10-31.md. That new proof does not grant production reset authority or rewrite this API-only receipt's scope.