Make the replacement harness runnable and target a live issuer

Closes the runnable half of gap G04. The Scenario B and C scripts could not
execute: absent compose files, binaries sought at src/bin where the Makefile
builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a
hardcoded workstation Go path invoked from outside the module.

Repairing the shell alone would have proved nothing. Both scripts set
KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and
never read it, so they passed identically whether or not a provider was running.
A harness that cannot fail for the reason it exists is worse than a missing one.

src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP:
discovery, the profile authorization surface, published keys parsed under the
runtime's own rules, excluded grants, and -- with credentials -- a real token
exchange verified against those keys. It skips when the variable is unset, so
make test is unchanged.

Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization
surface and key checks passed, and a client_credentials exchange produced a token
that verified against Keycloak's published JWKS through internal/jose.

It also failed, correctly: stock Keycloak advertises the excluded implicit and
password grants, and in Keycloak those are server capabilities rather than
per-client toggles, so no emitted realm removes them. A migrated Keycloak has a
wider grant surface than KeyCape, which substantiates with evidence what SCOPE
previously asserted without it. Scenario B legitimately reports failure today.

Directory migration, credential and MFA preservation and relying-party behaviour
remain unexercised, and Scenario C has never been run end to end, so G04 does not
fully close.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

scripts/test-scenario-b.sh

@@ -1,44 +1,68 @@
 #!/usr/bin/env bash
-# test-scenario-b.sh — Scenario B: IAM swap (KeyCape → Keycloak, same LLDAP directory)
+# test-scenario-b.sh — Scenario B: IAM swap (KeyCape -> Keycloak, same LLDAP directory).
 #
-# This script verifies that after migrating to Keycloak (with the same LLDAP directory),
-# all profile tests pass without modification.
+# Exports the canonical directory, transforms it into a Keycloak realm, starts
+# Keycloak over that realm, and runs the external conformance suite against it.
 #
-# Prerequisites: docker, docker compose
+# Prerequisites: docker, docker compose, and `make build` (binaries land in bin/).
 
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT"
 
-echo "=== Scenario B: IAM Replacement Test ==="
+BUILD_DIR="$REPO_ROOT/build/scenario-b"
+COMPOSE="docker compose -f docker-compose.scenario-b.yml"
+ISSUER_URL="http://localhost:8080/realms/netkingdom"
 
-# Step 1: Export canonical data from LLDAP
-echo "--- Step 1: Export canonical data ---"
-./src/bin/lldap-export \
+die() { echo "scenario-b: $*" >&2; exit 1; }
+
+# Check every prerequisite up front: failing half way through leaves a running
+# stack and a half-written realm, which is harder to diagnose than not starting.
+for binary in lldap-export keycape-to-keycloak; do
+  [ -x "bin/$binary" ] || die "bin/$binary is missing; run 'make build' first"
+done
+command -v docker >/dev/null || die "docker is not installed"
+command -v go >/dev/null || die "go is not installed"
+
+cleanup() { $COMPOSE down -v >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+mkdir -p "$BUILD_DIR/realm"
+
+echo "=== Scenario B: IAM replacement ==="
+
+echo "--- Step 1: start the directory ---"
+$COMPOSE up -d lldap
+timeout 120 bash -c 'until (exec 3<>/dev/tcp/127.0.0.1/3890) 2>/dev/null; do sleep 2; done' \
+  || die "LLDAP did not accept connections within 120s"
+
+echo "--- Step 2: export the canonical directory ---"
+./bin/lldap-export \
   --url "${LLDAP_URL:-ldap://localhost:3890}" \
   --bind-dn "${LLDAP_BIND_DN:-cn=admin,ou=people,dc=netkingdom,dc=local}" \
   --bind-pw "${LLDAP_BIND_PW:-adminpassword}" \
-  --base-dn "dc=netkingdom,dc=local" \
-  --output /tmp/canonical-export.yaml
+  --base-dn "${LLDAP_BASE_DN:-dc=netkingdom,dc=local}" \
+  --output "$BUILD_DIR/canonical-export.yaml"
 
-# Step 2: Transform to Keycloak realm
-echo "--- Step 2: Transform to Keycloak realm ---"
-./src/bin/keycape-to-keycloak \
-  --input /tmp/canonical-export.yaml \
+echo "--- Step 3: transform into a Keycloak realm ---"
+./bin/keycape-to-keycloak \
+  --input "$BUILD_DIR/canonical-export.yaml" \
   --realm netkingdom \
-  --issuer "${ISSUER:-https://auth.netkingdom.local}" \
-  --output /tmp/keycloak-realm-import.json
+  --issuer "${ISSUER:-$ISSUER_URL}" \
+  --output "$BUILD_DIR/realm/netkingdom-realm.json"
 
-# Step 3: Start Keycloak with the imported realm
-echo "--- Step 3: Start Keycloak with imported realm ---"
-docker compose -f docker-compose.scenario-b.yml up -d keycloak
-echo "Waiting for Keycloak to be ready..."
-timeout 120 bash -c 'until curl -sf http://localhost:8080/realms/netkingdom/.well-known/openid-configuration > /dev/null; do sleep 3; done'
+echo "--- Step 4: start Keycloak over the migrated realm ---"
+$COMPOSE up -d keycloak
+timeout 180 bash -c "until curl -sf '$ISSUER_URL/.well-known/openid-configuration' >/dev/null; do sleep 3; done" \
+  || die "Keycloak did not serve discovery within 180s"
 
-# Step 4: Run profile tests against Keycloak
-echo "--- Step 4: Run profile tests against Keycloak ---"
-KEYCAPE_TEST_ISSUER="http://localhost:8080/realms/netkingdom" \
-  /home/worsch/go/bin/go test ./src/tests/profile/... -v -count=1
+echo "--- Step 5: run the external conformance suite against Keycloak ---"
+# The suite reads KEYCAPE_TEST_ISSUER and talks to the running issuer over HTTP.
+# Run it from the module directory: the Go module root is src/, not the repo root.
+KEYCAPE_TEST_ISSUER="$ISSUER_URL" \
+  go -C src test ./tests/conformance/... -v -count=1
 
 echo "=== Scenario B PASSED ==="
+echo "Note: this proves the migrated realm serves a conforming OIDC surface."
+echo "It does not prove credential, MFA or relying-party behaviour was preserved."

scripts/test-scenario-c.sh

@@ -17,7 +17,7 @@ echo "=== Scenario C: Full Expansion Test ==="
 
 # Step 1: Export canonical data from LLDAP
 echo "--- Step 1: Export canonical data ---"
-./src/bin/lldap-export \
+./bin/lldap-export \
   --url "${LLDAP_URL:-ldap://localhost:3890}" \
   --bind-dn "${LLDAP_BIND_DN:-cn=admin,ou=people,dc=netkingdom,dc=local}" \
   --bind-pw "${LLDAP_BIND_PW:-adminpassword}" \
@@ -26,15 +26,15 @@ echo "--- Step 1: Export canonical data ---"
 
 # Step 2a: Generate LDIF for OpenLDAP
 echo "--- Step 2a: Generate OpenLDAP LDIF ---"
-./src/bin/lldap-to-ldap \
+./bin/lldap-to-ldap \
   --input /tmp/canonical-export.yaml \
   --target openldap \
-  --base-dn "dc=netkingdom,dc=local" \
+  --basedn "dc=netkingdom,dc=local" \
   --output /tmp/migration.ldif
 
 # Step 2b: Transform to Keycloak realm
 echo "--- Step 2b: Transform to Keycloak realm ---"
-./src/bin/keycape-to-keycloak \
+./bin/keycape-to-keycloak \
   --input /tmp/canonical-export.yaml \
   --realm netkingdom \
   --issuer "${ISSUER:-https://auth.netkingdom.local}" \
@@ -55,6 +55,6 @@ ldapadd -x -H ldap://localhost:389 -D "cn=admin,dc=netkingdom,dc=local" -w admin
 # Step 5: Run profile tests against Keycloak + OpenLDAP
 echo "--- Step 5: Run profile tests ---"
 KEYCAPE_TEST_ISSUER="http://localhost:8080/realms/netkingdom" \
-  /home/worsch/go/bin/go test ./src/tests/profile/... -v -count=1
+  go -C src test ./tests/conformance/... -v -count=1
 
 echo "=== Scenario C PASSED ==="