Implement KeyCape provider and service identity contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

capabilities/playbooks/key-cape.privacyidea-token-authority.yaml

@@ -0,0 +1,96 @@
+apiVersion: netkingdom.io/playbook-capability/v0.1
+kind: PlaybookCapabilityDeclaration
+metadata:
+  id: key-cape.privacyidea-token-authority
+  name: KeyCape privacyIDEA token-authority integration
+  owner: key-cape
+  repo: key-cape
+  domain: infotech
+  contract_version: "0.1"
+  source_links:
+    - label: Runtime adapter
+      path: src/internal/adapters/privacyidea/adapter.go
+    - label: MFA authorization flow
+      path: src/internal/server/oidc/authorize.go
+spec:
+  playbook:
+    path: src/internal/adapters/privacyidea/adapter.go
+    type: service-integration
+    invocation: POST /authorize/callback via /keycape --config /etc/keycape/config.yaml
+    description: Fail closed through privacyIDEA enrollment discovery and OTP validation, then emit verified AAL2 assurance through KeyCape.
+  capabilities:
+    - id: c2b.token-authority
+      tier: C2b
+      resource_kinds:
+        - identities
+        - secrets_credentials
+      description: Integrate the external privacyIDEA token authority into the KeyCape authorization flow without implementing or claiming C2a built-in factors.
+  parameters:
+    - name: privacyidea_base_url
+      type: string
+      required: false
+      default: http://privacyidea.sso.svc.cluster.local:80
+      constraints:
+        pattern: ^https?://[^\n\r]+$
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Cluster-local privacyIDEA API endpoint selected by the deployment owner.
+    - name: privacyidea_admin_token_ref
+      type: string
+      required: false
+      default: kubernetes://sso/keycape-config#config.yaml
+      sensitivity: secret_reference
+      tuning_authority: platform_only
+      description: Reference to the mounted KeyCape configuration carrying privacyIDEA API authentication; never a token value.
+    - name: realm
+      type: string
+      required: false
+      default: coulomb
+      constraints:
+        pattern: ^[a-z0-9][a-z0-9_-]{0,62}$
+      sensitivity: operational
+      tuning_authority: platform_only
+      description: Exact privacyIDEA realm used for token lookup and validation.
+    - name: require_for_all
+      type: boolean
+      required: false
+      default: true
+      sensitivity: security_sensitive
+      tuning_authority: platform_only
+      description: Fail-closed bootstrap posture requiring MFA for upstream users while enrollment remains independently verified.
+  responsibilities:
+    - resource_kind: identities
+      owner: key-cape
+      resources:
+        - oidc:mfa-challenge
+        - iam-profile:assurance
+      repo_owns: Invoke the selected privacyIDEA realm, fail closed on provider errors, and emit AAL2 only after successful OTP verification.
+      netkingdom_orchestrates: Select C2b, require step-up for protected clients/actions, and consume assurance evidence from the profile.
+    - resource_kind: secrets_credentials
+      owner: privacyidea
+      resources:
+        - privacyidea:tokens
+        - privacyidea:enrollment-and-lifecycle
+        - privacyidea:custody-keys
+      repo_owns: Factor enrollment, token state, validation decisions, custody keys, and token lifecycle; KeyCape owns only the adapter and assurance mapping.
+      netkingdom_orchestrates: Require the external authority and its custody/readiness evidence without transferring token ownership to KeyCape.
+  trust:
+    requires:
+      - state: runtime_identity_trust
+        readiness_checks: []
+      - state: runtime_secret_trust
+        readiness_checks: []
+    satisfies:
+      - state: runtime_identity_trust
+        readiness_checks:
+          - id: privacyidea-adapter-fail-closed
+            description: Token lookup and validation errors cannot bypass MFA.
+            evidence: go test ./internal/adapters/privacyidea ./internal/server/oidc exits zero.
+          - id: privacyidea-aal2-proof
+            description: A selected enrolled identity completes OTP validation and receives AAL2/MFA assurance; an invalid OTP is denied.
+            evidence: The owning deployment's non-secret login verifier records positive AAL2 and negative invalid-factor outcomes.
+  catalog:
+    publish: capabilities/playbooks/key-cape.privacyidea-token-authority.yaml
+    maturity: implemented-integration
+    consumers:
+      - netkingdom-security-scenario-composer