net-kingdom/docs/keycape-exposure-resolver-reconciliation.md

# KeyCape exposure: privacyIDEA resolver reconciliation

Incident: `KEYCAPE-EXPOSURE-20260823-01`  
Workplan: `NK-WP-0033`  
NetKingdom procedure: `sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh` (revision pinned by the approved checkout)
Platform recovery contract: railiance-platform `453fed3`  
Owner cutover receipt: State Hub message `45b236c8-052f-43d3-a472-44f8e9694da2`

This is the remaining attended provider-admin operation after the owner-reported
four-class cutover. It updates only privacyIDEA resolver `lldap-coulomb` so the
resolver uses the replacement LLDAP bind credential. It does not modify realms,
policies, tokens, KeyCape Secrets, or any other resolver.

No password, hash, token, Secret payload, or manifest belongs in this document,
State Hub, Git, chat, command arguments, or ordinary logs.

## Authority and pinning gate

The operator must record a private approval receipt containing, at minimum:

- incident `KEYCAPE-EXPOSURE-20260823-01`;
- the NetKingdom revision containing `reconcile-lldap-resolver-live.sh` and platform contract `453fed3`;
- the owner receipt `45b236c8-052f-43d3-a472-44f8e9694da2`;
- the exact start/end window, attended driver, and independent abort operator;
- confirmation that the replacement LLDAP credential is the provider-approved
  value and that no exposed predecessor will be restored.

No live action is permitted if any revision, owner, cluster, or approval
identifier differs from the receipt.

## Preflight (metadata and health only)

Run from the approved operator workstation, with the cluster context and
provider endpoint already authorized. Do not render any Secret data.

1. Verify the approved checkout contains `reconcile-lldap-resolver-live.sh`
   with mode `0755`; inspect its source, not live credential material.
2. Confirm LLDAP, privacyIDEA, KeyCape, Authelia, and
   identity-provisioner are Ready using deployment/pod status fields only.
3. Confirm privacyIDEA availability via the documented unauthenticated
   `/token/` probe (401/403 is expected) and KeyCape discovery health,
   discarding response bodies. Do not use a command that prints a bearer token
   or configuration response.
4. Confirm the approved window, driver, abort operator, provider custody, and
   cleanup workspace are ready. Stop on any drift or missing owner.

## Apply (one attended operation)

1. From the approved checkout, run exactly:

   ```text
   bash sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh --apply
   ```

   The helper securely prompts for pi-admin, replacement and predecessor
   LLDAP passwords, and one approved MFA code; authenticates to privacyIDEA;
   performs exactly one `POST /resolver/lldap-coulomb`; proves replacement
   resolver lookup, privacyIDEA MFA, replacement LLDAP authentication, and
   predecessor denial; rechecks readiness/health; securely cleans up; and
   emits one sanitized PASS/FAIL receipt. It must not be combined with
   `repair-realm-live.sh`, `bootstrap-realm.sh`, `creds-rotate.sh`, or any
   full-bundle generator.
3. Stop immediately on any non-success response, timeout, unexpected endpoint,
   or failed cleanup. Do not restore the exposed bundle or predecessor
   credential.

## Postflight and predecessor denial

Record only status codes, readiness, timestamps, revision identifiers, and
boolean results.

1. Confirm privacyIDEA, LLDAP, KeyCape, Authelia, and identity-provisioner are
   Ready again. Confirm the privacyIDEA health endpoint succeeds and the
   resolver endpoint returns success without retaining its response body.
2. Exercise one approved KeyCape MFA path that requires the `coulomb` realm.
   Record pass/fail only; never record the token or response body.
3. Using protected file inputs, prove an LDAP bind with the replacement value
   succeeds and a bind with the exposed predecessor fails. The predecessor
   test must be a boolean result and must not put the password in argv or
   stdout. A failed predecessor bind is required evidence; do not retry it
   against another provider.
4. Confirm the KeyCape owner’s existing four-class positive/negative receipt
   remains associated with this resolver update. If any class lacks a receipt,
   keep T05 open.
5. Securely remove the temporary workspace and record only cleanup success.

## Abort and rollback

Abort before mutation on revision drift, missing authority, unavailable health,
uncertain workspace cleanup, or any unsafe helper output. Abort forward after
mutation on a failed resolver response, failed readiness, failed replacement
MFA, or missing predecessor denial. The exposed bundle and every exposed
predecessor are never rollback material. Recovery after a partial write must
use a newly approved replacement value and revision, not a stale local bundle.

## Completion evidence

T03 may move to done only after the helper run and cleanup receipt are recorded
by the attended operator. T05 may move to done only after the resolver’s
replacement success, predecessor denial, owner cutover receipt, and all
residual limitations are recorded as sanitized evidence.