security: preserve realm configuration and remove shell credential evaluation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2

docs/attended-procedure-inventory.md

@@ -26,12 +26,12 @@ runbook or a dedicated procedure. Missing runbooks are listed separately.
 | `lldap/manage-group-members.sh` | [OPERATOR-GROUPS.md](../sso-mfa/k8s/lldap/OPERATOR-GROUPS.md) | unknown |
 | `postgresql/create-secrets.sh` | [README.md](../sso-mfa/k8s/postgresql/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
 | `privacyidea/bootstrap-admin.sh` | [README.md](../sso-mfa/k8s/privacyidea/README.md) | unknown |
-| `privacyidea/bootstrap-realm.sh` | [keycape-exposure-resolver-reconciliation.md](../docs/keycape-exposure-resolver-reconciliation.md) | unknown |
+| `privacyidea/bootstrap-realm.sh` | [privacyIDEA repair contract](../sso-mfa/k8s/privacyidea/README.md#configuration-preserving-realm-repair) | source repaired: literal private files, preview/explicit apply, configuration preservation; live acceptance pending |
 | `privacyidea/check-user-mfa-state.sh` | [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | source repaired: explicit admitted private JWT, scoped read-only counts; live diagnostic delivery not admitted by this repair |
 | `privacyidea/create-secrets.sh` | [README.md](../sso-mfa/k8s/privacyidea/README.md), [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md) | unknown |
 | `privacyidea/enckey-bootstrap.sh` | [README.md](../sso-mfa/k8s/privacyidea/README.md) | unknown |
 | `privacyidea/reconcile-lldap-resolver-live.sh` | [keycape-exposure-resolver-reconciliation.md](../docs/keycape-exposure-resolver-reconciliation.md) | attempted by Bernd Worsch 2026-08-27; no completed PASS receipt |
-| `privacyidea/repair-realm-live.sh` | [smooth-bootstrap-guide.md](../docs/smooth-bootstrap-guide.md), [keycape-exposure-resolver-reconciliation.md](../docs/keycape-exposure-resolver-reconciliation.md), [verify-t06.md](../docs/verify-t06.md) | unknown |
+| `privacyidea/repair-realm-live.sh` | [privacyIDEA repair contract](../sso-mfa/k8s/privacyidea/README.md#configuration-preserving-realm-repair), [verify-t06.md](../docs/verify-t06.md) | source repaired: attended in-memory input and propagated functional proof; live acceptance pending |
 | `privacyidea/update-lldap-resolver-live.sh` | None found | unknown |
 | `user-engine/verify-operability.sh` | None found | unknown |
 | `verify-identity-cutover-dependencies.sh` | None found | unknown |

docs/keycape-exposure-resolver-reconciliation.md

@@ -15,6 +15,18 @@ policies, tokens, KeyCape Secrets, or any other resolver.
 No password, hash, token, Secret payload, or manifest belongs in this document,
 State Hub, Git, chat, command arguments, or ordinary logs.
 
+## Resolver update semantics — corrected 2026-10-13
+
+Disposable native privacyIDEA 3.12.2 tests and its owner API implementation prove
+that omitted resolver fields are preserved. The historical general statement
+below that every POST replaces the whole object is superseded for this verified
+version. Sending explicit defaults can still overwrite custom tuning. Historical
+incident receipts and their target-version limitations remain unchanged.
+The current general realm repair sends only missing tuning fields on an existing
+resolver and never rotates its bind credential or replays MFA policies. The
+incident-specific attended cutover remains a separate approved procedure; do not
+substitute or combine the two.
+
 ## Authority and pinning gate
 
 The operator must record a private approval receipt containing, at minimum:

docs/smooth-bootstrap-guide.md

@@ -65,8 +65,8 @@ Each step has: commands/scripts, evidence required, blocked conditions, links to
 
 ## Step 2: PrivacyIDEA Bootstrap + Realm
 
-- Deploy/repair realm, LLDAP resolver, self-service policies.
-- Use repair script (sso-mfa/k8s/privacyidea/repair-realm-live.sh) or console runbook "privacyIDEA realm repair".
+- Repair missing realm/resolver configuration; preserve current owner-managed self-service/MFA policies.
+- Use `sso-mfa/k8s/privacyidea/repair-realm-live.sh` or console action "Repair privacyIDEA realm and resolver". See the [configuration-preserving contract](../sso-mfa/k8s/privacyidea/README.md#configuration-preserving-realm-repair); missing onboarding policies use their existing owner procedure.
 - Enroll platform-root TOTP in repaired realm (pi-admin for setup).
 - Evidence: related to t02 validate (realm healthy).
 - Validate: `make security-bootstrap-validate-t02` (covers audit/recovery gates incl. this).

docs/verify-t06.md

@@ -9,8 +9,9 @@ a fresh TOTP/HOTP code including its token PIN if required. It never reads a
 bootstrap bundle or Kubernetes Secret. No password, OTP or token belongs in
 command arguments, logs or the receipt. Do not enable shell tracing.
 
-`--pi-url`, `--realm`, and `--resolver` select a different approved target.
-The CLI requires HTTPS. The old positional secrets-directory argument is
+`--realm` and `--resolver` select an approved lookup. `--pi-url` is restricted
+to the canonical provider or a literal loopback target; the CLI requires HTTPS.
+The shared transport verifies system trust and refuses redirects and ambient proxies. The old positional secrets-directory argument is
 removed; `repair-realm-live.sh` now calls this interface and propagates failure.
 
 Success requires all of these properties: