Verify railiance01 identity dependencies

docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md

@@ -165,11 +165,30 @@ logs were removed. CoulombCore identity writers remain scaled to zero to
 prevent divergence while the railiance01 direct-resolution conformance gates
 run; no PVC, Secret, database, or workload declaration was deleted.
 
+## Runtime dependency reconciliation
+
+`sso-mfa/k8s/verify-identity-cutover-dependencies.sh` now provides the
+repeatable T04 negative search. It decodes Kubernetes Secret values only in
+process memory and reports resource/key locators rather than values.
+
+The live railiance01 run passed all gates:
+
+- no Secret, ConfigMap, Deployment, or StatefulSet in `sso`, `mfa`,
+  `user-engine`, or `databases` references CoulombCore, its IP, or the public
+  LLDAP/privacyIDEA endpoints;
+- KeyCape resolves LLDAP, Authelia, and privacyIDEA through cluster-local
+  service names and retains both user-engine and rapp-qonto client declarations;
+- privacyIDEA's migrated LLDAP resolver is cluster-local;
+- the KeyCape signing-key fingerprint matches CoulombCore;
+- LLDAP, Authelia, KeyCape, privacyIDEA, and user-engine deployments are Ready.
+
+TLS-preserving direct resolution to `92.205.62.239` returned HTTP 200 with
+successful certificate verification for `auth`, `login`, `lldap`, `pink`,
+and `pink-account` under `coulomb.social`.
+
 ## Required next evidence
 
-1. Reconcile cluster-local configuration and prove that railiance01 has no
-   runtime dependency on CoulombCore.
-2. Exercise platform-root and Binky login/MFA using TLS-preserving direct
+1. Exercise platform-root and Binky login/MFA using TLS-preserving direct
    resolution to railiance01.
-3. Verify KeyCape service-client flows and negative authorization probes.
-4. Move LLDAP and privacyIDEA DNS only after those gates pass.
+2. Verify KeyCape service-client flows and negative authorization probes.
+3. Move LLDAP and privacyIDEA DNS only after those gates pass.