Validate cadence contract and require functional MFA verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd

docs/keycape-exposure-resolver-reconciliation.md

@@ -5,7 +5,7 @@ Workplan: `NK-WP-0033`
 NetKingdom procedure: `sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh` (repaired 2026-08-27 in `4a38511`; the previously pinned revision could not complete a run — see NK-WP-0033 T05)
 Platform recovery contract: railiance-platform `453fed3`  
 Owner cutover receipt: State Hub message `45b236c8-052f-43d3-a472-44f8e9694da2`
-Exercise status: exercised 2026-08-27 by Bernd Worsch — first run ever; four defects found and fixed (`4a38511`). See `attended-procedure-standard.md`.
+Exercise status: unexercised to successful completion — attempted 2026-08-27 by Bernd Worsch; four defects found and fixed (`4a38511`), no green receipt. The 2026-09-05 shared transport refactor also awaits an attended run. See `attended-procedure-standard.md`.
 
 This is the remaining attended provider-admin operation after the owner-reported
 four-class cutover. It updates only privacyIDEA resolver `lldap-coulomb` so the
@@ -20,7 +20,7 @@ State Hub, Git, chat, command arguments, or ordinary logs.
 The operator must record a private approval receipt containing, at minimum:
 
 - incident `KEYCAPE-EXPOSURE-20260823-01`;
-- the NetKingdom revision containing `reconcile-lldap-resolver-live.sh` and platform contract `453fed3`;
+- the NetKingdom revision containing `reconcile-lldap-resolver-live.sh` and its adjacent `pi_api.py` and platform contract `453fed3`;
 - the owner receipt `45b236c8-052f-43d3-a472-44f8e9694da2`;
 - the exact start/end window, attended driver, and independent abort operator;
 - confirmation that the replacement LLDAP credential is the provider-approved