Validate cadence contract and require functional MFA verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd

workplans/NK-WP-0034-verification-that-verifies.md

@@ -4,10 +4,11 @@ type: workplan
 title: "Make the SSO/MFA verification actually verify"
 domain: infotech
 repo: net-kingdom
-status: proposed
+status: blocked
 owner: codex
 topic_slug: infotech
 created: "2026-08-28"
+updated: "2026-09-05"
 related:
   - NK-WP-0033
   - CUST-ADR-012
@@ -45,7 +46,7 @@ is broken, which is worse than no check, because it is believed.
 
 ```task
 id: NK-WP-0034-T01
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "9b5d8034-0ef1-53f9-ad4d-37de536bdc62"
 ```
@@ -65,7 +66,7 @@ them restored, it passes. Demonstrated in both directions, not argued.
 
 ```task
 id: NK-WP-0034-T02
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "0bd09a40-8b4d-5f9d-8d4c-81c55aa0c565"
 ```
@@ -83,7 +84,7 @@ Acceptance: one table — script, intended property, actual assertion, verdict.
 
 ```task
 id: NK-WP-0034-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "becb4dce-4971-5755-888f-5276c4a56fe7"
 ```
@@ -103,7 +104,7 @@ runbook are listed as a separate finding.
 
 ```task
 id: NK-WP-0034-T04
-status: todo
+status: done
 priority: low
 state_hub_task_id: "d43ae8e8-eda6-5c1d-9e1b-01966b0e92da"
 ```
@@ -118,3 +119,46 @@ applied to a copy is a fix that expires the next time someone writes a script.
 Acceptance: one implementation of the privacyIDEA request path in
 `sso-mfa/k8s/privacyidea/`; both callers use it; the GET behaviour has a test
 that fails if the header returns.
+
+
+## Review and implementation — 2026-09-05
+
+Reviewed the proposal against current code and implemented all repository-local
+changes. T01 waits only for the attended scratch/provider exercise required by
+its acceptance. No live credentials were requested and no production resolver
+was changed.
+
+- T01: replaced warning-only T06 success with an attended known-user and
+  TOTP/HOTP verifier, requiring realm binding, numeric tuning, exact user and
+  resolver, and token-backed success. Credentials are prompted in process;
+  missing attendance fails. Updated realm-repair and DR callers. Eighteen
+  tests exercise the actual shared HTTP transport, including clearing and
+  restoring every tuning field and rejecting passthrough/static passwords.
+  See `docs/verify-t06.md` for the remaining attended acceptance and limits.
+- T02: completed the per-script property/assertion/verdict table in
+  `docs/verification-audit-2026-09-05.md`. Other verify scripts retain their
+  implementations; their gaps are explicitly recorded for follow-up.
+- T03: inventoried every shell script under `sso-mfa/k8s/`, added exercise
+  headers to component runbooks, recorded unknown history and scripts without
+  runbooks in `docs/attended-procedure-inventory.md`. Corrected the reconciliation
+  runbook's attempted-run claim: no successful completion receipt exists.
+- T04: `privacyidea/pi_api.py` now supplies the request transport to both realm
+  bootstrap and resolver reconciliation (and T06). Authentication also uses the
+  shared transport in bootstrap. Its shell adapter keeps the token/body off
+  argv. Fixed bootstrap's first-success `set -e` counter exit found during the
+  review. The HTTP fixture rejects JSON Content-Type on GET and verifies the
+  real Python and shell adapter requests.
+
+Remaining gate: an attended operator runs the scratch target failure/restoration
+procedure and records receipts. An automated fixture is not reported as an
+exercised provider run. NK-WP-0033 still needs its own incident receipt and
+predecessor-disposition ruling.
+
+Validation: `python3 -m pytest tests tools -q` passed 106 tests, including 18
+privacyIDEA and 15 cadence cases. Ruff lint/format, shell syntax, embedded Python
+compilation and `git diff --check` passed.
+
+State Hub reconciliation was attempted with both the installed CLI and current
+checkout. Full reconciliation remains pending because API queries/writes timed
+out or returned connection-refused errors. Generated index/intake metadata was
+reviewed; the source files remain authoritative.