Record verified enrollment assurance release and automate provider contract tests

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

sso-mfa/k8s/keycape/deployment.yaml

@@ -50,7 +50,7 @@ spec:
         - name: keycape
           # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
           # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
-          image: forgejo.coulomb.social/coulomb/key-cape@sha256:c9eb584d60efecfe00e1745a7e8cd3ebb4ae0f94faa715ef9594cd58a5dcebb6
+          image: forgejo.coulomb.social/coulomb/key-cape@sha256:75bdbe1cd8181949c9d2759506629f19bd5d62a7cf81293811affa76c6a43dd6
           imagePullPolicy: IfNotPresent
 
           ports:

sso-mfa/k8s/privacyidea/keycape-scope-probe.py

@@ -0,0 +1,25 @@
+"""Provider-local idempotent setup of an inert realm-visibility probe; emits no key."""
+import contextlib,io,json,logging
+SERIAL="KCFACTORSCOPE01"
+DESCRIPTION="KeyCape realm visibility probe; keep disabled and unassigned"
+result={"success":False}
+with contextlib.redirect_stdout(io.StringIO()),contextlib.redirect_stderr(io.StringIO()):
+ try:
+  logging.disable(logging.CRITICAL)
+  from privacyidea.app import create_app
+  from privacyidea.lib.token import get_tokens,init_token
+  from privacyidea.lib.realm import get_realms
+  app=create_app(config_name="production",silent=True)
+  with app.app_context():
+   if "coulomb" not in get_realms():raise ValueError()
+   tokens=get_tokens(serial=SERIAL)
+   if not tokens:
+    token=init_token({"serial":SERIAL,"type":"hotp","genkey":1,"realm":"coulomb","description":DESCRIPTION})
+    token.token.active=False;token.token.save()
+    tokens=get_tokens(serial=SERIAL)
+   if len(tokens)!=1:raise ValueError()
+   data=tokens[0].token.get_vars()
+   if data["description"]!=DESCRIPTION or data["active"] or data["user_id"] or data["realms"]!=["coulomb"]:raise ValueError()
+   result={"success":True,"serial":SERIAL,"realm":"coulomb","disabled":True,"unassigned":True}
+ except Exception as e:result["failure_type"]=type(e).__name__
+print(json.dumps(result));raise SystemExit(0 if result["success"] else 1)