NK-WP-0056-T04: custody client secret reconciled with live; re-sealed custody

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e

docs/evidence/2026-10-30-nk54-bind-split/README.md

@@ -31,8 +31,9 @@ UTC, agent (Claude Code) guiding. All receipts are value-free (`values_recorded:
    (intended), and the custody client secret **not** matching the live `keycape_client_secret_hash`.
    The KeyCape-Authelia client secret was changed after the March custody seal without updating custody.
    Step 6 used a one-off helper that calls the same `publish()` path for `ldap_password` only (uid,
-   resourceVersion and full-data test, readback) and skips only the client-secret check. Follow-up:
-   reconcile custody with the live client secret (founder-run).
+   resourceVersion and full-data test, readback) and skips only the client-secret check. Reconciled the
+   same evening with `sso-mfa/bootstrap/reconcile-keycape-client-secret.py` (founder-run, value-free:
+   live pair agreed, custody updated and re-checked, re-sealed).
 4. Rollouts of identity-provisioner, KeyCape and LLDAP use `Recreate`: each had a short outage of
    about 30 s.
 

sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> X25519 GCGqgOi+miKichWZWpsLkjDiwEmizETg63AEEktJ32o
-Q9lcgmPdtNJp6Dcu9kK4u4S+y9l48Zb3BC3aZ+RPCYs
---- PssPTg1WtBF8F7prFNjVIPfxa5NwDRN0aOjJgf4OjEY
-<EFBFBD>öÉŠ¦õr´ ?37u!Íã²;t÷̘ÐÃÚ<C383>¿<EFBFBD>LDŠ±m­‘½
5SˆÚÀ“¡×Ö|M].ÛoÉrV±¬ÇhR~Þ¥	¾ËŠ?eZ@;ö@ªô+ë…¿cÕŠ®»¨*-²,Ù/	ÒK„Põ¬DaNE¥<45>“‹ÔÒÀÀ€w¶#
+-> X25519 gjqvyZK6X4+v32GvKVjQU2DvzRn805sl16jVQMWOJQ8
+5p1lojGUeQFxi2eTSeR+qI97Ac42gH3hVRyQZlRgYts
+--- X5M2niIOYt/jdHPXB3zeJWHtAH97V37bnsTLikd47I8
+Ks[Ş?ßÁ0~¤Xžţ<C5BE>šLŘěę‚”k± éŚí)ź`q…ÎYAΠ
ŃDĐÝŤ@ýË˙2â)Q0¶q›iš€	Ţ}dGŠŃý@©$ë}ÝE×"7IAšoMbBąH²ŔÔ¤B¤«"z:Áf <66>Gt/µýžň'§
›VVę!

workplans/NK-WP-0056-bounded-executor-path.md

@@ -137,7 +137,9 @@ needs to be decrypted for a bind rotation.
 
 **2026-10-30:** reconciliation tool prepared: `sso-mfa/bootstrap/reconcile-keycape-client-secret.py`
 (value-free; accepts the live KeyCape value only if it matches Authelia's live hash, writes custody through
-`rotation-env.py`, no cluster writes; `tests/test_reconcile_keycape_client_secret.py`). Founder run pending.
+`rotation-env.py`, no cluster writes; `tests/test_reconcile_keycape_client_secret.py`). **Founder ran it
+2026-10-30:** live KeyCape value matches Authelia's hash; custody did not match before, was updated and matches
+after (value-free output); custody re-sealed and shredded. The reconciliation step is done; the ESO move remains.
 
 ## Synthetic verification instead of a founder sign-in