diff --git a/docs/evidence/2026-10-30-nk54-bind-split/README.md b/docs/evidence/2026-10-30-nk54-bind-split/README.md index 08e3de5..93b56c1 100644 --- a/docs/evidence/2026-10-30-nk54-bind-split/README.md +++ b/docs/evidence/2026-10-30-nk54-bind-split/README.md @@ -31,8 +31,9 @@ UTC, agent (Claude Code) guiding. All receipts are value-free (`values_recorded: (intended), and the custody client secret **not** matching the live `keycape_client_secret_hash`. The KeyCape-Authelia client secret was changed after the March custody seal without updating custody. Step 6 used a one-off helper that calls the same `publish()` path for `ldap_password` only (uid, - resourceVersion and full-data test, readback) and skips only the client-secret check. Follow-up: - reconcile custody with the live client secret (founder-run). + resourceVersion and full-data test, readback) and skips only the client-secret check. Reconciled the + same evening with `sso-mfa/bootstrap/reconcile-keycape-client-secret.py` (founder-run, value-free: + live pair agreed, custody updated and re-checked, re-sealed). 4. Rollouts of identity-provisioner, KeyCape and LLDAP use `Recreate`: each had a short outage of about 30 s. diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age index 9937140..0fc51a2 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age index 903babb..6d0a7a4 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age index 4aa1855..7a5c0cf 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age and b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age index bd4f58d..12d17a8 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age and b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age index bdcbd3c..190a7d4 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age index 1c1b8e6..dc2e160 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age index af3743a..515c59e 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age index b33b405..11f4e30 100644 --- a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age +++ b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age @@ -1,5 +1,5 @@ age-encryption.org/v1 --> X25519 GCGqgOi+miKichWZWpsLkjDiwEmizETg63AEEktJ32o -Q9lcgmPdtNJp6Dcu9kK4u4S+y9l48Zb3BC3aZ+RPCYs ---- PssPTg1WtBF8F7prFNjVIPfxa5NwDRN0aOjJgf4OjEY -Ɋr?37u!;t̘ڝLDm 5S|M].orVhR~ޥ ˊ?eZ@;@+녿cՊ*-,/ KPDaNEw# \ No newline at end of file +-> X25519 gjqvyZK6X4+v32GvKVjQU2DvzRn805sl16jVQMWOJQ8 +5p1lojGUeQFxi2eTSeR+qI97Ac42gH3hVRyQZlRgYts +--- X5M2niIOYt/jdHPXB3zeJWHtAH97V37bnsTLikd47I8 +Ks[?0~XLꂔk)`qYAΠDݍ@2)Q0qi }dG@$}E"7IAoMbBH²ԤB"z:fGt/' VV! \ No newline at end of file diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age index ac1794b..3240ba4 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age index fad35e7..bfbc853 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age index 6753f6a..884aec6 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age differ diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index cefafb3..a38ffc5 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -137,7 +137,9 @@ needs to be decrypted for a bind rotation. **2026-10-30:** reconciliation tool prepared: `sso-mfa/bootstrap/reconcile-keycape-client-secret.py` (value-free; accepts the live KeyCape value only if it matches Authelia's live hash, writes custody through -`rotation-env.py`, no cluster writes; `tests/test_reconcile_keycape_client_secret.py`). Founder run pending. +`rotation-env.py`, no cluster writes; `tests/test_reconcile_keycape_client_secret.py`). **Founder ran it +2026-10-30:** live KeyCape value matches Authelia's hash; custody did not match before, was updated and matches +after (value-free output); custody re-sealed and shredded. The reconciliation step is done; the ESO move remains. ## Synthetic verification instead of a founder sign-in