From 5a52dc8a2326d102c0403646dc90698f5eca62da Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 30 Oct 2026 22:01:30 +0100 Subject: [PATCH] NK-WP-0056-T04: custody client secret reconciled with live; re-sealed custody Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 673304@bnt-lap001 Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e --- .../2026-10-30-nk54-bind-split/README.md | 5 +++-- .../secrets.enc/authelia/secrets.env.age | Bin 1507 -> 1531 bytes .../secrets.enc/breakglass/secrets.env.age | Bin 491 -> 491 bytes .../bootstrap/secrets.enc/keycape/key.pem.age | Bin 1904 -> 1904 bytes .../secrets.enc/keycape/pi_admin_token.age | Bin 4036 -> 4036 bytes .../secrets.enc/keycape/secrets.env.age | Bin 588 -> 588 bytes .../secrets.enc/lldap/secrets.env.age | Bin 1143 -> 1143 bytes .../secrets.enc/postgres/secrets.env.age | Bin 594 -> 594 bytes .../secrets.enc/privacyidea/pi.enc.age | 8 ++++---- .../secrets.enc/privacyidea/private.pem.age | Bin 1875 -> 1875 bytes .../secrets.enc/privacyidea/public.pem.age | Bin 651 -> 651 bytes .../secrets.enc/privacyidea/secrets.env.age | Bin 1143 -> 1143 bytes workplans/NK-WP-0056-bounded-executor-path.md | 4 +++- 13 files changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/evidence/2026-10-30-nk54-bind-split/README.md b/docs/evidence/2026-10-30-nk54-bind-split/README.md index 08e3de5..93b56c1 100644 --- a/docs/evidence/2026-10-30-nk54-bind-split/README.md +++ b/docs/evidence/2026-10-30-nk54-bind-split/README.md @@ -31,8 +31,9 @@ UTC, agent (Claude Code) guiding. All receipts are value-free (`values_recorded: (intended), and the custody client secret **not** matching the live `keycape_client_secret_hash`. The KeyCape-Authelia client secret was changed after the March custody seal without updating custody. Step 6 used a one-off helper that calls the same `publish()` path for `ldap_password` only (uid, - resourceVersion and full-data test, readback) and skips only the client-secret check. Follow-up: - reconcile custody with the live client secret (founder-run). + resourceVersion and full-data test, readback) and skips only the client-secret check. Reconciled the + same evening with `sso-mfa/bootstrap/reconcile-keycape-client-secret.py` (founder-run, value-free: + live pair agreed, custody updated and re-checked, re-sealed). 4. Rollouts of identity-provisioner, KeyCape and LLDAP use `Recreate`: each had a short outage of about 30 s. diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age index 9937140d89d38ff5951e2c8a1865043cb4d32979..0fc51a28b33b1cb24f209590f8252cccf266ce4f 100644 GIT binary patch delta 1517 zcmV3;PR@Ab(FdL~KZ7Nn&O%cSvMLR!41kcwu#NPDp5IH7|BKGHxGX?aL?H)d^eWkGLtb5>PCWNR~Fb5=)rOfqw2WN%hlSqd#J zEg)+~IZiTHQZY7hF*S8FMMi99RYO8_G)OU2bY*T)FLrBaZGTx|RBL#6cykK-)%9D? z49hbQAOSG1&fHRxR7$a8M2}=%Wmj70m!~8djGs9kaW1j5lx+lODGaj*pL>TlJxSx) ztgi3aXaLJ3coHn3l9xuRM1TVP5)=u5TM#*DqR=(wRh<-{;Q6fdu= zf=lT`XF-kU%0+2H!7tnEdJ-LgczrP%ZsR>J#}?kt3TdJ|P=GS5!*=aYaXNP*2rl-e zJ87zx5@z@)^{^`Rmy(WO|(=O^599me^_P93HaZ2ANClJ#!44{?s>HWsqE zaP;hJfM1}mDUrGig@))@*k8^5AG)2FK)M(iuCb$bech~okoV6LK8uTgL;ESa; z4}WD}w-?cac2C|vppa#q{5^~6o=v6!i~sLFL#ZKv4*!0v!Oz;RxwmIDGgOGQsDie( zNUSl{z|w-zq(9cd&jiKm@pK$)Dk>XElm|l;R@P{NYLlP{TIA)lGvBdTY ziQSxU%&gjYKczB%5L3}Kz{MUA5}xgse1CT|m01qo;26y--(G}O?`K;O67~OUOQjk+ znjk3)M-DzTX-=e?F>}J;SFHK-!^RxIgFdVdIrT6|l89Y%1ioK10Xd$Y5kE7aZM9D+ zI^%ET#~fgU!5c=Uq$`JBo!=9fX;CfgaSeU49Q|13W8g=M=Q-Um%B+C{6Mv{K zemvU^jPm4&N`-H9sdsQ=x{Q=YYUR%4$P(E7bVz5(TP5C@~~Sk5tT3J}2{(dX_bT zMPVp~adt*)C1#4QOP@W#An$PzP?eDUDU@Z=kmHAxKIz(>meRF_RCi~7*M z`R&j(oXCjoIGoXV&b)r6s>KDgTk>aL<(D`ahg+as~kAUCq; zgG4YkEZt0BX2!(k6Fhl{o+9mY)P^?O!ZHDOk*Z%VPPrdXkSf_JpLA~DQ;95CD)J=> ze&6clZNnxwy$>7tz=Bpm`({%NGg;mCJI$22KCM^OtIsq5^7!6Hz6*C)#T+a!-sF@% z-SaWNneeV$x~bdQw)J%mGt1(SqQ?+5NCt)z2G}Q2w@HcGQ0ij-jVpeNYZZk%9OH@g8ad|{JLN_>VH)k?KXgFg= zH)m5(cM3@|Ygs`}Z7XhLF>W$1WLa@#NmW`iW@SoKP)TlfOLZ$!dRJj$FjhlLK?*G` zEg(-!FG56fb5Ji=P&HI!YhzeyWn*r5Fj7ikOhR^9Mp-dVYJW3tPex^BNiYi7r#nb^ z*z^6WIb?>UEdGcvT%#+0Ht$slQ#vhd_@8BoEgdD8xV+jX^;)sreL0y;{!#0-JXP&y zONGcHwFq$%`<%V!N0!Mo65hK_cYnpx1Zbi|-e*&a4tgSFYEy8Ci+5PB5wg(xP ze34)>fIrb!KNjI8H6m0}6NLyMYibClb%s>}4|}MI%o0k~o9&)yaLVVX-$>sSdDcg9 z0iw^eAY~yZv(^+S!zheQ0>|w{`H06nqijpF%eVC|z<=(mEMPj+9rZTPdyU!D|HtOK zPAD*C(Dk>$_5d<^Gf+|ojxk4Y8ZSJYy#$q1E7YzS>aQ#Q$q@fx4n|eu!kEA@Q=eI3 zF>NV!_Us=$vr5%~RQXFrja|?rxuv;g{QV4%*0*AIn)Y1IOsOttO=T7;1kB?*L*Cfj zaaIt0Cx4c0!=#!-qNv6cVtD6}-v26cbYOVo4%(n$gbBzV#K>ih7~Xq4^L&n~V#=qA?8HsKs>EGOr_`kzI(B^`uq!BZ@Nw+uHv&xW zn?roYX0_}wSG*s)4W%2}#T6#W!Nd?_EN>lqY}r;f1z0BeOjf;OJC)iV?T=R9g*RR1 z=!14GVGLx4U^d#kVZqJ#R-%)R;2=gH7_>Mpp9jL$8A+{Cmrto&xUcc=M4|rcm9Q5* zCV$0=Ni~Y}u}L}(At{uJeB-w$dLGo6L7^=~Oo3l1bki}Td4ZFM^JlJo)(h;q8^evg zja`H*Nxw=%_q$O$HGK@h~GhZv>epnTL7n^AxU*%JhCtd_)yYDTBhRh7*!m& z%cxX12miD_w!6pzwVKIlkP>LlHQ3L2e}By^@;~#2F6l)b$^m(AF!d0;1BeDP&I#9b zPmpbr_=-?gL_?J0N6h@WLPuMTQW*%X>jeF!wFuElW8GAX)yxvSv4Ugmt~KnQSkRrp z<$?fR65d!7QY&>q7)rTwPZn57*Qkph*WA9Cj`-A46{q_bV%kymn-m6&AQ-;2pMT?? zxv5bRS!<(RP{8-9ylwkWfflqr4Bjq3Okc4?pqIH$(MhUR4 zgnIcOWhpC0b1;bOh&q-?u@CDP(!Bci*yBe~t&al*TVWJYs4eXwH+S!uqklVc#ucPr zs5_0p&>`zMTaEKthzECg_+^16imqSko_!}Y8^^|yoFvXpm)J;3!5KUteK4x5cTq%IUhFHDh*Icu87j zXg5YyMG9+kL{l;Zg)nV%QwQyQa5->9 zLG#<5B-SlIjT?+frT#03Zi?|a?j>s?M3YBU0%#cvKek?FeC)^nxdN413dcT-HZgGY z4-O7YMglvz1b?Pv?^nN51EHSGe9=~%r7EuZOW;HO?cO1pW_=0F%&X%B%jfqnAONsQ z@&##`gPu5*q>sGxmFCJDWx2-wxm+&|C37`hPFmVL0C?lIe5D@|EinX6U3-w;%DWv1 zlTiedla()hU2~D`)4O!}Ol-#g>c4yN=S-7?Y;?0e+)gJwnr=Y;H|C&c7ceIg{1+<< z3HO@#U7hdc#Mgc%k>i5G+FkX=Q0|Sb9%+a9CJ$MmczIPj+i{ zLsnTtD2Nm4dTD|J_QcM2^n zEg*7tWJ5P?D|2KtL_#)9aZ*8fGkQdEFKIDsMr<>8N@P-EYkx0hM0HRwYi|lV-K2E9 z)#xl{U!nBpp;2IU5S(1Ye#&n%FKYnYb2ie7E@Kl%?Y)4NhfPVoj06*?id zd%J8F{KEN=+?;Wa(_X5zKxJDh@=sooVpDL0Z;56nmf7QlSs{iH0|ZR> zONH(Cl#qFAzEexTBuT1l%|wsW?6;A@p~m6A&<@(kiQF`Y&+;cacAhl&^V*;jJw^O;2}-t{uIYX#T#J L*6Ss_$t4OTl;PF( diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age index 4aa1855a85d84f75a88829dfaa9253410cea2ea6..7a5c0cfdecf87af0b4b6524e7e02000dda5eaef2 100644 GIT binary patch delta 1893 zcmV-r2b%cs4)6|;Ab(^_SvNI#D>O7=FEvV3FEDO&b2&6GX?jC=cV;+ZS8a1xX*nx$ zVNqyUNeVY>Qd2}lG&f{rMoeyUVQVopX+&o$Yd2M5Niu6wGDl`FW^-Z2fG;%UAZfZDiG+IqTR%~K0ad|^HV}EC4OjcoWQ%MRD6E;q> zbu+y*y<+c5zU$o^z{jCBlZl(co9(cqAnM2HZqr&F>H1Ye#_4Iy=#yuJv`^Ke(4m4V zyF60`htG9b>eRy;Ln|(>P(kLrg)B*rPT4JH+Umm~Z&5iIAP`Mr@rnGv8slSu9H-b* zgjnY~sy|d4>3`9M=<$+LrChT30K6hlePvw0($Frm50fnv=ngABJqtiCG^}~v;H-BK zCpf&B;gjz&evod$jGC4X{q%+RZ(LmkYVoh-cW@b-uK zArlypgStRf7p#71`J&~cZlx4|xw3U{A={G6<`wnRFW*b{VGuwVV-0B{1l?Z&T$W%& z`L_`TO;i}=4e%;s*V9{y#h#&)uubA#pzqJgRm<5j|- z)WR3aSZTk{h$eU3teo<1mJ#)Ld5e)Q6_$~52Y<2u85{=Xsd)8RSlK4Cz-oesD4=&& zmXbx=%9Sr~20V^zhI<0(A^O0>5ktz-jhj2U=Lc}78ccPE_ZEjMo#6W+aV^G2gxYB( z^mv_2Hif(dNNAiSC-YJ-DVX!pRoR({;lds{SX-=rjD{e{nssX-4-W|lHMQM3Q$;Eq z4}V5Y&y5hNu#gIV9)P!Am&@C?TJi-aTp4V}{W|QK!(ztkx|Uh7@G>V_4Z-+@6n4M6 zEpBqrnx-1JRf#F_y<-@ZN_yBGm-b3$9urZ0Sr+2hl7MBt-(6UrI{Z7N$3PZ#(MnON z7H}hQn9{38&Co0kFPoh)Fau;>(n%hXaIqJWTJf=6_le5T|&!J!N zH~&&D^4Dm_9WHE~6ki%vYqG0n+HOltvR2Otkwrl;H4%Nn6dhaeu4O zsw%h!@_T+K5dSI_I2eVgQ=ATBR!mn3y;)Y%#hoJPii zxSFs-J9qdJ)Bp$%CP5C7bS3u>3V6pNmU;a=MHVYm>$Sod*w5t5e;qAqd$13h5ETIu z+)i0nN(;pkJWERN`u-|_JnsjXe1C#|f#b?uEc7#A;yi45kpKZh4fNiTvsN$3H$skj zFjy|I83mj3Z2PlX7lqwSh-=LEirPR<^o&pu7JIqcMLm{?KMZ>4AD@D5>!i=Bu6}vK zX@&|2G$D`)>gJ3XyNB7QQnV*fUYCFe)K6R(i1&5PeR^5cKor%sHI&qj+kb>{vIYIC zd?=)o1k;ONiRWl$pC{l2_nr^Lhl#wiF|3k0o1X%AZ=5y(2jbI-)-@2wUTbG`BwCMA zP6Auz$wM#ce`1g}F|Ad4t^{BXLW#pn&$7a|=D7y4 zCvS}hQ3!I8t4B8C>mf-5Tz~wK93{Btz)9~-I_k+odG>qPc!m)G-(6D#0KNKrFKHrG zI&-Bf`U+3z)Sx$EKV&t$EvoR|n2z!_ic(AU{uwZrr2s&tIY#tWOm_n*PP^JHq`~wT z<@5so9d3CS25DqxmsHKsJ*wQxW2`ymYcQ>oSpUTELdiI!TK=W&4S%sTNjeVdy?XZL zis!-xYPYjG1Fk_s2VBMwrzFib1}bwpfI{3%fGX>Rg29pC_L)D;xb#vfkWEnUsW^T( z%sE$93m?^AY%H`AN=+Bmekll~NVVsJ4pwxnX$hvt-3%f&DMVev6p6529S>OST7h4s zWz6E%$#<@8I%}u-ZGZjYj%j9k9`lf}@=mR6IdwAXFbGWN$d}>P|4>o7Piq6TLQakL zAwG|if^!&K6)lN|e*b=yF^8MlNX*9jV$?NYc3;ODoQA!`i&pFvJ_+Das6$&O~rq+Em5LCVE z)P)BA2`&&}GoMkFMG+Z$3a}t`+aq8>xXL$(9>M*|#&|Uf>{dCWoEJZySp4T(=S_O? fM`sl!Q<_D>RyiTrMN5_@uk8EGRNx~o<@rFDh7o~* delta 1893 zcmV-r2b%cs4)6|;Ab)RGa%D|wP%(H=Zf9CadUY~va%E;!VK7x@XIWK2WjI+$XJcha zOm|K&MG9+IO-O8Fc34bLXmLR{O)+dodTK#SZ&5`=Lt#l#b~0r|FLE(wGHp0wNeV43 zEg&#-K~iBbY)MaULPB{jNOovtWLQ)*HfBjmYEVoxb#!hxGJiC2aAPwvX)p>?y8Ge{ zRh75r#!e~vJ54*4!Lo^L&Z*lCTp5<~+c9%|idd&oJrQ%cTS*#M4)!f{P2<1ln^>gFR*pQ6Oj0@>_Eurog=sk~E3P1&a4t-7DGM@cS zak;byThf*fLQ?mSb8!f;59Jm?LE=HD!y0!Z#%no{@9d+*#kv(wzqCRUGk3(`=WtSg z9qZ~+7fp!Ww7*S?au(l)_lvB+Nk!miVbS5OafZ&(h<~>(nXaGqj6u#F($fE&%`V08 z9BYK2x-+EtTv~kaIk))^ZAEaKSH*MAn5KoLFKN%Bx`yi=A5CKduoosK!-h4>2p+(| zeAEp^av31ZlM= z4Ye=-m37O3L%we<018kT^qz zHW6t7+}thC4FSv~KF+KQ3lR~O8C|Lke6$f4Tcnsm%;Vn4qmtS+nOH_)Bebl5NbPmo z)n)xhJjE6)e59e=F6}NA=dObW>`- zqJMPMc%4WN5gR##MzW&1GU5iqgBp2txt0Wiz4*~|7WI9;P5d^jEEaCrF%1=kK}2yZ#`8kC$|ls8`pEi3T61oOk@!6{41|>x?3B1D#&^m*8{w(bL!-i z_PeN2X{R$Ee=LI`v8@W-v$QS`IkYQ&?tdh1tJ=}+8%($a1%EWdv^pL|X%YmW?!#{m zc=2~eyATzl`-mQGWbVKOecNoOD7Nwq6lpJlv6pz;)71?G8 zCsNDU#|TEjXWU^)4X(=Y9pzWq!;+M(T-01PgF`#GB;v9-$5r3_e|r}9LZygo41b&B zbAx+`H){cObW~wb5QfrU#mhHh+4RFs-r%9vOnstG`(XCF9&X_`qU|~Gk=?j-wxT63 z3YSQZ`Mwc#?YJ$Eg0wWP*pJhQ$|Iw1dsas8kgqLwj9RW0?`n4>IsH^9+YCoQq zYHP;sHKD@%1hMgJs*}X4gJXcT_J0zQspf`SW1%2Ro^jIhFxo6}3Z^c_R-kA*)*e4P z_t{JZ7VK$zI4LMIbc`p$^V)Uk#`{jo7pedmz}c9|V$VvWEQ|TmUzV_>N&I=NsZ?xT z8r8SwRrBxB-0ftx{;=?6!tOU6j0b#gPukVuPV2kbbA{$E7Je>e$ z19HXRQIfQ+n!>BpM5%u4bZ&*?LL~jX6|BX=r9=X zpt}-uhcq#&xAj6M`e_zXxU<%60-}~8m47+1h)R**p%qy!HDq(K9e+L?0SY=tEa`a+ zxQ2MR7Brtmo8*y*bWpIo-oM?~6ztJ&hpa*)%419xlYlRx1M2!u2UeYeJw|*sBA4%% zi64VQ!opmSs08iI*sBd;(zzK|22S}iX)KZ|UPDW9>Iavsgd)T015e2T2_ocadhOVq z0{~dNvGSi?kRI6R0Do?`5;LwBhrp#m0eJc)#d`jOJSR|Hn5AiCJp^}#YtJfHLo@&yN2O_-lq21~B4O27-1nS5& zIXgV9wg4x!5SMzv`E|ar|8+Z(uCpDb80nPd%mV_!;7y5>GDV3qxpcsKqp^pXQMlH3 zx@^V%H)1$LWI)f`G=f%RZ7q+&3=Qv_BYrz6zt5V~Am1^nc5HwqZM{%9S4+*C*ilto zJmM~(>x+ZqXo>A$AmuPlmFlwq?GbNIE)=-=c;s(fP9Oy$tP6nJAwJodSweT z5-}zPp%Aq`u;$y>5eeh}W)_3|3D$09)-Zv-CDXaCvJ}}ALQ@@xkXfEj$kLBLK(17U z#8PFlJn$k4*i&2|Z;R&T2OyM!0ceXP?qZn$@DV@#%FBDgXBI{Nq%Tnw5jgw;X`{)u zf3o$V4X^aBWHJfp(mskZeLGmIeKL(;l(}E{V~?G+&tV^0{Cc0DB*Eqy*7q(gUgpNz zP8z7(lFdK8V%raxEXTiiX(6EAof=ZR^U;rq^NHlMTm z7~O@6j_U~hGd0st^SVi2)l8)7lg4Dy24mg$jRUsvOCq3Yob{aC5@p+vmaxacZZ z#2988u!f0}dW|H%`#6a`ewQI6nNvPZHJ^>>ZiAkKtmYl>u{-DJ%8U+UyK7(MfSti2 zPAnwJsp@cXc{z`ZV(@=cloEg_eqxIZyqe_A#xh8Fbhg?Qp$Ni1Vx6|eS=5p=TAD-N zam8l&NG!zg9s|7jhg!jI6}eX4MX&oV(Z(kQ>k$4);sofg%+|Fc`GkBKquXe{Eeo_8 zye%03*@nOFfVnWfjMo)g&)O0L+n<&QJrA7z+x$S_?j_co8z8;=QZ)n9D&3CWA5e*< zpUo*SZsEjwyddJLi!L}J{vu(okg z`4Ip+Eazs8B49xaI(>OHC@1^Wo@hJ^DdYVR;#TA~2Ll9nC(s$1f5dX{ffNS=Q z#46?O33-VKGe9668QvyZ9j#k8CcG&<^{hc9saiM^-r!~MHa>}SCOmM`iSvh#)p*RZ z^N4Zg6M1kN_iSquqk)-G2ZY~z4OoowTIM=LA8bjXQ)*FoS0tvd$7`|n9sdYMw!VQc zB-oVx3}B>gZ>Bu6C@H#=J@W0z}~|oJ|cjS1Rh1 zgoBCN31zz|&4S|&Da!>>exGr|X7A{-$~84^iSe@(x}<+pQx~u(6z{ZQ=zcf zdxIUngpe0?I=csIvyxqVbNSkM4~*q`J`1r8#u;Y1hSqcMBhd?nrN+(v$C>MEyhHPHiwe$4Pb$P!3v}POuGMa5(nG9Ekt(k+0qPW&a?}t-75T z9$nhhq#nlQ-;v5}fe1J8FPy;uHb)*>xaomGy13+np!rm+eatS_xj~&8R#Jg}`nke% zf^|B^H`zapJhT?cd9|GYgQxmoe#K+Ac3Bq~_aiU;ZXP2eZbC*o;wU$CqJSo)Xd3EN z1{}gNi)BC&hx1LqoYjut#CC6G&oMt|_C7+9Puyz4z%;^?~}>u)PYgn;f1`Tvsz+jWe|bDUfYvs`xIV|H@w@Kpd8&p(JP zdOltA11jkXZLMz8LibTtNq|7)Mal)RbCh$;^{aUl?*+w1hzNWZ#n?RYEB)>~gX)e` z&TQi+5?k#2mL1AFmy}sD};ac=ZQ1+0nfmti`rwLZDHt%*pd7X84z0JGp0#qrF)&A{5 z)>Y8u&xA{X@sQ)%Tpt4EBw3k^k|nOx-J!$+=4ZoYkiHySNugU58N9!i3e95=BA5)?gSu^29Brh^cS2*l5Ao}5+<{VihdMzN_|4cL%O@fg!N~!id^07@#1Dbq8^jQ3 z9Y5r3>cQ4XER$I*fu|j$)d0Qi|F2a{tJYCr%fAyn_ytvW0@q>!%1GbYY7a7RBK~3` zJMX813w*TVK7vi@Y#6xHFxdd}RW}u8PbdPc>(9O7O71Kkq*9_e*&(U5Rj!+wBu`BK@?J4W$DpO_Z-Av zHXDJ==Okb<${gB+o^yE?Z7EwZA1J? zR4MCCq`+QZMp&AHSm^YCfnUq;9jvv%eAzvS za9=o_U|4O*|NU?xYbRkm4vY+nk7?F=FSIZ~?N9m=2#bCoU-!n*tw%Na#S;DOM;VzV zdFwdKq@$%#H)M+hu#g6v&Gy99gfjCY!oNF4T&$ibBb+#lJsa!uQ*&Z)9HGFHW46<8 z^1*YiC}C`z%7${f?)sO$i^@eFOm_++2tYQ%s0Y3=zJ5&re0rI}Dql21Aa zK_SdQ@*2=DTRJjAuGF$U8tDZzE9Op0v9-BaglrvkkoqQX&ebcdLNrF10m{OcXm|sE z!maj*S8r6c?}d|6brsaK*5ZVyCGi%ltJ&JZB0dciH!V1D@$>PEkupLc=$-uq^HnFr zUXU~sF)fKm{*6QUK1hcjWyVNF_Yp!>IbbR2#C%U&9G^8|>a2B`5P@VujIV(>pAc9Z=b&MIaB~&Qvsv%; z*jwIVIV1cuQbhj9183(Z4~G)dqd7oU?xReD|J{Qcv@{AR^b!)`liCs8qM3h%2HX49 zo#>5m%W>KxkC z-RveLv11A;gLy6XubO-8s~YD2Ia^|ki};kHLk-8MX?N%nL^y9*5kTg&AJ4zoYB^QN zfThyo-iY%6mnQ5yz%W~q{N8d6{rRuibDT$7pq833fKhf`RH^lXpAL~MZUX4c#&RXC zotleHM*{sxYu+UDlSiyaSeO3+NVLCMVFczT?|bAXXeJahoE|om<-`W;bbvjz_%)6O zL%$ha^SO)9Me3oA?NDj5qXgZ6OKeYEm+bu>l1V?ekLH6$Lc~gx@3(49*_J`SF!1GU zTuQ70CrrVgJ*T;+s5s7sorrsRy`A^fd6+ajgB3tpQjOp>m#u6&O>C`y@WBpnM*S&{ zFar@wzg5o@OcZ~qsnHSMviP(P*webI73pYP`a;vYE7g-;0$XNhJAYf&DbtGYpA_pDRR@3CUW@69GYq7MZm|2v+uT|Dr4cWPbf2W3B59fwuc(vTw@x zPKx=jOl~|xWaNC9c{Fs{P@M9IV3}gpA8!QAvs5icRUuEYW^R{>h%p7O@9y!$;2o(x qVs&;;?~q7{ezn(E0`dIUn?@n3qPIHdeQr9n}~B literal 4036 zcmV;#4?FN-XJsvAZewzJaCB*JZZ2vKEaq*~*t-zP!Y}J`3rP`ttUeM8NQl*R6p z0dnIgnC7A5pRFli_;yO}&ivz;u6M^2NtOtRmSh;s`!)17TpD31VvPu&+`(m+V&h|T4^z> z@&rHLcpwbZH{xu$gFX$tsp7k{(#%+jmQr|01Nt5nC0BZt86e!PO3~L6PS#jf?|sd> zw=LfX!sD=Yg1-*La1^Ev*8wb0OPTf{H^|%dtED6>J{5k(?sQja-Uev|s=Y}_CI*d{Zf zN#|NGb0BI(^VYO?&-XuY``ird+MkpKS%@w^5Yy9#^61n36r za*M@v61g*fh}yX^bWaMq&aePle-;d$*sdhgjqQ3h%E8uP-|H7UxOXzxNjm_b)!~{b zqnki!=Vynzxojh2aMG!pL&wRB=Fv-oiy8h0GkX5h+hb{xmKF*({NE8L1J639`=lx~ z=_*SgPg(3gZ=$N0pig`8#Bs7|te~c@37LT^3WNnn2ftT4|3N~Z2y>-AWBU%HZ3Tx< zDAJxmWPPi6EZ|Mrkg<#)M#hCaY*CpHYZq{#BQNVkMJ!>Seh1^jf*GFY-Pj}+q_=q! z>*?uC=<0KF@5(<64mB4NKix*h}vQPW^r4+2gj zl*v~z?C^(yF|)*L23IL>FcJYqrnVdXev@AEe3Mkq;IpG%IH+r@7iie%t7R|3Pjm$H zSP_A7L$N{*L0UmzbXhYwJw6eB_J7vniZyf(7dB`2gr#?lZTMB>ZkR98E1kUdhji$C zi9?>E#?U_UlFDYsXn{G9M%YmE@7i+`c;!?yE^&TB^+{%JRZB}k7W7JP!tE9htR3%c z@waKmMdVk8SSrjdXME%$A1jW+PIVEoHJiczsCgTpbO z&2}Tp2+kUYcss8t_rIjrYQGs>iwjmboxoWwxgt$#yoDuemU~?Z+RMl=9OBoPfUw7R zYm-k)X6sUAKt;v#Jp2%9$Z@U0U?WDQn9V2=Elp5)jfBT0n8|uVw8Ln`nt3zN!epFc zLoxWR<|6xFQOTX68L;R>RRXSA+*Z-PLZ)!i4vopsKD3ew{TeL^W1asU-4s6t@ZU@g zWq(xojdegoYk+a4MZP|ZP_M>{R5fd)P=cQ}>uK1#3rW0_3EfSJU~PCmY!Fy1Eff#V zUTg9+$Wki6R~sc5vgfW_!lqU<_LJUed3M$cvn!juTu+clmmtn*j*Yc5e3*)wnF#XL z;q~d6p@uGP-0b$%5KPw0y|K3uYbF}FptYT(f)-ZjWKk*Y&LGyr&CC5P95 zfM|^6wnAkEH@)Grg7qK}4e5Poel48gQO*Q~z)DbbOXyK>?xR1PBXEkN&&!{T=Ew?v zthZ*qMG{gAaIecG4VDSknY8__2s!g>wUzA0c>~%80R=cZhd`X7QIsHAX^+`1$#rrG z)m5Mwq>kBSY5NT^TljItDea+)K2aPvHw+xi0~+f3rffmvaCCs?YwQlnEPU#eRgFH# z`Q?J1{{Jw2uGcD$rd9-vs!|6PT3R{i?502rJlN}g;8GRbQX~)i%GMjX=7iGF?}>3pf1Zh>!H`I^t>xQxr9l;Dix&9ABxXDu9$eo;v&xmpRZDD&? zW_kQhCPPbcDqa8Aob#A-!N(5A>#yQ=F%1M=OkfR}K3Dt6p!*nMz5C-x$C0B+^p*0e zRhe7%=1KcJ=6837SX-pU4cv|zKXl9)kH?uHkPy!(7g<%>^UVAX0qPY5x4fJGECc4V z%J)@!0vxYV%m-a*S+$6NY&H}QmwOvTh6(-J5}EaGE18tZYBOt%}_ zS1-rLvYm(7nRl=>$Y`z6gqn;R*m@YtRk04ThwpkObu+~bKQ|o?P8YAV5WID)B;m?a|~^NlH;5-u;W7n4{oRKI%T$L=*cU$9z^f5M?Sf8|539h zcA!(%?k#J?1=7ABn>Qvqx(=t(%nP~CY02f=kBm*62KHs$YXwtXfM@e+(yt{I5CqhC zpx($<=*qW7f&x^f^;Dg3(@2rZ!LOD|Oz`Tl3NgJSXev_$}xid+4Okfh=9{&kp2XG3I-P$KnEVZ)KZT7vPR7V8xM!k%L*IWj-Yz`CUr6bP;Zg zjIh6Cf49pC$>O%$aGiANCduU1yAEqtzc+Y?d!{Q{knWal#gidL__Z+Rj$xIeqMRS0 zTCdHW8pSjGkNo2hs!yOAK(Zi@yi5VI7!c;!vt1LaKF|M4J1N{U1lG_|(R3OIp}wDE zIrKLfSS1d-4>T=*k_^yN!25gQ%#b55Iq{Tpf#AykJs{c{lBUT`)}Pz zP#D!Xv<$DbqWGfdx_U~^3OR%18=D^sGE}1~3UomaA8x7bE)suylF2BSo@EpZv$VR< zbpJ9T1+_Yp31T%Z=kzg0tGs?B@sKgX#DH9$Nxp~sFj}NxMKYgXCNmNLrL>FSh{gw2 ztI$WWfJTtWcy`8c#;-zO;ldT4?f$ob(!Iw_;dAjU?v&GI(2_#ya@u)x6H4R1g< z2)-oTtL@biQNJd4EdOo*S2)eV`@^^%45<@SBn?d*!F(4ex)2jw-G7B_eXIJt@rA?? z1ZAexLsX3)nyNO<77 zV1LL`KA}u}9!@4M*Y?tqc>LWoCE|_^j<5gvwkg;7n$Vpn0hu4pIenvgfzCF~pgw9# zkOh#XVl+Z|{i|Pv-fwo$5Lqqr;^|4d(3|F79^9Gs7A5C*RR^NVP7imUH}T&_Z4rM^xyE=;6OLOby3X`j3?RFNOuZT9x-JQXU)>fHqd?zCWQY| zieifd+8k<0)a#W!SKt*p%dDx7&s_Og+AS_1P`UXPiNynX+r@v(TDtOShV{*DI)lEc zMqf_tb%|yCHE-h^PnK#6gqYWTYmna~DqW}WH{oTNobDX7`I=U0<(X|H<^E2GvWp{+ z@p!0!4WX19NWkSfgJOpD((T{8p0w8E<-1=!08xhjle%HZLOeS-Gft50CFkEMl~&22 z=+X{jNhmyTwyubxW5{{xi)smW#F|7yVZT2G>mTRI1|TM3ar~M$KB$C8+ zU~*BA*_v_}#a1Y|BpsJ^Bs{fo-;;_H@nsd2SUAyg*@#uN+s%pgbe%~2&Fe0bwCtVv67BrC2jf|P+^0B6^o%WY7ll4d-S*h+2+&2A5epIW@A$a;LA4NEc6_K~@u88TTZpOg{oAgVH!*BTP<1n9WKV4{ zFm`NfI0{v7LU4LUQ(<~xSXo+GN@{3XS4LtvO?pC9P)kipFiBS{G%#*XRZDnFQ3@?B zEg&yyWp_?Dc~xXlFj#q1G)YBbPf9dRd238<FNEOKDV4Ykzu1Qh7{7XlDv<wmSUoziXpqB)C)K1}%_CO(DKvNw(xYc07{a&ygSQ45IrTS3)J{V_qb9-hF_a7WV_ zN4u~~3y1_cuRoCo>4|XV$w-nHtzraw=H&V+A|_Ezp}DCH=KgtBqeyH5OXi=TX;mkk zetWWT+cGHt*?%duFPG>acWK*{?AFVJT|-0RtTV#54+a=wN7U3@AU(;+!1fSBi6?c> z^8ZBmE1HvB(PR!nbsiONmq-R^vMKBSCsSl;e2QhXd5hJDm0YilDf9;E%!d(N19u4y zkW|56Y1UKKQ^o9RRD5SlA{fhZUO6*4`;8MBU5Ilx%72*aG8x**iH3l7SaJXX&D597 zKolBM(szH3>c`Z81iP+m08h*-H)cX#41+DAgMMvyY6v2i<;@4O?*+H;tIRskE3xr! z2h7wc^*YGbU-H=;TLl-926Af|0sfGLGBTxI;29B>W*cOLei7cpxm_tNDMmmW1PREP zp!x=@!Z6nq@bo~%{4UX*+_u9nagp=|7{d2_jB9#83LGnjz8|LQ8REWYeG_OaZyoWGHgUbD=|!3QDIJ1NoP%HbT2DxW>!O5No__;a|$gj zEg(5XGe%EJD_V4EL`_C^W@IZlb7^R2O*TYkS#&i;PH=QiFn@G0ZcagQcW(;%2lZ+* zI6V5nvE}%ujxbI#S9{@!D*d)joL^l-2o$=mtOg-@m3yz%+$(?4@+p}2Wxv{xYO`-8 ze8;QKr^IvxG8Ob%$9qaG0CKUB#0zDXjy_)Rel3kDlVx>v?Bqjw)A2UL@@_L>?=PFq z62EJw_(||nzkkQ7uI;jx8i{HTBwgrxutqQopKzktq@|?k95;Osu#hZI4X>_{^qy$W z1?ddq1IGhJKjMSWPYX708yFJGi&`uhT5=kAgQK77?K$Ne1(n$`zPRoD^JOELwv|Lf zx6#MG269X9>CzJM6jdKk>nQjZ;Nh5Si_#ktYUyd+Eq})}`SIa$FeB)L#SIxU=mZWx z2~F@8nt#I+y2k|O?wP1sz_g3UFzubmX^N3odLj)z1oY^aoxt>V%fcNQ?U)e~-vbOfaWnmQ)vCH3|e#WZz63nlGy=q*aIZRrMA F0HjPoic}3M#vY-9-%&?0Z}+R+sabkHd~qvo+AHt_!XRQ#J|2?W}B(Y)eES$>_B7bHZMkJQ~xz;puP8`EEvYCc( zpN@6sa5hiHvVU=AQBsI~_9C-IXKPnypS<;ea74&j#r0eNK#CD2| z1CVpsj>z6w3P87{=6k9XqBr`=ejW<cHf$X8s;1j{4+s+DvlqkmRDn?WWf zT9yb<=zpej##@Qoml1#+Q5fS2G~m1}_w|W1Yg;hD!H3 z&kefAmX2i9-*ZV8AflW>mOJ}T0ID+Yd7E`rb2wjcgbsl$y|wzL$4;xBEfdygxQU_h zVXI}fL8=?Bn)p#xvd)x<+zrE>tF)N!2sR{pM}OoB`GL~se~y{9*kdh}U11I1%=LzO ze`x6mY%zi8w8QlKu|l%Tz;~YP+^W;eNaR_?qKkTS<;TiejQ3kUc3A4TI&%#p)<|@4 zDcB1dWT0|w?lbSe%j-;ff<10#C`6#m@}WTefHu0c=IUbs*f4YyO49xKMCJV$d=bJa z@PFH9OupKl_f}7?PDPp{vkGNINA+ZR>3ISX`CL6p3&y+Kg(L>oA4S%TB<2?T5TpMw#1!qcm@@Y*DLzIsSd*CA!M9B6_Q=$xF&Lp^Gpc2k| zf2sq``X;PPonC?~W$Esk7l{=n%umGd+3=d&bnxBW8kFiorq_pZ-ByCS9*$a~J=7pX z$La6OxJq*gBpA4*!M~173jnYobA)WI@to{p<@R$)MI6WI{P6+@b!$AKh?_WB4_<%H z9{Q}umV?|g8^~*ZuaaFp;w6CusW-4gf@hU&C|td5yEn_M?`v4c2D7rcD9IEgya%(O rJVAxsPD{VBY*1SKBar;Q%fYB!L~RK#rYnHRW6zER4jTQTMLHC95n&-j delta 1125 zcmV-r1e*Kz2=@q(A%8|QaAGuiOL}ulSvOF6QEFFiZDey-NLe^obw_qGQc!4ZPeEZg zR%tR-3NSNpYHnz3cQiF-N_0?4P(yG|R5@8_Vr@5OO;~zPdUZ5nWGib zOtBrK2l^%k@Kg-mcii3g^_@Ld>3s$;d--byT_0!M7Az-z^(up8s9JCj=)qm~AOa@+n^q%+fTM|Tr!qfl1P0>C++HM$J z@xT({Nm{!`Z6eZBZI#QCYdfj%h$4Q zDcDAb9)E6&{vKvM3b#cKskjiT1OfP`eww}e$dMxyi0i`v+OrK3!kRjDnU2pY@parU z=ka>w&Dw8k*@}+^mFLd=rOj7mYH6V&m9mc4wIDpD#5yF69HnI!u#Ld67swN7g|+iHPLf(pE0R+8pbf-`;57scDD*yK9^Uydwlw zNHmW7)@?U9q^5&Is0ieZd4j3^wEWU={vO-CEg^EKvoBnDy?8nR7PROgZ4&qh}GH z#S4>BI?1=0Ij-H47Kvm664BCQ^~U@c3V*>80`l2YZbi<1JqW^FV$l=SJp9a6jIFwRpOQb zw}}-ppU48QMOFZx>ONG)b5Bw}hhsGPRs~?X56+GAXjV!Xc|y)l1+hRfr1tpEG+wo( zg4t=FT0m@uqImjN{ExNR;)9t)NJ7M(`FTpHmZD9AxtZX diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age index af3743ace7fc117124c8232d7f27b66914d72883..515c59e44a26865875b6930fe9a3fc8ba9b336f7 100644 GIT binary patch delta 573 zcmV-D0>b^$1kwbMAb)dhM=MKAFKbjcMKpJ4Vopk0H$*r|L04B&GBasTNkAVlP!Ma&t&oM>#QKYdK+5Qb9~NN=Ye?o`hl$p-R4*bL+HWj=2B34$``IIcTm`Bbszo5^&f*A=yM7^s#QK;hsfmSV z%#8G(*@!u?Hh+sgnBHN9pW*mF_V)eGrBES*8|39Ir4=h{$O&pIPDDS=8$|W8vEcZB z&#eaL{XKZ^d$SR|lhLmB0T9lk%1C!}6sg~%Le6u`s73!4+<(Ua^J~UT8g{YaQHXD> zT&IHl4@l*4&eQ|nv%$&(rQ*xM0k1$av=Vc^N5cti!T`J&2ggJ&YgUWgCx^<%w!PZ1cBjY~NEdo$L65END zWsrc`JT{^_k1z(+W6^s2kbA_#-lbpw3oQS1^MHwKd#rG#dzNdZja~JkabS_gnB>4T LKenLIKHIXb^$1kwbMAb)BxO<^}UNijlUb5Kq}SaMTjcsF%5S5HB6T5M}?QfMz}WoSxv zT69`NcM3UpM^!UcN>@=bOjdYjXLV3PML~E?IV(3yL2f~4D|be4LPmIMQ!-gZFbXX# zEg*4Ybx(RXRBK@~MR#vUO=)#VS8FdcXm@LIVPZ~1SvOWgXMb&CS#owoL1zkw{G~km z@hQGL;GwD_*YZ&aD@#pt7RC$0<&oc~kEGW?2DwaE3a>GD4}#JKN6*KzQ=mSpZU0gV z1m%6a5&_C(DywgO_5(@m*RMc>sS+`}h9`OZ1=HI9^cz$~ME-vB0RKOqx7YmQl}3%> zK74nXZ9Nu241b;~{2f`DtBWXf#Vf~zgg9n2`Rr`mu`*igM^q>+2Zo+t(}1j-1Y-ns zxHw>`K8&YRixKgI`DeN(Z5LIn=r5N&A=Ft zXFo2tY{TOBf#_0s>p}~`(&nKCMn##IfUI;noq2CkUVl*5B`*k_p?WJ`nRAGe*f+qW z%1bbshPmBU6OE(tQ3B11cgUY2Id*2$O4$*nEdhlncgq5dtcN?c&uAoRM_HNNkjLC` ziHh7~zMTyONg&1jn86IXjQ}ca$zG8|mY8S#e X25519 GCGqgOi+miKichWZWpsLkjDiwEmizETg63AEEktJ32o -Q9lcgmPdtNJp6Dcu9kK4u4S+y9l48Zb3BC3aZ+RPCYs ---- PssPTg1WtBF8F7prFNjVIPfxa5NwDRN0aOjJgf4OjEY -�öÉŠ¦õr´ ?37u!Íã²;t÷̘ÐÃÚ�¿�LDбm­‘½ 5SˆÚÀ“¡×Ö|M].ÛoÉrV±¬ÇhR~Þ¥ ¾ËŠ?eZ@;ö@ªô+ë…¿cÕŠ®»¨*-²,Ù/ ÒK„Põ¬DaNE¥�“‹ÔÒÀÀ€w¶# \ No newline at end of file +-> X25519 gjqvyZK6X4+v32GvKVjQU2DvzRn805sl16jVQMWOJQ8 +5p1lojGUeQFxi2eTSeR+qI97Ac42gH3hVRyQZlRgYts +--- X5M2niIOYt/jdHPXB3zeJWHtAH97V37bnsTLikd47I8 +Ks[ª?ßÁ0~¤Xžþ�šLØìê‚”k± éŒí)Ÿ`q…ÎYAΠÑDÐÝ�@ýËÿ2â)Q0¶q›iš€ Þ}dGŠÑý@©$ë}ÝE×"7IAšoMbB¹H²ÀÔ¤B¤«"z:Áf �Gt/µýžò'§ ›VVê! \ No newline at end of file diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age index ac1794b939c14c7d7bab881e93e73acfae450691..3240ba4e42f8b7c48e945fe1e48b678bd95b1c51 100644 GIT binary patch delta 1864 zcmV-O2eB*WOH;yGC?p(Vs?0VcXoA4L2oZjbT&>^HBN0WRdRJo zQ*dZjRSHEfPI_5ZMK3W(Xh=h1IWc)tZ&^}zXE}F8G)_rjOfPjuGI?xPX=Zg#NeV43 zEg)HTQc_AZaA{X_X;@52YF9^0F;-Dv)46&_=*yOe~2I2u@!644`TVA=dIW$q*$Y8qVilg6YcM4y>6vs zDA=BNap@Y7DpZKB_;T8x%W-NY(5C6lu48d`u&Y+EwZ-6hI?+us;uUsK4W>^sZhP;zq{ba7pukT}Q4issmOv|ux z@l>U)5PIi()-!MxJ9vGv5qYT%yb8c7K>y4S-hWJ0dqvFxQziI;@+~&3r(q^sM$OLN z9FhbiwGchJPgn%p!HXUsDU|0Lp^A?HEt9RKi*w}n)~Wm=#M#o0K+8BuHjHYLeA9(& z(7BszlD}lyol7p2gMx`RX0xsf-?!`&^9+7Ni;Mxc_B{tfYg#&} zoSWE9W~O$WSuLIIU`lbGrd=Zvcc@&jCALoSa3L7TaT3%-ZUgR3P7EdHSG|oei#To@ObTkqltZ zaQUJ>SS|kKl?HBwo4meuJ_l9+B-bbKJaGd?$eZ`~zNd>xxam}_LSZzKF>))2(SP+| zpQ^@YFXODhEyOUx;yYUMK9C2A3caCtQAYyDlyQ5OO6c+Hp<9b)W{v@omo}hrB0{Z%XC058W>LasS)Gc8V~#k~>sSH1 zcqvhix4sUcY*|HXnZ|q`d83xEA9inwBz|uMKl(C%D+!na;PCl?>KNr*(0?Mt0SVdYNee>hLd?>jTfG0YUbJucw-muk6D34D_y2YnTy}Ot)2$K)i$is2PK_mY z*)(p=1wh-}3s=5x^Xqnh!3r^Rdp4MkL1Lw1q|7)8rW7t7(DcLuL3vx2X3}upWS?G{ zeJrIBF&4qBQhS0vsVQEP1>^ zh}jWnl;OyvhA}RBVBEl>^Ih=ROC574s6M36nP|p>xhz7kWG(vzQ|he$v~8&3DBMWR z9s%$@7(bQz zEm1v9J3#;?xbH4J|8$v_qp&<1&ZfoHk>G~}GaJD|nsYw8lMcaf=|@2j$i;HK689i{ zijG$@DQwblNyBxHjDM+-fBN#qw;$>i?DN|ydF4hzCUH%^$-xr$1~IMo|FU^(9E5~_ zwJSL30SV*&bctv~XM2ti3wzp delta 1864 zcmV-O2evOL2hShZZ7d2C5+Ok#O$V?;}HRVz+VZ$VdgV_0EPd2CTHFG)c(Qh#n(ZFy5=ZAA(_zF>43 z@T#;ykQ^Uz|BQk zy{(Y|)HrS7Ek2D{7XIvrLbx)fqzB3}|K*{r@V3;M*Yb@OAGkrBG>my$=H94%-BMBm zGXU3kIF3KlQ-A3i*UWA9usC@=g6+p{1zh5bvNGNy&63=il0mt+!{T!s=<4{aAP=pG z=OQOU&mwKckCJ?26YW7;F68U-hH~@U*UDBP`23V*3E9507(eQXcP68D)4Xwmt*Ef} zP+hh+mKM-Nl1j=wlS72+R4C;l_Os!qv#X8Wq(%A+!tW_7r8{U1#Eb!H?|b%_n;p&BlG@nnBaf~)2U^z#F9AI#8n$ue@l_% z57qL>Cr1@l(H-;~oM=c+a+h&wuudm%X%dy| z5Pu8^tKd5YRB38n{&WQCtN>slNIXxGUkTgf4oTqd!rKFq6!?PhQqP8K#mb_^i9bjx$pShAsF4}wjMN{X|N1qH6teJ;l-8`A(&H@( zaV)Q-10KdNdj?!xTAu16wn=)@1gY}35G4CnP@Hbi{)28MLp5T~>K@nOz&&e!r((^0 z{}SRq0-5*ESXYQ%2Ww;yzO9DGV}F3#qH9nDAJ)6cHK0*<;$vGX0jj#hszHylE~a$e zd4n?KH!qBRhEF{^)961@A%E>}@NYt* zz$ecEsBm6>Tx&;FaWJpa5L5w^hh79RqVLxv9fh6);Pxq$qsRvmiM}Op6Yl`?(t~oz z#)O((W?=*x6RJ49z%u*fod4jGKIXkVG|+!X{b_%H1;JKDMSsw9|AVmhxUv47X~1sx zSf*<0zS2Y%Z*KG!g(knQJ%6!+>Z^rRUjP05|4!x0JNHCrtPY|7(B-c&?`&Z7uoZfj z`iC~=WZamuh$E*ATKfyeD_KnG_%)Fm8l1tiah#G?ogyQPQrv`~OEuA>?hOWU=raOy z9TsKlSPHX!`LHzM7DNeDmqMVJ93W6=8W|@pQn8!VoF?+2yswTj2Y(o$m;{v3mrrlW zG7#iMp_fN~&Z=N#40-c?E8W)xkv0hdok?j-UFYto>1xWJ@5j}N=+MfooB)cADM;-= zcRZ@6gG%q~@W2$&nD-ps8aDw5MB_Uya?Ke9tz2&$EWV<>4Wb3;!@v?#vVju3>yzps zS_%td+Uz((_g}u2IDbDNX1rbhS^GTp(XASWk)suf6K^znBCq2=P;2y?(LgOHG`P5f z!oQZmw>_$AD@_dvxE;_9tSX5iyHXp>($M*4+2_=rS|9J`##sn-L1&alcAb&w|cxpykT5L*LSTizCO=W0mLOE4QctlH5HAYZkLPd6DVo6nG zSY|_MRSIq^WKnTRM|NXJY;7}cPC`j`Q*TRWXjnHnd3SAMS~P4=Wid!uaCvq&MG7q~ zEg)uiIa63lN?A-bL`-imFmXmxXIe*EF;q=VF-&h~R%&B)G=D;2H#kdXVK@rb`O=56 z+K>WPjxwtx;Qu12{ykGXp7A|P1myAl=@+P9UK}~R*8w@3kx5_}_OHRjeOQ_A%&S+k zYYHdwU$*~YwO8|1s^u6bn^oa15+%L>C?i?Af%gwxbq|MObUKe9i|;Xfh(uBg9Taum znjKk=;P+Gpo_`H71L@Q$f;pEMJIIB%)Co-s>WuyB|dy^ywn70Fr(e0(FHm@y7 z!n-q!y93hGZOwDoi%!cQxOn=)V9VXgWJ`M_o`8eEAn$1Z{ljAEjUJYEy>@*nK<>cx zLUi*j&0kC@#U}vEWl;K0*d?qL8)Wp8&Pt{|qv)xNjDPu=*ieks*Vno}@|No~SEKMf z2?$@m6Aw4=VCLK0X zS)caa8TWf>IYFq9$}CTk&)URHU0T8&exQCpDO@8kY9C(04`cf_N>PjkCF@FL5e4%h_vc!I!D{CNz+?FDmbQ3y zwYoMAB^WXW8O5g38gkSJ=${H@;G6+aCR-EI)m{D&em6M?9ltu9L3h=8Q%T4AteFDr QrQPH#duL=w#U4!GZo6D05&!@I delta 630 zcmV-+0*U>L1&alcAb(*`bu)N%L@PmKFi~PExV@^YLIBhvrb4@{5M`SNcQ&?khF+)LmQh#GXZCXM{cU1~}pr1)s zfyE54;FkzyV6#n_Jw1l|K9&D25LIX>GYL9x6fH2LlaX4@E2fYPuG8&^*SX=}k4dBG z`cAHEP5w4OCjg@Bi$U3ZVM413)dAa|w5u*oS``H0E;ptGXF&Ow?9fS58Tj_&VYe}n zalRX`0UJKo@9`&Dg!E2_Bu>KmM_zB^qiaff~!%KhF#e5f)Rd=kTe7s*rzBDp=nC}TRZtCW$U-CFL^MAu4ew>5x9su-cJBx4o8*3l| z*u>6^*~~~r;d?roKRQuL z&FhDAn{VL2*Y_Y&a=MDuHURu8HBwA~wZ7p#hrv49KlPVr$_vE1ZJY-B|9pPz1X!ERd$PEkq~+;IJDPuf%V1=|!ST6^%( Qmy-K&r53o_p~t3kt#+p>(*OVf diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age index 6753f6afb2dfceb1db8b40e753c44a5143b1642b..884aec65ba5f7d1a96699ce9cac95e43481245da 100644 GIT binary patch delta 1126 zcmV-s1eyEy2=@q(Ab&AqWk^GMQF1kKV`*w;Q8jdCODj>(Y zIa)bLa|$;zGEsC*Yj;g>VR3SGPi19oGe=@pNilUVcy?lKPIEa{Sz^TM`Le#Xjw!}H*R%SVt+$YS!`-FGf4`5qLvwU zHx(JpXGZA-O)dH57cj!zM#p!VLRyvuNmfQR0(;a3LX83@+b|M}CIO}4tSPS{RpJD0 z=LTSi6yJXscXf5z%zvkc&}B$?A9w%A)})*IgtxdYq}r-XHf*z?RUPKnal!Rw!^~Q^ zCmS3HD_rJ^c7H8tF8*di4dtwRrE9RD#Ai5ue|x zBjFLRzDIs&?{9Y_W3Qwoq*{P+w1CO8Xq(iSsMrr{c>l7`YQD^siW-spM0~?N>MiSj zk6!PR&~NO%yF4_Z&3)>fd^)1bURXQ>R-vAC&J7_Q7k?hYeDZMPK?ewWW>+X2SH8Q{@0R{wtP@ZH*HHB`54ghFy4ETP;jVOf^-gYA z^YtOGv1sVJMn;$50ksAPM=H_ zmxWL08Wi=Cvu_!?_Qye~GuO{7+#frto$cayIy)HFwG>|<{Rh?ff2(G$$^gk7-~yIw zVcB(;k(jpEPdpOtQEa6x*nlS+lx8%EnLbSz0cyw|otjrT2=Z_1)s|mFGCJUb(qAPj zaudFp<0<%YEP@-R7DPJ5<*5u$Smt_CAyNH_#WC`_7r1F5PbT1Aj*SmZqLr-QL>yOD sY?`kDDx8q=90GesCM9ZCE3NmM~( zOG!CVZwf+sNqKoRQbjpqGFNqTQ!ipRL@!ZSdUHr)R&Po$F<4qma#3(qcVjPWK?*G` zEg*I`Vt6k~dQ4DgGDlcKVJ~k~WkF6-Xh~B!Xf$j!H&a zhECENbJ=P)n17>#DWxswWsM=K+Tv%YGrf}fFP?u8QpB<+@Lg}T7}Y_MQU285`@Lur zh&xS@HF1wP{h_A?B_YvMW>`nOUV0FW8o+2AU%|N*TpneJ75zQ`*Nf3%NBu3bv+^d6 z619zIQPPJ(IY$$*)7+~B4Y?ZPyF1kmS%gWl-$@b^y?^P_26CqGwrh(M&rD54y(a0( zN6{Q9f^%l2*EZAL;E<(NUD4i{AbQ>=hueO3Kib(`_izm{jb`O!8E@tw#p!F`1`&t16|cW^lIc7KSAkVM&hPdSee! z3Rr(;R{a;{ark@!-+Q`UV~g3Gwz=|y*ip8#@E_#TWJ#v>l7yU$E;;{Tw(ujh!f16! z-j6$X1!ZHh&YJZpYI|ZpC)iE^Dmddy(SK=a8#MOi*|MHWr7ysL2=mP^7z34*U60w? zM_@~}hr>xT#ZXO%+_+yf37$I#j;#PCy#FB=+KOeve_v;VZJUWm$F1|u8EXNiI5ai~ zyb5Fj$kZSe=1{9LzJz1_JF#NxRd@M<`mE+DZ<>|<@*G<@1TJ;z$q@k^C8W~ia$g7Y zCxppLS-j1?o*Cq(4VWUjf1zku&1s)IV@~g8=pMJ{!gFZ~CEcc8-TV=lx%e~jSXH@0 sb6k6rld@Q1yJe3B$Ku}Jv>>-^RIUi4Z6jkS%}9zpPM2IHXL`o{4np`4fdBvi diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index cefafb3..a38ffc5 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -137,7 +137,9 @@ needs to be decrypted for a bind rotation. **2026-10-30:** reconciliation tool prepared: `sso-mfa/bootstrap/reconcile-keycape-client-secret.py` (value-free; accepts the live KeyCape value only if it matches Authelia's live hash, writes custody through -`rotation-env.py`, no cluster writes; `tests/test_reconcile_keycape_client_secret.py`). Founder run pending. +`rotation-env.py`, no cluster writes; `tests/test_reconcile_keycape_client_secret.py`). **Founder ran it +2026-10-30:** live KeyCape value matches Authelia's hash; custody did not match before, was updated and matches +after (value-free output); custody re-sealed and shredded. The reconciliation step is done; the ESO move remains. ## Synthetic verification instead of a founder sign-in