NK-WP-0033 add attended resolver reconciliation receipt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

docs/keycape-exposure-resolver-reconciliation.md

@@ -2,7 +2,7 @@
 
 Incident: `KEYCAPE-EXPOSURE-20260823-01`  
 Workplan: `NK-WP-0033`  
-NetKingdom procedure revision: `f2e578c`  
+NetKingdom procedure: `sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh` (revision pinned by the approved checkout)
 Platform recovery contract: railiance-platform `453fed3`  
 Owner cutover receipt: State Hub message `45b236c8-052f-43d3-a472-44f8e9694da2`
 
@@ -19,7 +19,7 @@ State Hub, Git, chat, command arguments, or ordinary logs.
 The operator must record a private approval receipt containing, at minimum:
 
 - incident `KEYCAPE-EXPOSURE-20260823-01`;
-- NetKingdom revision `f2e578c` and platform contract `453fed3`;
+- the NetKingdom revision containing `reconcile-lldap-resolver-live.sh` and platform contract `453fed3`;
 - the owner receipt `45b236c8-052f-43d3-a472-44f8e9694da2`;
 - the exact start/end window, attended driver, and independent abort operator;
 - confirmation that the replacement LLDAP credential is the provider-approved
@@ -33,35 +33,36 @@ identifier differs from the receipt.
 Run from the approved operator workstation, with the cluster context and
 provider endpoint already authorized. Do not render any Secret data.
 
-1. Verify the checked-out revision is exactly `f2e578c` and the helper has mode
-   `0755`; inspect its source, not live credential material.
+1. Verify the approved checkout contains `reconcile-lldap-resolver-live.sh`
+   with mode `0755`; inspect its source, not live credential material.
 2. Confirm LLDAP, privacyIDEA, KeyCape, Authelia, and
    identity-provisioner are Ready using deployment/pod status fields only.
-3. Confirm privacyIDEA and KeyCape health endpoints return an HTTP success
-   status, discarding response bodies. Do not use a command that prints a
-   bearer token or configuration response.
+3. Confirm privacyIDEA availability via the documented unauthenticated
+   `/token/` probe (401/403 is expected) and KeyCape discovery health,
+   discarding response bodies. Do not use a command that prints a bearer token
+   or configuration response.
 4. Confirm the approved window, driver, abort operator, provider custody, and
    cleanup workspace are ready. Stop on any drift or missing owner.
 
 ## Apply (one attended operation)
 
-1. Create one private mode-`0700` workspace with a cleanup trap. Keep the
-   pi-admin password and replacement LLDAP bind password in separate
-   mode-`0600` files or supply them only through the helper's hidden prompts.
-2. From the pinned checkout, run exactly:
+1. From the approved checkout, run exactly:
 
    ```text
-   bash sso-mfa/k8s/privacyidea/update-lldap-resolver-live.sh --apply
+   bash sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh --apply
    ```
 
-   The helper prompts for both passwords, authenticates to privacyIDEA, and
-   performs one `POST /resolver/lldap-coulomb`. It passes only protected file
-   paths to its child process, never prints values, and prints only a boolean
-   result. It must not be combined with `repair-realm-live.sh`,
-   `bootstrap-realm.sh`, `creds-rotate.sh`, or any full-bundle generator.
+   The helper securely prompts for pi-admin, replacement and predecessor
+   LLDAP passwords, and one approved MFA code; authenticates to privacyIDEA;
+   performs exactly one `POST /resolver/lldap-coulomb`; proves replacement
+   resolver lookup, privacyIDEA MFA, replacement LLDAP authentication, and
+   predecessor denial; rechecks readiness/health; securely cleans up; and
+   emits one sanitized PASS/FAIL receipt. It must not be combined with
+   `repair-realm-live.sh`, `bootstrap-realm.sh`, `creds-rotate.sh`, or any
+   full-bundle generator.
 3. Stop immediately on any non-success response, timeout, unexpected endpoint,
-   or output that is not the documented boolean result. Do not restore the
-   exposed bundle or predecessor credential.
+   or failed cleanup. Do not restore the exposed bundle or predecessor
+   credential.
 
 ## Postflight and predecessor denial