NK-WP-0056-T04: reconcile tool names the failing phase (custody, cluster, live-pair)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e

sso-mfa/bootstrap/reconcile-keycape-client-secret.py

@@ -52,11 +52,14 @@ def main():
         print(__doc__.strip().splitlines()[-2], file=sys.stderr)
         return 2
     root = roots[0]
-    phase = 'read'
+    phase = 'custody'
     try:
+        custody_value(root)  # fail first, and distinctly, if the decrypted copy is absent
+        phase = 'cluster'
         hashed = secret_data('authelia-secrets', 'keycape_client_secret_hash')
         config = yaml.safe_load(secret_data('keycape-config', 'config.yaml'))
         live = str(config['authelia']['clientSecret']).encode()
+        phase = 'live-pair'
         if not bcrypt.checkpw(live, hashed): raise Refused()  # live pair must agree first
         before = bcrypt.checkpw(custody_value(root), hashed)
         report = {'live_keycape_matches_authelia_hash': True, 'custody_matched_before': before,

tests/test_reconcile_keycape_client_secret.py

@@ -83,5 +83,13 @@ def test_refuses_when_live_pair_disagrees(case):
     before = env.read_bytes()
     result = run(case, '--apply')
     assert result.returncode == 1 and result.stdout == ''
-    assert json.loads(result.stderr) == {'result': 'unverified', 'phase': 'read', 'partial_changes_possible': False}
+    assert json.loads(result.stderr) == {'result': 'unverified', 'phase': 'live-pair', 'partial_changes_possible': False}
     assert env.read_bytes() == before
+
+
+def test_missing_custody_copy_is_reported_as_custody(case):
+    private, *_ = case
+    import shutil; shutil.rmtree(private)
+    result = run(case)
+    assert result.returncode == 1
+    assert json.loads(result.stderr)['phase'] == 'custody'