NK-WP-0056-T04 done: svc-privacyidea written through from OpenBao; all four binds in platform custody

Founder-run under CCR-2026-0055: setup, verify and realm_bootstrap.py
--rotate-bind --from-openbao with the admin MFA proof. The first apply's check
got a code that was not admin's, so both MFA prompts now name the user.
Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age

@@ -1,6 +1,6 @@
 age-encryption.org/v1
--> X25519 un+UWbG5oXAsm5dXauwEzU41cpG5+blwU2gbAkEmVXw
-j7kyOG6iU3FlO8Vcc0p8LklEjMlPw5kC8GP9g3mffx0
---- JmF8vLxSsPTLu5qhvDscgD2EwKpppCW+ELfpdjFsdvg
-#ƒòâ•Š<E280A2>\]÷ R»kHG0É[O
à7°‹3QšU0t¢ ŒŠ6¸áÄ2Ÿ¼Ê4‰ ØŠˆl—%qÔ'}߬›¯)qµYþ¬oùÖ GšÐ=¢ÂçÀø^9ƒÂ„nJï_}“ÞP" Ã¹O¯ž¦÷y5a…v<E280A6>çžç‰—4nÕ)bôÄ‹ØÀ‚|š2]€õtg!<21>‰ 8²|;ÖÞ!ÆŽ¢ÖîQmŒlè¯[ʯ5”¡â5Wì¨_4+×
-jŸöÕ8±S±Æ"Ä´­¹«èº·¡~vzÕD¿î;ÎŽönÂyfö³sl‚<1F>-<2D>GÃÖCb{´›kùlw~f5}<7D>úH’ÿçŠóÛݸ¾«äú´
q~ÌÛx|†©0fæ{a,D½¥^›<>¨ˆt†`ÜvNõösc‘%‹ <E280B9>#‘F|XÒM÷zK¢lÍÒve2\‰hì­¦æ™ï–«òä2¬_M<5F>¬âí(Í<>3¦fÕ¬±m"+ýícNY„ùÓ:}­‚Ú¨ï0ÎD8ì~ˆî»Þh¬LPZç0¸Öûù–ÉèZXå?Óq"‚„
+-> X25519 QLBViIVzS9+rvilFUi/3fTJYoWmfLFnatUUgeSeLWkM
+CPWJ3Dn1NY/Uo2+8rzQcwaIeaz9HD6jmCm34zPw4X94
+--- iHAsNfMnCuzehlSl+WmGOY7TORSrlB/xpV606yXPkcE
+ÍB]M¥ñÒè2™=Ç=e̮ײ¾;ä`á<qì¢BÈA<¶f°¦øËCOCõ{KáßaB$ìlì]À¼Ð<C2BC>¥©ã¬²¯Ÿ¶æ‰°'µt˜ÇÊV½º6Ž|a.ŒÞ¥Ï¡$ØЦÛV™¼Iµž­;öfS)N?¾êî	rc‡œAñ<41>W tã?‰YÚx?¨<>h6 6•ž¡7-/•4<E280A2>Wx«0ζ”¼p
…bÀ±žÓãŒI³[“8ŒÐÍûìJÝVÝü#"\a2Mµ—†f¼oÊgg—[n½™ýÍ9Uõ<55>‡PœÔœ))òËšÕcJ	H=
Eø«ÞôyX-®E»)Œ9<C592>Í®9A0®ïh‚iwÛÖuiŽ¢*!„v¢ú0ÇÃLìRYp¥…^½Sj§°‡®ÅNæ}>‘Ô5_6
+«óì:HÜf:Wá:¯Õ¸®p‘ÿ]!üÏw¬^¾OÀ«™*ˆ
‘ʬõZ]U>ˆZªÁ“	FJ“⌻ݶÇøÏÌ©Ñ{Ñ°e9Ð2þ׶7[ðÏSô\²Íª4Þiz°\½Ñmœ˜ŒK1

sso-mfa/k8s/privacyidea/realm_bootstrap.py

@@ -233,7 +233,7 @@ def main():
             phase = 'functional-verification'
             from verify_mfa import verify
             proof = verify(base, args.verify_user, REALM, RESOLVER, admin,
-                           lambda:getpass.getpass('Fresh MFA code (include token PIN if required): '))
+                           lambda:getpass.getpass('Fresh MFA code of %s (realm %s; token PIN first if set; not pi-admin): ' % (args.verify_user, REALM)))
             if proof['result'] != 'PASS': raise Refused()
             report['mfa_verified'] = True
         print(json.dumps(report, sort_keys=True))

sso-mfa/k8s/privacyidea/verify_mfa.py

@@ -116,7 +116,9 @@ def main(argv=None):
             args.realm,
             args.resolver,
             password,
-            lambda: getpass.getpass("Fresh MFA code (include token PIN if required): "),
+            lambda: getpass.getpass(
+                f"Fresh MFA code of {args.user} (realm {args.realm}; token PIN first if set; not pi-admin): "
+            ),
         )
     except (EOFError, KeyboardInterrupt, ValueError):
         report = {"result": "FAIL", "phase": "protected-input"}