Sharpen NK-WP-0051 field names, opt-in page, and preview tool.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52

workplans/NK-WP-0051-sign-in-diagnosis.md

@@ -5,11 +5,12 @@ title: "Show who a workload sign-in actually is"
 domain: infotech
 repo: net-kingdom
 status: ready
-flavor: planning
+flavor: implementation
 owner: codex
 topic_slug: netkingdom
 created: "2026-10-14"
 updated: "2026-10-14"
+depends_on: []
 related:
   - MASON-WP-0011
   - NK-WP-0034
@@ -31,6 +32,12 @@ account site, Authelia, and OpenBao. The account site stayed on
 then said only `claim "groups" does not match any associated bound claim
 values`. A user with no one-time password never reached that refusal.
 
+Done when an attended `bao login` with the T05 fixture uid shows, before
+OpenBao answers, the uid, its group display names, and `aal2`; and the
+ops-mason receipt for the refused login names the same uid and the OpenBao
+error text. A routine login to a client that has not opted in gains no
+extra screen.
+
 ## Boundaries
 
 NetKingdom orchestrates this. It does not re-implement the issuer, the
@@ -72,7 +79,18 @@ returns to the application, the KeyCape log line (`client_id` and uid),
 the account site (account-site uid and Authelia uid on separate lines),
 and the ops-mason receipt (uid and the OpenBao error text, no token).
 
-Done when that document is the only copy of the field list.
+Each fact has one field name, used unchanged on every surface:
+`uid`, `groups` (sorted display names), `assurance` (`aal1` or `aal2`), plus
+`client_id` and, on the receipt only, `openbao_error`. The document also
+lists what never appears: tokens, authorization codes, email addresses,
+one-time passwords, raw `memberOf` DNs, and session cookies.
+
+`assurance` describes this authorization request, from KeyCape's assurance
+decision (`MFAVerified`). A reused session that was `aal2` earlier is `aal1`
+here unless this request asked for and verified the one-time code.
+
+Done when that document is the only copy of the field list and the other
+tasks link to it instead of restating it.
 
 ## KeyCape shows the principal before the callback
 
@@ -87,7 +105,12 @@ state_hub_task_id: "a78219bb-2355-5a2e-8750-0b32a57f87bc"
 ```
 
 key-cape shows the three facts before it redirects to the application, and
-adds the uid and `client_id` to the existing auth log line. A groups
+adds the uid and `client_id` to the existing auth log line.
+
+The page is opt-in per client (a client registration flag, default off),
+enabled first for the OpenBao client. Routine logins elsewhere keep their
+current flow. The page has one action, continue, and a line that says how
+to sign in as someone else. A groups
 refusal from OpenBao then follows a screen that already named the uid.
 
 Acceptance is a deployed key-cape image. The log line contains no token,
@@ -120,11 +143,17 @@ priority: high
 state_hub_task_id: "65f85a11-8512-5700-b258-feb2ead84372"
 ```
 
-Add a read-only preview in this repo that prints one uid's `memberOf`
-display names. No mail, no password, no one-time password. Matching those
-names to an OpenBao role stays a metadata read in ops-mason.
+Add a read-only `groups --user <uid>` operation to
+`sso-mfa/k8s/lldap/lldap_admin.py`. It reuses the existing snapshot and
+custody login, has no `--apply`, and prints the T01 fields `uid` and
+`groups`. An unknown uid is a refusal, not an empty list. No mail, no
+password, no one-time password. Tests extend
+`tests/test_lldap_group_maintenance.py`; `GROUP-MAINTENANCE.md` documents
+the command. Matching those names to an OpenBao role stays a metadata read
+in ops-mason.
 
-Name one negative-login fixture in the T01 document: a uid that is not in
+Name one negative-login fixture in the T01 document (`signin-probe-negative`):
+a uid that is not in
 `reuse-surface-hub-writers`, is not a platform admin, and will hold a
 one-time password. Do not create that user in git.