fix(authelia): load rotated client verifier from secret file

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

workplans/NK-WP-0033-keycape-secret-exposure-rotation.md

@@ -54,7 +54,7 @@ or copied.
 
 ```task
 id: NK-WP-0033-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "c5ca817c-d601-5172-a106-1546c0743635"
 ```
@@ -78,9 +78,14 @@ Railiance-platform published its forward-only owner contract at revision
 the LLDAP credential also feeds identity-provisioner and privacyIDEA's
 persisted LDAP resolver. It also found that privacyIDEA `/auth` issues an
 expiring administrative session JWT with no individual revocation operation;
-`/token/revoke` applies to MFA authenticators, not that JWT. T02 therefore
-remains in progress until the contract chooses expiry-based predecessor denial
-or separately authorizes wider JWT-signing-secret invalidation.
+`/token/revoke` applies to MFA authenticators, not that JWT. The owner recovery
+selected the wider privacyIDEA signing-secret invalidation path, so predecessor
+JWT denial is covered by the live cutover outcome.
+
+Completed 2026-08-23. KeyCape reported that its owner-controlled recovery
+replaced all four exposed classes, including the privacyIDEA signing secret,
+and that positive/negative checks passed. The live outcome resolves the
+predecessor disposition; sanitized receipts remain in the owning workplan.
 
 Warden routing has no concrete entries for these four KeyCape lanes. Catalog
 repair was requested in `e5794329-cda5-4a6f-8234-a6eaa1fc318c`; generic or
@@ -90,7 +95,7 @@ unrelated routes do not authorize execution.
 
 ```task
 id: NK-WP-0033-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "f0f6d6c3-9c45-56b7-9fd6-52fb0ea9054a"
 ```
@@ -106,6 +111,12 @@ identity-provisioner restart, privacyIDEA resolver `lldap-coulomb`, the
 Authelia client hash, and the privacyIDEA JWT expiry disposition. Static or
 dry-run tests must prove replacements do not enter argv or stdout.
 
+The source-of-truth reconciliation is now in progress: Authelia 4.38 OIDC
+client entries cannot consume `*_FILE` environment overrides because clients
+are a list. NetKingdom is switching the verifier to Authelia's supported
+template filter over the Secret-mounted file before this revision is applied
+again.
+
 Do not use `sso-mfa/bootstrap/creds-rotate.sh` through an agent as currently
 written: it prints generated replacement values and its signing-key path
 causes immediate invalidation. Do not use a helper that reads the live Secret
@@ -116,7 +127,7 @@ reviewed for this incident.
 
 ```task
 id: NK-WP-0033-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "751cca48-2bc9-5d44-80a0-60478717e99e"
 ```
@@ -125,13 +136,18 @@ Under the separately approved authority/window, replace the signing material,
 LLDAP bind credential, Authelia client credential, and privacyIDEA admin token;
 roll or reload every affected provider/consumer; preserve or explicitly end
 JWT continuity according to T02; and abort on partial-bundle or stale-source
-evidence. This task is not authorized until T02 and T03 are done.
+evidence. The task was gated on the owner-controlled T02 contract and is now
+complete.
+
+Completed by the KeyCape owner-controlled recovery path on 2026-08-23. The
+owner reported all four affected deployments Ready and positive/negative
+checks passing. NetKingdom made no live mutation.
 
 ## T05 — Prove replacement, predecessor rejection, and cleanup
 
 ```task
 id: NK-WP-0033-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "41e55d5c-ae28-5ee2-be25-b9a3758428f7"
 ```