From e536ce8133a01c9367e9bb33e196f08b7df11b49 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 6 Nov 2026 11:13:23 +0100
Subject: [PATCH] ADHOC-2026-11-06-T02: make keycape-tool-test (warden on
 PYTHONPATH); 6 NK-WP-0048 digest drifts documented

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
---
 Makefile                      |  3 +++
 WORK-RECORDS.md               |  1 +
 workplans/ADHOC-2026-11-06.md | 30 ++++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/Makefile b/Makefile
index baf6333..a0e8401 100644
--- a/Makefile
+++ b/Makefile
@@ -217,6 +217,9 @@ agent-status-token: ## Founder, once per working day: a 12 h read-only token for
 	  --duration=12h > $(HOME)/.kube/nk-agent-status.token && \
 	  python3 tools/agent-status/token_expiry.py $(HOME)/.kube/nk-agent-status.token
 
+keycape-tool-test: ## KeyCape and LLDAP tool tests; they import ops-warden's warden package (OPS_WARDEN_SRC, default ../ops-warden/src)
+	PYTHONPATH=$${OPS_WARDEN_SRC:-../ops-warden/src} python3 -m pytest -q sso-mfa/k8s/keycape sso-mfa/k8s/lldap
+
 conventions-lint: ## Runbook and tooling conventions from the 2026-11-04/05 pilot (NK-WP-0058-T07), read-only
 	python3 tools/conventions/lint.py
 
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 094eecc..b1b9509 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -74,6 +74,7 @@
 | task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
 | task | NK-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
 | task | NK-WP-ADHOC-2026-11-06-T01 | done | — | workplans/ADHOC-2026-11-06.md |
+| task | NK-WP-ADHOC-2026-11-06-T02 | done | — | workplans/ADHOC-2026-11-06.md |
 | task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
 | task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
 | task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
diff --git a/workplans/ADHOC-2026-11-06.md b/workplans/ADHOC-2026-11-06.md
index 5c9adee..4d9ee0f 100644
--- a/workplans/ADHOC-2026-11-06.md
+++ b/workplans/ADHOC-2026-11-06.md
@@ -49,3 +49,33 @@ searches used a pattern file.
    and tenant-engine.
 
 Both were sent to the owners as hub messages: user-engine `f441911e`, tenant-engine `700c43f1`.
+
+## KeyCape and LLDAP tool tests: runnable, and the drift they show
+
+```task
+id: NK-WP-ADHOC-2026-11-06-T02
+status: done
+priority: low
+```
+
+`sso-mfa/k8s/keycape` and `sso-mfa/k8s/lldap` showed 7 failing tests and 11 that could not load. No CI runs them.
+
+- **Cause of 18 of them:** the adapter tests import ops-warden's `warden` package. It is installed only as a uv tool
+  with its own Python, so plain `python3` cannot import it.
+- **Fix:** `make keycape-tool-test`, which puts `../ops-warden/src` (or `OPS_WARDEN_SRC`) on `PYTHONPATH`. Result:
+  347 passed, 13 skipped, 6 failed.
+- **The 6 remaining failures are digest drift in NK-WP-0048 artifacts,** for whoever continues NK-WP-0048. Parallel
+  worktrees `nk48-R3F1` and `nk48-R3F2` exist, so nothing was regenerated on `main`.
+  - `test_compose_1_2_descriptors` (2): the committed 1.2 and 1.3 composition artifacts differ from a fresh
+    regeneration.
+  - `test_admit_1_3_type` (4): the committed admission map pins adapter descriptor digests that today's composer
+    computes differently. Refusals now stop at "type has no exact acknowledged machine descriptor; plan only".
+  - **Not caused by ops-warden's last commits:** the same 6 fail against ops-warden `95d31c3` and `12430de`.
+  - **Already failing before 2026-11-05:** they fail at net-kingdom `7f3bd6e` as well.
+  - **NK-WP-0058-T07 (`cd265b8`) adds to it:** it changed `portal-client-rollout.py`, which `bind-env`,
+    `keycape-registration` and `mint-secret` load through `keycape-client.py`. A regeneration must start from
+    today's source.
+
+**Founder note, not a task:** the shell in which `~/net-kingdom` showed the old 1-hour token recipe is not on this
+machine's filesystem: this machine has exactly one `net-kingdom` checkout, `/home/worsch/net-kingdom`. Running
+`echo $HOME; hostname; readlink -f ~/net-kingdom` in that shell shows where the old copy is.