reconcile-lldap-resolver-live.sh had never completed a run. Four defects,
found by running it on 2026-08-27:
1. request() set Content-Type: application/json on every call, including
bodyless GETs. Werkzeug 3.x rejects those in front of privacyIDEA, so
every GET returned an HTML 400 while POSTs succeeded — the resolver
write landed and the lookup immediately after it did not.
bootstrap-realm.sh already fixed this in pi_api and said why; this
script was written later and did not inherit it.
2. GET /user/ returns result.value as a list of user objects, not a dict
carrying "users". With the 400 fixed, the lookup finally reached the
parse and raised AttributeError past the except clause, so the run
died as a traceback instead of a receipt. Both shapes now accepted,
and the except clause catches parse errors so a failed run still
names the phase it died in.
3. A resolver write replaces the whole object, so TIMEOUT,
CACHE_TIMEOUT and SIZELIMIT were dropped by every --apply. A resolver
with them unset still resolves users, but the WebUI refuses to save
or test it — so the script silently un-repaired a resolver an
operator had fixed by hand. Now sent, defaulting to the verified
5/120/500 and overridable per run. Same omission fixed in
bootstrap-realm.sh, which created the resolver that way originally.
4. The predecessor prompt could not be left empty, so an operator who
had lost the exposed credential had to type a placeholder — which
also fails the bind and was recorded as a PASSING denial proof.
--predecessor-unavailable skips the bind and records NOT-PROVEN.
--note carries operator context into the receipt line itself, so the
claim and its caveat travel together.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth
token per decision (verified in the running container); flex-auth-user-engine
138aa347 serves with caller-auth enforce. Probes: valid 200
decision:d9aef25f08e17b84, missing token 401, wrong-system 403.
Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned
against, while the cluster ran c501aeb2. Re-applying it would have rolled the
portal back to an image that cannot authenticate to a PDP now in enforce.
kubectl diff is now empty.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Register coulomb-social with mfaRequired: false, roll key-cape image that
honors client policy, and track NK-WP-0025 public registration orchestration.
Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.
T2: greenfield live proof against a fresh uninitialized OpenBao 2.5.5 —
caught and fixed 'bao operator unseal -' not reading stdin (now
'bao write sys/unseal key=-'); init and reseal-replay paths proven.
T3: attended-ceremony selectable — runbook, non-secret ceremony-record
template + validator, and a lab/production deployment profile that blocks
sops-held-automation in console selection, gates, and the init script.
T4: console gate + evidence flags for auto-unseal-transit (Helm seal stanza
prepared in railiance-platform).
Also: SCOPE.md refreshed to current repo state; adhoc fix for the broken
check-secrets Make target (unescaped $).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
