- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.
NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.
Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf
