{
  "schema": "netkingdom.reset-transition-validation.v1",
  "status": "tested_proposal_not_granted",
  "unit_checks": 25,
  "native_controller_checks": 4,
  "failures": 0,
  "errors": 0,
  "skipped": 0,
  "junit_sha256": "26911e26b410c242f3dafb1915301875a4bfd3f5d88770be3b7bec5ce4c5c3d5",
  "ruff": "passed",
  "native_findings": [
    "grant and rollback preserve all other user IDs and group memberships",
    "real process death after removal or addition recovers read-only without replaying grant",
    "membership rollback leaves prior HTTP token rights active; freshly issued token loses those rights"
  ],
  "authelia_findings": "same running process refuses reset before grant, allows after grant, refuses after rollback; three fresh consumed challenges, old/new password checks; all confined containers removed",
  "runtime_observation": {
    "schema": "netkingdom.reset-runtime.v1",
    "kube-system_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
    "sso_uid": "a4a148d8-92ab-41e6-b975-4e67b73edfc0",
    "authelia": {
      "uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
      "images": [
        "docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54"
      ],
      "ready": true
    },
    "lldap": {
      "uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
      "images": [
        "docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d"
      ],
      "ready": true
    },
    "authelia_configuration": {
      "uid": "7af1fa0d-1bd4-47e1-8873-0f620788ef3f",
      "sha256": "0a8bca50641a4c6f27830f476c2c9f413fc3795711becccb8344ee4d6c376e80",
      "bind_is_svc_authelia": true
    }
  },
  "production_membership_changed": false,
  "grant_approved": false,
  "productive_acceptance": false,
  "sources": [
    {
      "path": "sso-mfa/k8s/lldap/reset-role-transition.py",
      "sha256": "cc405861bb5cc0adf419a1cf98a90872d8395eecbfc7d4d38947cb4008bee217"
    },
    {
      "path": "sso-mfa/k8s/lldap/reset-role-plan.json",
      "sha256": "703e281ee6a17e1ef0a1dffbad35b8025ab3480d51d3fc2c36323f2bc6227106"
    },
    {
      "path": "tests/test_reset_role_transition.py",
      "sha256": "1437761ac60a7aeba16db70ccf07d48a9f5332617a00e7a325e678951985a08e"
    },
    {
      "path": "sso-mfa/k8s/lldap/test_reset_role_transition_native.py",
      "sha256": "13c53e8a757ed0e954ffd28df14283d51dd9d7d3278c1d7d7d5759b419a2a89a"
    },
    {
      "path": "sso-mfa/k8s/lldap/test_bind_split.py",
      "sha256": "ae69051a3df4596fe220306d88a28b2c12e42fbfe3587e02135e3684eb5f354a"
    },
    {
      "path": "sso-mfa/k8s/lldap/bind-split-rehearsal.py",
      "sha256": "9ab873d1e941807fb19a48fb18c3af246a98bf0788660d8d79a14fb0c0e0a067"
    },
    {
      "path": "docs/evidence/2026-10-31-reset-authority/role-refresh.json",
      "sha256": "325f446960134e9510591a2a27f5833bc80fa858d77e6a88082af41307993b65"
    }
  ]
}