tegwick 55fe8303f3 NK-WP-0056-T09: enroll with a privacyIDEA-generated key, write KV last ... Third founder setup run stopped at /token/init. Reproduced on the pinned privacyIDEA 3.12.2: an admin policy with action '*' enables totp_force_server_generate, so a supplied otpkey is silently replaced and verify_enrollment then fails with ERR905. setup now enrolls with genkey=1, takes the seed from the enrollment response (memory only), confirms with a code, and writes PASSWORD and TOTP_SEED to KV (CAS=0) last. Failed receipts kept as evidence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87		2026-10-31 13:23:47 +01:00
..
bootstrap	NK-WP-0056-T04 done: svc-privacyidea written through from OpenBao; all four binds in platform custody	2026-10-31 11:19:21 +01:00
k8s	NK-WP-0056-T09: enroll with a privacyIDEA-generated key, write KV last	2026-10-31 13:23:47 +01:00
WORKPLAN.md	security: repair LDAP group callers and fail incomplete T07 acceptance	2026-10-14 01:17:35 +02:00