net-kingdom/docs/attended-procedure-inventory.md

Attended procedure inventory — 2026-09-05 baseline, reviewed 2026-10-15

Reviewed all 32 shell scripts under sso-mfa/k8s/ for NK-WP-0034-T03. Exercise status: unknown unless the row states otherwise. Existing deployment or task completion is not treated as proof that a particular script revision completed successfully with an identified operator. Unknown does not mean never run.

Runbook matching below requires an explicit script reference in the component runbook or a dedicated procedure. Missing runbooks are listed separately.

Script (under sso-mfa/k8s/)	Runbook	Exercise status
authelia/create-secrets.sh	README.md, smooth-bootstrap-guide.md	unknown
keycape/configure-openbao-oidc.sh	README.md	retired 2026-10-15 before token/cluster access; Platform governed owner operation replaces the root-token pod prompt
keycape/create-pi-token.sh	README.md	retired; current factor reader is Platform-owned RPF-WP-0040; historical Secret/provider revocation remains open
keycape/create-secrets.sh	README.md, smooth-bootstrap-guide.md	unknown
keycape/patch-openbao-client.sh	README.md	retired 2026-10-15; use reviewed guarded registration/rollout adapters
keycape/refresh-pi-token-live.sh	README.md	retired; no personal-admin token refresh or live acceptance claimed
keycape/register-coulomb-social.sh	None found	retired 2026-10-15; raw registry replacement/output removed
keycape/verify-openbao-client.sh	README.md, smooth-bootstrap-guide.md	unknown
lldap/bootstrap-users.sh	README.md, OPERATOR-GROUPS.md	source + isolated native fixture verified 2026-10-14; estate exercise still unknown; procedure
lldap/break-glass.sh	platform-root-custody.md	retired 2026-10-14; owner routes
lldap/create-secrets.sh	README.md, smooth-bootstrap-guide.md	unknown
lldap/create-user.sh	OPERATOR-GROUPS.md, smooth-bootstrap-guide.md	retired 2026-10-14; owner routes
lldap/dry-run-nonroot-user.sh	smooth-bootstrap-guide.md	retired 2026-10-14; owner routes
lldap/manage-group-members.sh	OPERATOR-GROUPS.md	source + isolated native fixture verified 2026-10-14; estate exercise still unknown; procedure
postgresql/create-secrets.sh	README.md, smooth-bootstrap-guide.md	unknown
privacyidea/bootstrap-admin.sh	README.md	unknown
privacyidea/bootstrap-realm.sh	privacyIDEA repair contract	source repaired: literal private files, preview/explicit apply, configuration preservation; live acceptance pending
privacyidea/check-user-mfa-state.sh	smooth-bootstrap-guide.md	source repaired: explicit admitted private JWT, scoped read-only counts; live diagnostic delivery not admitted by this repair
privacyidea/create-secrets.sh	README.md, smooth-bootstrap-guide.md	unknown
privacyidea/enckey-bootstrap.sh	README.md	source/isolated native recovery adapter verified 2026-10-13; current estate recovery remains NK-WP-0049-T03
privacyidea/reconcile-lldap-resolver-live.sh	keycape-exposure-resolver-reconciliation.md	historical check 2026-09-23 with predecessor unproven; current core exercised 2026-10-14 on disposable PI/LLDAP, full production procedure unexercised
privacyidea/repair-realm-live.sh	privacyIDEA repair contract, verify-t06.md	source repaired: attended in-memory input and propagated functional proof; live acceptance pending
privacyidea/update-lldap-resolver-live.sh	keycape-exposure-resolver-reconciliation.md	core exercised 2026-10-14 on disposable PI/LLDAP; production unexercised
user-engine/verify-operability.sh	None found	retired 2026-10-15; use rapp-user-engine verification; no stale manifest rollback
verify-identity-cutover-dependencies.sh	None found	read-only source review; tracing disabled and private staging 2026-10-15; no new native exercise claim
verify-t02.sh	README.md	unknown
verify-t03.sh	DR-RUNBOOK.md	unknown
verify-t04.sh	DR-RUNBOOK.md	unknown
verify-t05.sh	DR-RUNBOOK.md	unknown
verify-t06.sh	verify-t06.md	unexercised on provider; HTTP simulation passed
verify-t07.sh	DR-RUNBOOK.md	source + isolated native fixture verified 2026-10-14; estate exercise still unknown; procedure
verify-t08.sh	DR-RUNBOOK.md	unknown

Scripts without a matching runbook

• sso-mfa/k8s/keycape/register-coulomb-social.sh — header usage is available, but a runbook with prerequisites, verification and exercise history was not found in the reviewed runbook set.
• sso-mfa/k8s/user-engine/verify-operability.sh — header usage is available, but a runbook with prerequisites, verification and exercise history was not found in the reviewed runbook set.
• sso-mfa/k8s/verify-identity-cutover-dependencies.sh — header usage is available, but a runbook with prerequisites, verification and exercise history was not found in the reviewed runbook set.

Exercise evidence correction

The resolver reconciliation runbook previously called an attempted run “exercised” despite the incident explicitly recording no green receipt. Its header now says unexercised to successful completion. Existing incident authority/window requirements still apply; this documentation review does not authorize that attended cutover. The changed helper must be included in the revision recorded by the operator.

Bootstrap/root-output caller review — 2026-10-15

The original 32-shell-script snapshot above is historical and does not cover the subsequently added Python adapters or bootstrap/Make callers. The current exact scope, source digests and per-entrypoint dispositions are recorded in the caller source inventory. It enumerates all current non-test shell/Python files under bootstrap and k8s, plus Make, the console, legacy delivery copier and isolated transport checker. Enumeration is complete for that declared scope; it is not a claim that every helper has current production acceptance or that no future defect can exist.

Caller group	Current source boundary	Native acceptance
Generate/encrypt/decrypt/bundle	Public recipient for encryption; explicit private temporary key for decryption; private files; fresh no-overwrite bundle output; no age private key in bundle; no plaintext tar intermediate	Disposable actual age checks; exact off-host artifact/current coverage pending
SOPS setup/read/edit/encrypt/rotate/unlock	Existing private-input and recipient checks; no automatic permanent HOME key installation	Existing source/disposable receipts; independent recovery pending
Component create/apply/rotation	Literal private input, create-or-match or explicit named field update; no credential argv; contained errors; unknown writes require reconciliation	Current multi-consumer recovery/revocation remains owner work
Bootstrap orchestration	Attended entry; no automatic erase/regeneration of retained service custody; failed OpenBao verification stops before final cleanup; encrypted handoff is not proof of recovery	No production bootstrap executed in this review
Lab OpenBao init/unseal	Explicit lab model, admitted kubeconfig and exact cluster UID; private no-overwrite init receipt; shares stdin only; no automatic post-init root configuration	Captured fake-cluster transport tests only; historical lab receipt does not cover new revision
Legacy User Engine delivery copier	Retired; scoped email ESO delivery remains authoritative; audit delivery replacement needs owner custody path; existing Secrets untouched	No provider token copied, rotated or revoked
Legacy registry patchers/root prompt	Retired; raw Python registry patch output disabled; guarded owner adapters remain available	Existing registry/clients unchanged
Secret presence diagnostic	Current scoped factor Secret replaces old personal-token expectation; historical applied/native state never rewritten from presence	Presence only
Dependency/client verification	No tracing of decoded config; private staging; suppressed provider response/port-forward diagnostics	No new native acceptance claimed
Legacy managed workload rollback	Retired; current rapp-user-engine release/verification contract is authoritative	No workload rollback or reapply performed

The recovery ceremony records exact outstanding owner evidence. Retired callers are not evidence of provider revocation. A successful local backup job is not evidence of an off-host matching key/data set.