{
  "date": "2026-10-12",
  "gap_refs": [
    "G08",
    "G09",
    "G04",
    "G12"
  ],
  "owner_task": "NK-WP-0049-T02",
  "manifest": {
    "repo": "net-kingdom",
    "base_head": "6ae4708ea061048f84fe59dcee3f482c69e291f9",
    "files": [
      {
        "path": "sso-mfa/k8s/privacyidea/bootstrap-admin.sh",
        "before": "b7769727e2f199ba8d8455bdeef3de4df954f01d33d46b5ebbd7af6fc015de63",
        "after": "1a11738c1790cc6b5f23ed40f02971591eb76afa486be89d5535b0027aca6989"
      },
      {
        "path": "sso-mfa/k8s/privacyidea/bootstrap-admin.py",
        "before": null,
        "after": "b81b5c3806dbdf03ea7cac37884cc368de0f0ef7880ac326b67af3a291c35890"
      },
      {
        "path": "sso-mfa/k8s/privacyidea/bootstrap-admin-remote.py",
        "before": null,
        "after": "c83c3a5c9a753a8afec90c35ce5ddbfc15f7b8aff437065f428109d9c5774b89"
      },
      {
        "path": "tests/test_admin_bootstrap.py",
        "before": null,
        "after": "505925378e4d662b3c2077c7f22a748159abb11eb48e432f301187745b6fb0fd"
      },
      {
        "path": "tests/test_admin_bootstrap_privacyidea.py",
        "before": null,
        "after": "1652a31b52e7ca6af1442ebf2191731cb501de0837ffef945bbc7d1a6b8e6d3e"
      },
      {
        "path": "sso-mfa/k8s/privacyidea/README.md",
        "before": "2b4b99a9d0b2d6cb9c129125b3ff003dbd925d89ae7ee770ff187718796d9551",
        "after": "aeaed29e3d8a6f914e6758a1788c312760503b72473701685012366177069c09"
      },
      {
        "path": "sso-mfa/k8s/privacyidea/deployment.yaml",
        "before": "79f0bf9eaab5482509cd9d18bb0fa42b9f1a9cab33e7c1e504486b2d1e24e409",
        "after": "c6da8950b5daf61ba7b3238f7a6d3d3a05eabb835369b1c4e397cce1f5eab5e6"
      },
      {
        "path": "sso-mfa/k8s/verify-t04.sh",
        "before": "6911d45e8dd76aea3663d02393c98d30d5d3f8168c2a33326eedcff1a4a9d9b4",
        "after": "b34c6b43bf1e1a2274df3014436e9c9993a1c17bc6d81d482a80f4fd56365ce6"
      },
      {
        "path": "sso-mfa/WORKPLAN.md",
        "before": "611390e9bfad1b53fa471bf0e2a3b0b8ea8094c99cbffd69e17a785b6b819e85",
        "after": "5b76896a6c322810dc99c4539046ff40f53498bac4a9b28ab06f23bb635cfdf3"
      },
      {
        "path": "docs/security-bootstrap-age-custody.md",
        "before": "0110b1e2f184e0ae700e7278b6f1d9b9136cb07872ec72f74c3c580131f5a1ec",
        "after": "8c6d0834e69b0fa071eea38829043b89d0e1ab0f8196bbb758117db49a6fb408"
      },
      {
        "path": "workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md",
        "before": "d2f56748a25111a096cefab330d5aa51a248e0864c3f91d35c1ebc7ab34d7c64",
        "after": "fb5a977cc7d90c0e911b0671af15b315bef5cfd637441db75aad7b2659468f5a"
      }
    ]
  },
  "source_commit": "19a1c75d309991de8654c4b7a9eeffea8fb90b18",
  "source_pushed": true,
  "architecture_basis": {
    "scope": "NetKingdom current profile; source inspection, not live consumer inventory",
    "observations": [
      "NetKingdom SCOPE.md declares Keycloak enterprise federation backlog",
      "Current KeyCape source provisions a pi-admin token through keycape/create-pi-token.sh and references it in keycape/create-secrets.sh",
      "No trigger-admin consumer reference found in reviewed KeyCape or Platform source; NetKingdom references are legacy bootstrap/docs/readiness expectations",
      "NetKingdom runtime package ownership is external under ADR-0015; this repair does not authorize managed deployment"
    ]
  },
  "verification": {
    "original_entrypoint_regressions": {
      "failed": 14,
      "passed": 2
    },
    "final_focused": {
      "passed": 36,
      "failed": 0,
      "warnings": 4,
      "seconds": 13.32,
      "scope": "29 entry-point/controller tests and seven actual privacyIDEA 3.12.2 model tests using disposable SQLite"
    },
    "initial_full_suite_attempt": {
      "collection_errors": 4,
      "cause": "Disposable test environment lacked existing repository jsonschema dependency; installed it and reran full suite"
    },
    "actual_checkout_full_suite": {
      "passed": 288,
      "subtests_passed": 29,
      "failed": 0,
      "skipped": 0,
      "warnings": 4,
      "seconds": 44.81,
      "command": "PATH=/tmp/netkingdom-sops-tools:$PATH PYTHONDONTWRITEBYTECODE=1 /tmp/netkingdom-admin-output-fix/venv/bin/python -m pytest -p no:cacheprovider tests tools -q --tb=short --disable-warnings",
      "warning_scope": "Four upstream dependency deprecation warnings"
    },
    "test_dependencies": "admin-bootstrap-test-requirements.txt"
  },
  "controls": [
    "No automatic legacy trigger-admin account/policy/Secret creation or misleading current readiness requirement",
    "Private owned regular single-link service input; no shell evaluation, no credential argv or environment assignment",
    "One pod, credential on kubectl stdin, sanitized diagnostics and exact value-free receipt",
    "Version-scoped 3.12.2 adapter verifies existing password without updates",
    "New account/policy insert-only writes share transaction; uniqueness conflicts roll back instead of overwriting",
    "Scoped pi-admin policy; broad legacy policies, multi-admin migration and external administrative realms refused",
    "MFA/effective-policy acceptance explicitly separated from bootstrap success"
  ],
  "proof_limits": [
    "No live account, policy, Secret or credential was accessed, changed or revoked",
    "Disposable SQLite exercises actual privacyIDEA models; deployed image/PostgreSQL/native permissions and MFA remain unverified",
    "Policy controller/transport tests use synthetic data and fake kubectl",
    "Existing trigger credentials/Secrets are not removed; inventory and authorized revocation remain required",
    "KeyCape full-admin token issue/delivery/least-privilege/refresh and other delegated callers remain open",
    "Existing custom policies or SUPERUSER_REALM configuration require owner-reviewed profile migration",
    "An error after DB commit can leave created state; rerun verification uses the same credential, never resets it",
    "No runtime agent isolation or hostile same-UID guarantee"
  ],
  "source_basis": [
    {
      "url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/cli/pimanage/admin.py",
      "sha256": "5d4a4c89058f2aa6f0307bab06b684f190084e9a198d36243d3306c4d546fa6f"
    },
    {
      "url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/lib/auth.py",
      "sha256": "bd1b14c4dd6e906570e6a89e9bb444e82e4e5fca06f7411a7406a16cae7019e9"
    },
    {
      "url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/models/config.py",
      "sha256": "b0727db3643613b76f5c8b31256945a1259d26ef2b1878525ecb20dde4cb05ea"
    },
    {
      "url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/models/policy.py",
      "sha256": "4a5bb2f8fb8f89f9ab93f9dde588c440d08a5358161ed4faeff95d8b1368c02c"
    },
    {
      "url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/lib/policy.py",
      "sha256": "903284a68602c0e7cbe20c40348b6394ba491a6a0beac251553e00332ea3dcb6"
    },
    {
      "url": "https://github.com/privacyidea/privacyidea/blob/v3.12.2/privacyidea/cli/__init__.py",
      "sha256": "a89d3ccd773d5275fbe06ca86871af15ed61e7c822287c964b32d7e25e311244"
    }
  ],
  "statehub_sync": {
    "owner": {
      "fail": 0,
      "automation_error": 0,
      "warn": 32,
      "info": 5
    },
    "custodian": {
      "fail": 0,
      "automation_error": 0,
      "warn": 7,
      "info": 4
    },
    "custodian_note": "DB reconciliation succeeded; sandbox prevented automatic working-memory Git commit. Scoped assessment and evidence committed separately."
  },
  "source_implementation_decision_id": "765c47a9-6f4f-488f-ac13-27073a10289f",
  "progress_id": "87746c12-8197-46b8-95a4-4f6742ec2643"
}