- recipe_meta: DEPS=[keycloak] enabled (base proven cold-green). - setup_custom_tests.sh: wire OIDC env (explicit keycloak realm endpoints) + insert oidc_rpcs secret at bumped version + clear FranceConnect eidas1 acr + in-place redeploy (adapted from the proven lasuite-docs hook). - functional/test_oidc_with_keycloak.py: SSO discovery + password grant + JWT claims vs dep keycloak realm 'lasuite-drive' (@requires_deps; F2-11 fails run on skip). - functional/test_minio_storage.py: §4.3 specific — drive-media-storage bucket present + real upload->list->download round-trip via mc inside the minio container. - PARITY.md: OIDC + MinIO rows landed; backup data-integrity (ci_marker) already real. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- harness: services_converged treats replicas:0 one-shot (minio-createbuckets) as converged (cur==want); removes the want==0 rejection that hung deploys. DECISIONS.md. - recipe_meta.EXTRA_ENV flattens MINIO_DOMAIN/COLLABORA_DOMAIN to single-label wildcard siblings (the *.ci.commoninternet.net cert covers one label only). DECISIONS.md. - lifecycle overlays (install/upgrade/backup/restore) + ops.py postgres ci_marker data-integrity (db user/name=drive). Parity health_check functional test. PARITY.md. - DEPS=[keycloak] + OIDC/WOPI/upload functional tests deferred to the SSO iteration (probe-before-assert: prove the ~10-service base deploy converges first). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>