From f96898d4c5b4ded3237d1df70baed188501c7cbf Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Thu, 15 Oct 2026 15:20:15 -0700
Subject: [PATCH] =?UTF-8?q?docs(authentik):=20pk=2022-23=20provisioned=20?=
 =?UTF-8?q?=E2=80=94=20mitch=20+=20eric=20in=20the=20human-user=20template?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../Infrastructure/Authentik.md                  |  3 ++-
 serverAppConfigs-docs/log.md                     | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/serverAppConfigs-docs/Infrastructure/Authentik.md b/serverAppConfigs-docs/Infrastructure/Authentik.md
index 851a407..3a44b60 100644
--- a/serverAppConfigs-docs/Infrastructure/Authentik.md
+++ b/serverAppConfigs-docs/Infrastructure/Authentik.md
@@ -452,7 +452,8 @@ access is decided entirely by GROUP MEMBERSHIP consumed downstream —
 - `Non-Admin Users` = the plain-user marker group (precedents: qa-e2e, and
   every human account).
 - **The human-user template** (ridley, kassie, alex, artem, kirby, ry, nic,
-  debo, freya — kirby/ry/nic/debo/freya (pk 17–21) created 2026-10-09, kassie
+  debo, freya, mitch, eric — mitch (pk 22) and eric (pk 23) created
+  2026-10-15, kirby/ry/nic/debo/freya (pk 17–21) created 2026-10-09, kassie
   and alex created 2026-10-08, artem (pk 16) created 2026-10-07): `username` +
   `<user>@franksdank.cloud` + display name +
   `is_active=True` + the password set via `set_password`, membership in
diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md
index 24cba7f..4ae3865 100644
--- a/serverAppConfigs-docs/log.md
+++ b/serverAppConfigs-docs/log.md
@@ -1783,3 +1783,19 @@ every restart since the cutover.
   Gate rerunning against the repaired fleet; frank-archon's own health gate
   passed every deploy. Open: decode/prefill ladders vs the w4dn8 record,
   probe leg D — scheduled probe window.
+
+## 2026-10-15 — authentik: two more human accounts (Dankclaw)
+- **Live — mitch (pk 22) and eric (pk 23) provisioned via `ak shell` ORM, no
+  repo objects.** Each `<user>@franksdank.cloud` in the human-user template
+  shape (`is_active=True`, display name, password via `set_password` on stdin
+  only — never argv, so nothing lands in `ps`), groups `Non-Admin Users` +
+  `jellyfin_users` + `openwebui_users`; no admin group granted. Verified
+  through the exact PasswordStage code path (`authenticate()` accepted each
+  password and rejected a wrong one), `app_entitlements(open-webui)` →
+  `Open WebUI Users` for both (identical to the ridley precedent), and
+  `is_superuser=False` / `path=users`. Zero `proxysession` rows for either —
+  groups were set before any login, so no claim purge was due. Downstream:
+  Jellyfin visibility rides the LDAP outpost cache (expect lag); OpenWebUI
+  mints their accounts as role `pending` on first login.
+- `/serverAppConfigs-docs/Infrastructure/Authentik.md` — human-user template
+  census extended with pk 22–23.