Reconciliation Audit

BPP-001 W5b — admin-triggered L3 audit lottery.

require_admin is a parameter dependency, so it resolves BEFORE this body ever runs: a non-admin caller gets 403 regardless of the reconciliation flag's state. The flag check (require_bpp_reconciliation_enabled — 404 unless BOTH BPP_ENABLED and BPP_RECONCILIATION_ENABLED are true) is the first line of the body, so an authenticated admin with the flag off gets 404. This exact ordering mirrors the /tasks/secret-suites/* precedent (app/routers/tasks.py): 403 (non-admin) takes priority over 404 (flag-off) because the admin dependency always resolves first.

Selects up to k certifications via the deterministic seeded audit lottery (select_audit_candidates — Townsend costly-state- verification, see its docstring) and reconciles each one in turn against its owner-granted provider usage scope. Certifications with no grant on file are never selected in the first place. Returns provider/verdict/delta_pct/cost_scope only — never any key material.