Todos

• pretix shell_scoped reads stdin through IPython: it drops a compound statement that ends the input (measured: a trailing for block printed nothing), echoes a module docstring as Out[N], and ends stdout with its exit prompt. files/python/provision_mcp_identity.py ends in an if/else and tasks/utils/mcp.yml compares stdout_lines[-1] with CHANGED, so the token step may never run and never reports a change. Options: end the script with a plain print(...) of a marker and match it with search('(?m)...$'), as files/python/admin_account.py and tasks/utils/administrator.yml do.

• templates/playwright.env.j2 still blocks the administrator and biber persona flows with the rationale that the role provisions no Pretix account; tasks/utils/administrator.yml now converges a native administrator with the users e-mail while sso is off, and pretix-oidc grants staff from the RBAC administrator group while it is on, so the administrator flow could be enabled.

• An install that switches sso from off to on keeps the native administrator under the Keycloak e-mail, and pretix-oidc then refuses the Keycloak sign-in with EmailAddressTakenError (pretix_oidc/views.py). Options: move that account to the pretix_oidc backend with the Keycloak username as auth_backend_identifier in files/python/admin_account.py when sso turns on.