coulomb-social/docs/security-close-down-checklist.md

# Coulomb sign-in close-down record

2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication)
and coulomb-social (product assurance). Founder-approved repair activated on 2026-10-06.

The historical public authorization-code/PKCE client descriptor has
`mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported.
Restoration retained that historical policy, with no changes to other clients.
Before production approval, the owners must decide and verify whether ordinary
personal sessions may remain AAL1, which actions require step-up, and that PKCE,
exact callbacks and tenant checks are enforced by the running issuer/application.
Do not treat successful discovery, synthetic tests or a registered Member as
proof of interactive authentication. The founder explicitly approved the live restoration; user sign-in is pending.

Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence;
CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by
preparing this descriptor. The restored descriptor preserves the historical AAL1 policy; other clients are unchanged.