coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record p01 repeated stale MFA refusal and authentication dependency

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
This commit is contained in:
tegwick 2026-10-03 20:30:49 +02:00
parent 15c330ccd0
commit 219d83ad1b
2 changed files with 32 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/evidence/2026-10-03-provisioning-window-review-refusal.json Normal file
View file

@ -0,0 +1,17 @@
{
"memo_id": "infd-20261003-p01",
"observed_at": "2026-10-03T18:27:49.372959+00:00",
"action": "read",
"outcome": "policy_denied",
"policy_version": "v7",
"assurance_at": 1791047288,
"authentication_time_utc": "2026-10-03T17:08:08+00:00",
"mfa_age_at_request_seconds": 4781,
"maximum_mfa_age_seconds": 900,
"identity_and_memo_pins_match": true,
"fresh_password_and_otp_on_latest_attempt": "awaiting operator confirmation",
"dependency": "INFD-IN-0005",
"next_step": "Complete KeyCape /account/logout and upstream browser sign-out, then fresh password/OTP login. If the signed authentication time remains old after real OTP, KeyCape owns the correction and completed-browser proof.",
"policy_relaxed": false,
"agent_performed_human_act": false
}

16
workplans/ADHOC-2026-10-03.md
View file

@ -40,7 +40,7 @@ id: INFD-WP-ADHOC-2026-10-03-T02
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
blocking_reason: "p01 loaded and review service ready; founder must sign in with fresh MFA, review the packet, acknowledge the required highlight and choose accept, return or decline at decisions.coulomb.social."
blocking_reason: "p01 is loaded, but repeated browser read attempts retain KeyCape MFA time 17:08:08 UTC and fail the 900-second policy limit. Obtain genuinely fresh password/OTP authentication; if fresh OTP still emits the old time, KeyCape owns the correction (INFD-IN-0005). Then founder reviews, acknowledges and chooses a disposition."
priority: high
state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
```
@ -113,3 +113,17 @@ Evidence: `docs/evidence/2026-10-03-provisioning-window-p01-load.json`.
Only A6 remains: founder signs in with fresh MFA, reads the full packet,
acknowledges the required highlight, and chooses a disposition. Plan remains
blocked on that human act; hub decision D1 remains unresolved.
A6 refusal diagnosis: read at 18:27:49 UTC still carried exactly the same
KeyCape `assurance.at=1791047288` (17:08:08 UTC), age 4,781 seconds. Exact
identity, group, memo and native approval pins match v7; the 900-second MFA
limit refuses this request. The latest attempt has not supplied fresh evidence;
whether the browser actually performed a fresh OTP is awaiting operator
confirmation. Do not infer a new authentication from a successful redirect.
KeyCape's `/account/logout` confirmation clears its session and routes through
upstream Authelia sign-out; informed-decision sign-out alone is local. Complete
that browser flow, then start a new review login with password and OTP.
If the verified timestamp remains old after that, KeyCape must correct the
authentication-time contract under existing intake `INFD-IN-0005` and prove
it with a completed browser journey. Retain all policy freshness limits.
Evidence: `docs/evidence/2026-10-03-provisioning-window-review-refusal.json`.