coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require confirmed enrollment and genuine OTP evidence for MFA
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m10s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 16:37:08 +02:00
parent 3a36f1a507
commit 122a0d1369
7 changed files with 165 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/KEY-WP-0035-optional-mfa.md
View file

@ -76,3 +76,19 @@ All Go regression/conformance suites pass, including five new renewal/validation
Consumer source 632b1f1 deployed and Ready 1/1; CI, four provider HTTP checks and twelve live browser checks passed. See docs/credential-renewal-release-2026-09-13.md. T02/T03 retain actual credential delivery and live recovery/policy acceptance.
2026-09-13 custody activation supersedes the earlier owner-handoff gate: the new factor service is live and renewable. T02/T03 now track effective policy/onboarding acceptance, not missing credential ownership.
## Require confirmed enrollment and actual OTP evidence
```task
id: KEY-WP-0035-T05
status: progress
priority: high
```
Live provider source inspection found active tokens can remain in verification
state; live policy inspection found password passthrough enabled for users without
factors. Distinguish pending enrollment from completed enrollment and require
TOTP/HOTP serial/type evidence before AAL2. Cover pending/confirmed/cancelled,
existing-factor plus pending enrollment, missing/unknown state, incomplete pages,
password passthrough and static-password token rejection. All Go suites pass
locally; publish and verify the guarded issuer replacement before completion.