diff --git a/.custodian-brief.md b/.custodian-brief.md index c4ec082..679d1c5 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — key-cape **Domain:** infotech -**Last synced:** 2026-10-14 22:10 UTC +**Last synced:** 2026-10-14 22:34 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -30,12 +30,6 @@ Progress: 2/4 done | workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9` - ! T02 — Register the client and hand over its secret `40ddaa29` *(wait: Claims are verified against the registered client.)* -### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02) -Progress: 1/2 done | workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b` - -**Open tasks:** -- ► Deploy the image and record its digest `bd5db26c` - ## Inbox Hygiene **Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index d775a2c..d86b29b 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -50,8 +50,8 @@ | workplan | KEY-WP-0037 | finished | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | | workplan | KEY-WP-0038 | active | — | workplans/KEY-WP-0038-forgejo-oidc-client.md | | workplan | KEY-WP-0039 | active | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md | -| workplan | KEY-WP-0040 | active | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md | -| workplan | KEY-WP-0041 | active | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md | +| workplan | KEY-WP-0040 | finished | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md | +| workplan | KEY-WP-0041 | finished | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md | | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md | | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md | | task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md | @@ -217,8 +217,8 @@ | task | KEY-WP-0039-T01 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md | | task | KEY-WP-0039-T02 | wait | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md | | task | KEY-WP-0039-T03 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md | -| task | KEY-WP-0040-T01 | progress | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md | -| task | KEY-WP-0040-T02 | progress | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md | +| task | KEY-WP-0040-T01 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md | +| task | KEY-WP-0040-T02 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md | | task | KEY-WP-0041-T01 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md | -| task | KEY-WP-0041-T02 | todo | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md | +| task | KEY-WP-0041-T02 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md | | intake | KEY-IN-0001 | closed | — | intakes/intakes.md | diff --git a/workplans/KEY-WP-0040-mfa-attended-run-findings.md b/workplans/KEY-WP-0040-mfa-attended-run-findings.md index df7f210..58a0b99 100644 --- a/workplans/KEY-WP-0040-mfa-attended-run-findings.md +++ b/workplans/KEY-WP-0040-mfa-attended-run-findings.md @@ -4,11 +4,11 @@ type: workplan title: "Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)" domain: infotech repo: key-cape -status: active +status: finished owner: claude-code topic_slug: netkingdom created: "2026-10-11" -updated: "2026-10-16" +updated: "2026-10-17" flavor: implementation depends_on: [] state_hub_workstream_id: "a67f9d60-9b8f-5111-9fe5-9f64e631b1c3" @@ -21,7 +21,7 @@ U05–U07 passed. U08 is blocked by T01. ```task id: KEY-WP-0040-T01 -status: progress +status: done priority: high state_hub_task_id: "b385602d-714a-5fdb-b40b-bd870420f28e" ``` @@ -60,7 +60,7 @@ the deployed authenticated preview succeeds and user-engine can rerun U08. ```task id: KEY-WP-0040-T02 -status: progress +status: done priority: medium state_hub_task_id: "3ad155dd-15ef-5522-bdf9-c78832728553" ``` @@ -132,3 +132,30 @@ OTP-page observation. Both remain progress. Resume the existing owner procedure No authenticated preview, real-factor mutation or attended page observation was performed during this source reconciliation. No passwords, codes, token values, provider keys or production Secret objects were requested or read. + +## T02 attended acceptance — 2026-10-17 + +The founder reported in session that the real user-engine-portal OTP challenge +shows **Code rejected or lost your authenticator?**, that it leads to +`https://users.coulomb.social/security`, and that the lost-device guidance is +reachable there ("T02 is fine"). This is the founder's own observation, on the +deployed image `cdec9dd7` from source `8c6c071`. No exact time or client was +recorded, and no challenge URL, request state, cookie or OTP value was preserved. +T02 is done. T01 still waits for the authenticated preview (step 2 above). + +## T01 attended preview acceptance — 2026-10-17 + +The founder, signed in as platform-root with its own fresh OTP (AAL2), opened +`/platform/factor-recovery` and previewed login `tegwick` with the existing +reference `U08-2026-10-11`. The founder reported that the preview listed +tegwick's TOTP. The `invalid_request` failure from October 11 (F6) did not recur. +No confirm or disable action was taken, and no factor was changed. The serial +suffix and exact time were not reported, so this record does not claim that the +listed factor is still …E1D. The U08 operator must reconcile the current factor +metadata in the preview before any disable. + +All Done-when conditions hold: the DN-shaped actor defect was fixed with regression +tests (2026-10-12), the sidecar logs only closed field names and error codes, and +the deployed preview succeeds. T01 and the workplan are done. U08 itself, meaning +the attended disable, re-enrolment and fresh login, belongs to user-engine +(USER-WP-0028-T03) and is handed back to it. This workplan does not close U08.