coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish KEY-WP-0040: OTP help link and recovery preview accepted live.

Browse source 
Founder-attended 2026-10-17: the OTP challenge shows the lost-authenticator
link (T02), and the platform-root factor-recovery preview of tegwick lists the
TOTP without invalid_request (T01, F6 fixed). No factor was changed. U08 is
handed back to user-engine (USER-WP-0028-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
This commit is contained in:
tegwick 2026-10-17 04:15:22 +02:00
parent 834b0d06a1
commit 258d899a78
3 changed files with 37 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

8
.custodian-brief.md
View file

@ -2,7 +2,7 @@
# Custodian Brief — key-cape
**Domain:** infotech
**Last synced:** 2026-10-14 22:10 UTC
**Last synced:** 2026-10-14 22:34 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
@ -30,12 +30,6 @@ Progress: 2/4 done | workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`
- ! T02 — Register the client and hand over its secret `40ddaa29`
*(wait: Claims are verified against the registered client.)*
### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)
Progress: 1/2 done | workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b`
**Open tasks:**
- ► Deploy the image and record its digest `bd5db26c`
## Inbox Hygiene
**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.

10
WORK-RECORDS.md
View file

@ -50,8 +50,8 @@
| workplan | KEY-WP-0037 | finished | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
| workplan | KEY-WP-0038 | active | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
| workplan | KEY-WP-0039 | active | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
| workplan | KEY-WP-0040 | active | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
| workplan | KEY-WP-0041 | active | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
| workplan | KEY-WP-0040 | finished | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
| workplan | KEY-WP-0041 | finished | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
| task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
| task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
| task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md |
@ -217,8 +217,8 @@
| task | KEY-WP-0039-T01 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
| task | KEY-WP-0039-T02 | wait | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
| task | KEY-WP-0039-T03 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
| task | KEY-WP-0040-T01 | progress | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
| task | KEY-WP-0040-T02 | progress | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
| task | KEY-WP-0040-T01 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
| task | KEY-WP-0040-T02 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
| task | KEY-WP-0041-T01 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
| task | KEY-WP-0041-T02 | todo | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
| task | KEY-WP-0041-T02 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
| intake | KEY-IN-0001 | closed | — | intakes/intakes.md |

35
workplans/KEY-WP-0040-mfa-attended-run-findings.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)"
domain: infotech
repo: key-cape
status: active
status: finished
owner: claude-code
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-16"
updated: "2026-10-17"
flavor: implementation
depends_on: []
state_hub_workstream_id: "a67f9d60-9b8f-5111-9fe5-9f64e631b1c3"
@ -21,7 +21,7 @@ U05–U07 passed. U08 is blocked by T01.
```task
id: KEY-WP-0040-T01
status: progress
status: done
priority: high
state_hub_task_id: "b385602d-714a-5fdb-b40b-bd870420f28e"
```
@ -60,7 +60,7 @@ the deployed authenticated preview succeeds and user-engine can rerun U08.
```task
id: KEY-WP-0040-T02
status: progress
status: done
priority: medium
state_hub_task_id: "3ad155dd-15ef-5522-bdf9-c78832728553"
```
@ -132,3 +132,30 @@ OTP-page observation. Both remain progress. Resume the existing owner procedure
No authenticated preview, real-factor mutation or attended page observation was
performed during this source reconciliation. No passwords, codes, token values,
provider keys or production Secret objects were requested or read.
## T02 attended acceptance — 2026-10-17
The founder reported in session that the real user-engine-portal OTP challenge
shows **Code rejected or lost your authenticator?**, that it leads to
`https://users.coulomb.social/security`, and that the lost-device guidance is
reachable there ("T02 is fine"). This is the founder's own observation, on the
deployed image `cdec9dd7` from source `8c6c071`. No exact time or client was
recorded, and no challenge URL, request state, cookie or OTP value was preserved.
T02 is done. T01 still waits for the authenticated preview (step 2 above).
## T01 attended preview acceptance — 2026-10-17
The founder, signed in as platform-root with its own fresh OTP (AAL2), opened
`/platform/factor-recovery` and previewed login `tegwick` with the existing
reference `U08-2026-10-11`. The founder reported that the preview listed
tegwick's TOTP. The `invalid_request` failure from October 11 (F6) did not recur.
No confirm or disable action was taken, and no factor was changed. The serial
suffix and exact time were not reported, so this record does not claim that the
listed factor is still …E1D. The U08 operator must reconcile the current factor
metadata in the preview before any disable.
All Done-when conditions hold: the DN-shaped actor defect was fixed with regression
tests (2026-10-12), the sidecar logs only closed field names and error codes, and
the deployed preview succeeds. T01 and the workplan are done. U08 itself, meaning
the attended disable, re-enrolment and fresh login, belongs to user-engine
(USER-WP-0028-T03) and is handed back to it. This workplan does not close U08.