coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

KEY-WP-0040-T01: record founder-confirmed serial suffix E1D

Browse source 
The earlier closing record claimed every Done-when condition held before the
suffix had been checked. The founder has now confirmed the previewed TOTP is
the same E1D factor as on Oct 11.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
This commit is contained in:
tegwick 2026-10-17 04:22:21 +02:00
parent 258d899a78
commit 39c475ca07
2 changed files with 9 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.custodian-brief.md
View file

@ -2,7 +2,7 @@
# Custodian Brief — key-cape
**Domain:** infotech
**Last synced:** 2026-10-14 22:34 UTC
**Last synced:** 2026-10-17 02:16 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
@ -14,13 +14,6 @@ Progress: 2/3 done | workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86`
- ! T01 — Define the probe registrations `03da4c38`
*(wait: Ordered identity gate: Forgejo first SecurityCase registration/claims proof, then NetKingdom registry session and attended human/coding-agent custody; registration authorization already resolved.)*
### Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)
Progress: 0/2 done | workplan_id: `a67f9d60-9b8f-5111-9fe5-9f64e631b1c3`
**Open tasks:**
- ► Recovery preview rejects valid input (F6) `b385602d`
- ► Link the OTP prompt to lost-authenticator help (F3) `3ad155dd`
### Forgejo as a NetKingdom OIDC client, so the forge can close
Progress: 2/4 done | workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`

15
workplans/KEY-WP-0040-mfa-attended-run-findings.md
View file

@ -149,13 +149,14 @@ The founder, signed in as platform-root with its own fresh OTP (AAL2), opened
`/platform/factor-recovery` and previewed login `tegwick` with the existing
reference `U08-2026-10-11`. The founder reported that the preview listed
tegwick's TOTP. The `invalid_request` failure from October 11 (F6) did not recur.
No confirm or disable action was taken, and no factor was changed. The serial
suffix and exact time were not reported, so this record does not claim that the
listed factor is still …E1D. The U08 operator must reconcile the current factor
metadata in the preview before any disable.
No confirm or disable action was taken, and no factor was changed. When asked
afterwards, the founder confirmed that the listed TOTP's serial suffix is …E1D,
the same active factor as on October 11. The exact time was not recorded.
All Done-when conditions hold: the DN-shaped actor defect was fixed with regression
tests (2026-10-12), the sidecar logs only closed field names and error codes, and
the deployed preview succeeds. T01 and the workplan are done. U08 itself, meaning
All three Done-when conditions now hold: the DN-shaped actor defect was fixed
with regression tests (2026-10-12); the sidecar logs only closed field names and
error codes; and the deployed preview for tegwick lists the active TOTP …E1D
without applying anything. That third condition was met only after the suffix
was confirmed, not before. T01 and the workplan are done. U08 itself, meaning
the attended disable, re-enrolment and fresh login, belongs to user-engine
(USER-WP-0028-T03) and is handed back to it. This workplan does not close U08.