coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: reconcile deployed MFA help and remaining recovery acceptance

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 21:24:41 +02:00
parent 6a4afd8080
commit 3c71226a1a
1 changed files with 43 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

44
workplans/KEY-WP-0040-mfa-attended-run-findings.md
View file

@ -8,7 +8,7 @@ status: active
owner: claude-code
topic_slug: netkingdom
created: "2026-10-11"
updated: "2026-10-14"
updated: "2026-10-16"
flavor: implementation
depends_on: []
state_hub_workstream_id: "a67f9d60-9b8f-5111-9fe5-9f64e631b1c3"
@ -90,3 +90,45 @@ T02 is a local source edit only; its source/image publication remains pending.
2026-10-14: the MFA challenge render test now requires the lost-authenticator
link after the OTP form, with rel="noreferrer" and no request state in the URL.
T02 stays progress until that page is published and an attended journey sees it.
## Current publication and attended acceptance — 2026-10-16
The source-only publication statements above describe the October 12–14 state.
They are superseded for T02: the October 15 founder-run publication recorded in
`docs/operations.md` (Current image) and KEY-WP-0041-T02 delivered image
`sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`
from source `8c6c071`. That source includes the OTP help link commit `205a1c0`.
The founder verified the image-only diff, server dry-run, Recreate rollout,
Ready pod with zero restarts and discovery HTTP200. No additional image rollout
is needed to make the existing T02 link available. This reconciliation makes
no new live observation and does not infer attended acceptance from publication.
T01 still needs the actual authenticated preview; T02 still needs the actual
OTP-page observation. Both remain progress. Resume the existing owner procedure
`user-engine/docs/mfa-attended-run.md`, corrected by its October 11 evidence
`user-engine/docs/evidence/2026-10-11-mfa-attended-u05-u08.md`:
1. In the real user-engine-portal OTP challenge, observe **Code rejected or lost
your authenticator?**, follow it to `https://users.coulomb.social/security`,
and confirm the rejected-code/lost-device guidance is reachable. Preserve no
challenge URL, request state, cookie or OTP value in evidence. Record time,
client, link text/destination and outcome. This supplies T02 acceptance.
2. With platform-root's own fresh AAL2 browser session, open the existing
`/platform/factor-recovery` form. Preview `tegwick` using the existing support
reference `U08-2026-10-11`; inspect any existing reference before changing it.
Confirm the current factor metadata and shared-identity warning. The October
11 suffix was …E1D; a changed factor is a reason to reconcile current state,
never to force the old selection. Record only time, preview outcome and serial
suffix. This preview alone makes no factor change and supplies the remaining
T01 preview evidence.
3. Only in the separately attended recovery window, after the operator verifies
the person and exact current scope, continue the existing U08 confirmation,
audited disable, reference readback, replacement enrollment and fresh login
procedure. Preserve the original reference and safe recovery record id.
Neither the published bug fix nor a passing preview closes U08. Stop on
stale metadata, replaced factor or failed audit/readback; do not reset or
re-enroll merely to make an acceptance check pass.
No authenticated preview, real-factor mutation or attended page observation was
performed during this source reconciliation. No passwords, codes, token values,
provider keys or production Secret objects were requested or read.