From 3c71226a1a7b8a2bdb710e9c497e1a1f7f8a3987 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 16 Oct 2026 21:24:41 +0200 Subject: [PATCH] docs: reconcile deployed MFA help and remaining recovery acceptance Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786 --- .../KEY-WP-0040-mfa-attended-run-findings.md | 44 ++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/workplans/KEY-WP-0040-mfa-attended-run-findings.md b/workplans/KEY-WP-0040-mfa-attended-run-findings.md index 9074902..df7f210 100644 --- a/workplans/KEY-WP-0040-mfa-attended-run-findings.md +++ b/workplans/KEY-WP-0040-mfa-attended-run-findings.md @@ -8,7 +8,7 @@ status: active owner: claude-code topic_slug: netkingdom created: "2026-10-11" -updated: "2026-10-14" +updated: "2026-10-16" flavor: implementation depends_on: [] state_hub_workstream_id: "a67f9d60-9b8f-5111-9fe5-9f64e631b1c3" @@ -90,3 +90,45 @@ T02 is a local source edit only; its source/image publication remains pending. 2026-10-14: the MFA challenge render test now requires the lost-authenticator link after the OTP form, with rel="noreferrer" and no request state in the URL. T02 stays progress until that page is published and an attended journey sees it. + +## Current publication and attended acceptance — 2026-10-16 + +The source-only publication statements above describe the October 12–14 state. +They are superseded for T02: the October 15 founder-run publication recorded in +`docs/operations.md` (Current image) and KEY-WP-0041-T02 delivered image +`sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` +from source `8c6c071`. That source includes the OTP help link commit `205a1c0`. +The founder verified the image-only diff, server dry-run, Recreate rollout, +Ready pod with zero restarts and discovery HTTP200. No additional image rollout +is needed to make the existing T02 link available. This reconciliation makes +no new live observation and does not infer attended acceptance from publication. + +T01 still needs the actual authenticated preview; T02 still needs the actual +OTP-page observation. Both remain progress. Resume the existing owner procedure +`user-engine/docs/mfa-attended-run.md`, corrected by its October 11 evidence +`user-engine/docs/evidence/2026-10-11-mfa-attended-u05-u08.md`: + +1. In the real user-engine-portal OTP challenge, observe **Code rejected or lost + your authenticator?**, follow it to `https://users.coulomb.social/security`, + and confirm the rejected-code/lost-device guidance is reachable. Preserve no + challenge URL, request state, cookie or OTP value in evidence. Record time, + client, link text/destination and outcome. This supplies T02 acceptance. +2. With platform-root's own fresh AAL2 browser session, open the existing + `/platform/factor-recovery` form. Preview `tegwick` using the existing support + reference `U08-2026-10-11`; inspect any existing reference before changing it. + Confirm the current factor metadata and shared-identity warning. The October + 11 suffix was …E1D; a changed factor is a reason to reconcile current state, + never to force the old selection. Record only time, preview outcome and serial + suffix. This preview alone makes no factor change and supplies the remaining + T01 preview evidence. +3. Only in the separately attended recovery window, after the operator verifies + the person and exact current scope, continue the existing U08 confirmation, + audited disable, reference readback, replacement enrollment and fresh login + procedure. Preserve the original reference and safe recovery record id. + Neither the published bug fix nor a passing preview closes U08. Stop on + stale metadata, replaced factor or failed audit/readback; do not reset or + re-enroll merely to make an acceptance check pass. + +No authenticated preview, real-factor mutation or attended page observation was +performed during this source reconciliation. No passwords, codes, token values, +provider keys or production Secret objects were requested or read.