From 85f5deaf4ac9c9c27a3f01c02e21761d328abf30 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 13 Sep 2026 00:28:09 +0200 Subject: [PATCH] Support opt-in MFA per browser client with authoritative enrollment checks Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- workplans/KEY-WP-0035-optional-mfa.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/workplans/KEY-WP-0035-optional-mfa.md b/workplans/KEY-WP-0035-optional-mfa.md index 83ee54a..6d4933e 100644 --- a/workplans/KEY-WP-0035-optional-mfa.md +++ b/workplans/KEY-WP-0035-optional-mfa.md @@ -9,6 +9,7 @@ owner: codex topic_slug: infotech created: "2026-09-13" updated: "2026-09-13" +state_hub_workstream_id: "b27601d8-d0a5-5c79-a1ff-c2a4cedafa74" --- Requested behavior: password-only login before OTP activation; require OTP after @@ -20,6 +21,7 @@ activation. Do not lower assurance of unrelated applications. id: KEY-WP-0035-T01 status: done priority: high +state_hub_task_id: "c1ed06c2-c689-53d1-afc7-e10d79e9e94f" ``` Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on @@ -33,6 +35,7 @@ Validation: `go test ./...` and `git diff --check` passed on 2026-09-13. See doc id: KEY-WP-0035-T02 status: wait priority: high +state_hub_task_id: "b066a273-f91c-50ee-b497-a39eace03b3a" ``` Live factor-read credentials return HTTP 401. The owner route @@ -48,6 +51,7 @@ available; deploy digest-pinned source and run no-factor/enrolled/error checks. id: KEY-WP-0035-T03 status: wait priority: high +state_hub_task_id: "93ce2e97-6c5a-58a7-8f3c-1c4f0eb6f1b5" ``` Verify provider self-service login, possession-confirmed activation, cancellation