coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support opt-in MFA per browser client with authoritative enrollment checks

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 00:28:09 +02:00
parent 9a226e9cd0
commit 85f5deaf4a
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
workplans/KEY-WP-0035-optional-mfa.md
View file

@ -9,6 +9,7 @@ owner: codex
topic_slug: infotech topic_slug: infotech
created: "2026-09-13" created: "2026-09-13"
updated: "2026-09-13" updated: "2026-09-13"
state_hub_workstream_id: "b27601d8-d0a5-5c79-a1ff-c2a4cedafa74"
--- ---
Requested behavior: password-only login before OTP activation; require OTP after Requested behavior: password-only login before OTP activation; require OTP after
@ -20,6 +21,7 @@ activation. Do not lower assurance of unrelated applications.
id: KEY-WP-0035-T01 id: KEY-WP-0035-T01
status: done status: done
priority: high priority: high
state_hub_task_id: "c1ed06c2-c689-53d1-afc7-e10d79e9e94f"
``` ```
Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on
@ -33,6 +35,7 @@ Validation: `go test ./...` and `git diff --check` passed on 2026-09-13. See doc
id: KEY-WP-0035-T02 id: KEY-WP-0035-T02
status: wait status: wait
priority: high priority: high
state_hub_task_id: "b066a273-f91c-50ee-b497-a39eace03b3a"
``` ```
Live factor-read credentials return HTTP 401. The owner route Live factor-read credentials return HTTP 401. The owner route
@ -48,6 +51,7 @@ available; deploy digest-pinned source and run no-factor/enrolled/error checks.
id: KEY-WP-0035-T03 id: KEY-WP-0035-T03
status: wait status: wait
priority: high priority: high
state_hub_task_id: "93ce2e97-6c5a-58a7-8f3c-1c4f0eb6f1b5"
``` ```
Verify provider self-service login, possession-confirmed activation, cancellation Verify provider self-service login, possession-confirmed activation, cancellation