coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record deployed P06 policy and completed platform acceptance

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:10:25 +02:00
parent e0b3c25f06
commit e17b3f4631
2 changed files with 38 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/KEY-WP-0035-optional-mfa.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Opt-in MFA for demo-company login"
domain: infotech
repo: key-cape
status: active
status: finished
owner: codex
topic_slug: infotech
created: "2026-09-13"
updated: "2026-09-13"
updated: "2026-09-14"
state_hub_workstream_id: "b27601d8-d0a5-5c79-a1ff-c2a4cedafa74"
---
@ -33,7 +33,7 @@ Validation: `go test ./...` and `git diff --check` passed on 2026-09-13. See doc
```task
id: KEY-WP-0035-T02
status: progress
status: done
priority: high
state_hub_task_id: "b066a273-f91c-50ee-b497-a39eace03b3a"
```
@ -50,7 +50,7 @@ optional policy. See railiance-platform/docs/evidence/2026-09-13-keycape-factor-
```task
id: KEY-WP-0035-T03
status: wait
status: done
priority: high
state_hub_task_id: "93ce2e97-6c5a-58a7-8f3c-1c4f0eb6f1b5"
```
@ -101,3 +101,12 @@ failing closed. Native scope proof passed. Isolated installed-provider tests
passed possession confirmation/cancellation, permission withdrawal/recovery and
provider-issued JWT expiry; these are now included in CI. T02/T03 remain the
actual optional-client and self-service browser activation gates.
2026-09-14: T02/T03 completed through USER-WP-0033 P06. Installed-provider
native and five browser checks passed, including confirmed activation,
cancellation, old-session MFA and denied active-factor replacement. Portal
guards, provider restrictions and both scoped optional-client policies are live;
PVC readback confirms effective state. Full release evidence and rollback:
`../user-engine/docs/evidence/2026-09-13-p06-authentication-policy.md`.
Residual actual-user and workload sign-in acceptance remains live under
KEY-WP-0034, USER-WP-0028 and VERGABE-WP-0019 before this closure.