key-cape/workplans/KEY-WP-0035-optional-mfa.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
KEY-WP-0035	workplan	Opt-in MFA for demo-company login	infotech	key-cape	active	codex	infotech	2026-09-13	2026-09-13	b27601d8-d0a5-5c79-a1ff-c2a4cedafa74

Requested behavior: password-only login before OTP activation; require OTP after activation. Do not lower assurance of unrelated applications.

Implement enrollment-dependent browser policy

id: KEY-WP-0035-T01
status: done
priority: high
state_hub_task_id: "c1ed06c2-c689-53d1-afc7-e10d79e9e94f"

Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on provider lookup errors and malformed/incomplete responses. Preserve the setting in config/runtime/canonical model and flag manual migration requirements. Validation: go test ./... and git diff --check passed on 2026-09-13. See docs/optional-mfa.md.

Restore authoritative factor lookup and enable the reviewed client

id: KEY-WP-0035-T02
status: wait
priority: high
state_hub_task_id: "b066a273-f91c-50ee-b497-a39eace03b3a"

Live factor-read credentials return HTTP 401. The owner route net-kingdom-privacyidea-admin-token is non-resolvable pending railiance-platform's approved custody/renewal contract (NK-WP-0033). Native credential handoff required; no secrets in work records. Do not enable the policy before lookup is verified. Prepare exact byte-preserving client migration after the provider contract is available; deploy digest-pinned source and run no-factor/enrolled/error checks.

Verify optional enrollment and account management access

id: KEY-WP-0035-T03
status: wait
priority: high
state_hub_task_id: "93ce2e97-6c5a-58a7-8f3c-1c4f0eb6f1b5"

Verify provider self-service login, possession-confirmed activation, cancellation and removal/recovery. Resolve shared portal assurance scope before surfacing the verified OTP setup link. Actual user login acceptance remains open under KEY-WP-0034 and VERGABE-WP-0019; this work does not finish either workplan.

Support bounded provider credential renewal without issuer restart

id: KEY-WP-0035-T04
status: done
priority: high
state_hub_task_id: "494f554d-6542-5797-804f-6df4a05dcadb"

Supports platform journey P05 and USER-WP-0030-T03. Add an exclusive mounted adminTokenFile credential source, fresh reads for lookup and validation, no stale fallback, bounded input, sanitized failures and atomic replacement acceptance. Preserve inline configuration compatibility. Require provider success and true validation value before AAL2; bound default request time and reject credential-bearing redirects. Test renewal, rejection, recovery and policy regressions. This implements the consumer delivery contract; owner credential issuance/custody and live P04/P05/P06 acceptance remain T02/T03.

All Go regression/conformance suites pass, including five new renewal/validation tests with invalid-source subcases. Added exact-commit authentication acceptance CI. Provider-mounted credential delivery and effective optional policy remain gated separately.

Consumer source 632b1f1 deployed and Ready 1/1; CI, four provider HTTP checks and twelve live browser checks passed. See docs/credential-renewal-release-2026-09-13.md. T02/T03 retain actual credential delivery and live recovery/policy acceptance.