key-cape/workplans/KEY-WP-0040-mfa-attended-run-findings.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on
KEY-WP-0040	workplan	Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)	infotech	key-cape	ready	claude-code	netkingdom	2026-10-11	2026-10-11	implementation

From the attended run of 2026-10-11 (user-engine docs/evidence/2026-10-11-mfa-attended-u05-u08.md). U05–U07 passed. U08 is blocked by T01.

Recovery preview rejects valid input (F6)

id: KEY-WP-0040-T01
status: todo
priority: high

Operator platform-root (holds platform-operator, fresh AAL2) previewed login tegwick, reference U08-2026-10-11 at /platform/factor-recovery. Every attempt returned invalid_request ("Enter a valid login and support reference."). Both inputs match [A-Za-z0-9_.@:/-]{1,150}. The factor-recovery container in mfa/privacyidea logged nothing.

Candidate causes in scripts/recovery_service.py / scripts/factor_recovery.py:

• the actor sub (KeyCape user.ID) failing _recover's character rule;
• a privacyIDEA serial failing it;
• the request body differing from what is validated, e.g. form encoding through the portal.

Done when:

• the failing check is identified and fixed with a regression test;
• the sidecar logs the failing check (field name and error code, never values);
• a preview for tegwick lists the active TOTP (serial suffix …E1D) without applying anything.

Then hand back to user-engine, which re-runs U08 (USER-WP-0028-T03). The fix and roll-out of the sidecar are blue lane under the build-mode change rule.

Link the OTP prompt to lost-authenticator help (F3)

id: KEY-WP-0040-T02
status: todo
priority: medium

The OTP input offers no way out for a user whose code is rejected or whose device is lost. Add "Code rejected or lost your authenticator?" linking to https://users.coulomb.social/security (the lost-authenticator section). The same link serves users who have no factor yet (the dead end noted in mfa-attended-run.md).