NK-WP-0042-T02: record user-engine's pilot proposal (coulomb-social)

The message dependency is cleared; T02 waits on the founder under
decision cef97ccd for the pilot choice and journey acceptance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469893@bnt-lap001
Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb

workplans/NK-WP-0042-workload-mfa-step-up.md

@@ -9,7 +9,7 @@ flavor: planning
 owner: claude-code
 topic_slug: netkingdom
 created: "2026-09-23"
-updated: "2026-10-03"
+updated: "2026-10-09"
 related: [NK-ADR-0016, NK-WP-0037]
 state_hub_workstream_id: "3f702215-704b-5788-8ca0-b8b9ba2dd3f8"
 ---
@@ -59,8 +59,7 @@ id: NK-WP-0042-T02
 status: wait
 needs_human: true
 decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
-blocked_on: message-from:user-engine
-blocking_reason: "Agree the MFA-required user experience with user-engine and one pilot workload; must be accepted from a user's perspective."
+blocking_reason: "user-engine's pilot proposal (coulomb-social) is in; the pilot choice, the AAL2 switch-on and user-perspective acceptance are the founder's (decision cef97ccd)."
 priority: medium
 state_hub_task_id: "4e51585d-2b57-56d4-84c1-314041d26bcf"
 ```
@@ -91,6 +90,40 @@ by user-engine, so `blocked_on: message-from:user-engine` stays real, and the
 founder's acceptance under decision cef97ccd stays the human gate. The reply
 reminds user-engine of `892fd489`.
 
+2026-10-09: user-engine answered `892fd489` (message `a459e8a6`), as a proposal;
+the pilot choice and the AAL2 switch-on stay founder decisions:
+
+- Pilot workload: `coulomb-social` (the current registration/onboarding client,
+  owner of application action step-up). One non-privileged feature behind
+  `acr_values=aal2`. Precedent: the user-engine portal's administration step-up
+  ("Verify with MFA" -> `/login?recovery=1&return_path=...`, P06 recent-MFA
+  guard, deployed).
+- Refusal shape: inline enrollment detour at the issuer; factor screens stay on
+  the IdP and user-engine never collects an OTP or reads a seed. Fallback on an
+  `mfa_required`-class refusal: link to the public user-engine `/security`
+  page. Return means the workload re-requests with `acr_values`; a return URL is
+  never proof of enrollment.
+- U06 touchpoints reused: `/security`; My account -> Sign-in security ->
+  provider management (`USER_ENGINE_MFA_MANAGEMENT_URL`, deliberately unset
+  until attended KEY-WP-0035 self-service checks pass); U07 lost device and U08
+  replace/remove (replacement verified before removal, no bypass link; P04
+  operator-assisted recovery); P06 policy preview/rollback so switching on does
+  not lock out unenrolled users.
+- Constraint: user-engine's attended real-factor U05-U08 run
+  (USER-WP-0027-T03 / USER-WP-0028-T03) is pending, and route
+  `net-kingdom-privacyidea-admin-token` is still `resolvable: false`
+  (railiance-platform). user-engine proposes running the pilot's
+  user-perspective acceptance in that same attended session (enrollment detour
+  -> return -> lost-factor recovery, end to end once).
+
+NetKingdom's reading: the proposal fits the T01 contract (issuer owns factor
+screens, workload enforces issued assurance, return is not evidence). The
+message dependency is cleared; T02 stays `wait` on the founder under decision
+cef97ccd: choose the pilot, then accept the journey in the combined attended
+session. Note that coulomb.social fits oidc-browser-relying-party 1.0 only partly
+(NK-WP-0048 README fit table), so the pilot's KeyCape `acr_values` handling is
+checked on its existing registration.
+
 ## Infrastructure review — 2026-09-28
 
 Build T02 on the already completed USER-WP-0033 and KEY-WP-0035 P06 work.