From 257c810709b727a47183bc8136e8b4d48eaf12d8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 11:47:34 +0200 Subject: [PATCH] NK-WP-0042-T02: record user-engine's pilot proposal (coulomb-social) The message dependency is cleared; T02 waits on the founder under decision cef97ccd for the pilot choice and journey acceptance. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 469893@bnt-lap001 Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb --- workplans/NK-WP-0042-workload-mfa-step-up.md | 39 ++++++++++++++++++-- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/workplans/NK-WP-0042-workload-mfa-step-up.md b/workplans/NK-WP-0042-workload-mfa-step-up.md index ba36ab7..d517b80 100644 --- a/workplans/NK-WP-0042-workload-mfa-step-up.md +++ b/workplans/NK-WP-0042-workload-mfa-step-up.md @@ -9,7 +9,7 @@ flavor: planning owner: claude-code topic_slug: netkingdom created: "2026-09-23" -updated: "2026-10-03" +updated: "2026-10-09" related: [NK-ADR-0016, NK-WP-0037] state_hub_workstream_id: "3f702215-704b-5788-8ca0-b8b9ba2dd3f8" --- @@ -59,8 +59,7 @@ id: NK-WP-0042-T02 status: wait needs_human: true decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb -blocked_on: message-from:user-engine -blocking_reason: "Agree the MFA-required user experience with user-engine and one pilot workload; must be accepted from a user's perspective." +blocking_reason: "user-engine's pilot proposal (coulomb-social) is in; the pilot choice, the AAL2 switch-on and user-perspective acceptance are the founder's (decision cef97ccd)." priority: medium state_hub_task_id: "4e51585d-2b57-56d4-84c1-314041d26bcf" ``` @@ -91,6 +90,40 @@ by user-engine, so `blocked_on: message-from:user-engine` stays real, and the founder's acceptance under decision cef97ccd stays the human gate. The reply reminds user-engine of `892fd489`. +2026-10-09: user-engine answered `892fd489` (message `a459e8a6`), as a proposal; +the pilot choice and the AAL2 switch-on stay founder decisions: + +- Pilot workload: `coulomb-social` (the current registration/onboarding client, + owner of application action step-up). One non-privileged feature behind + `acr_values=aal2`. Precedent: the user-engine portal's administration step-up + ("Verify with MFA" -> `/login?recovery=1&return_path=...`, P06 recent-MFA + guard, deployed). +- Refusal shape: inline enrollment detour at the issuer; factor screens stay on + the IdP and user-engine never collects an OTP or reads a seed. Fallback on an + `mfa_required`-class refusal: link to the public user-engine `/security` + page. Return means the workload re-requests with `acr_values`; a return URL is + never proof of enrollment. +- U06 touchpoints reused: `/security`; My account -> Sign-in security -> + provider management (`USER_ENGINE_MFA_MANAGEMENT_URL`, deliberately unset + until attended KEY-WP-0035 self-service checks pass); U07 lost device and U08 + replace/remove (replacement verified before removal, no bypass link; P04 + operator-assisted recovery); P06 policy preview/rollback so switching on does + not lock out unenrolled users. +- Constraint: user-engine's attended real-factor U05-U08 run + (USER-WP-0027-T03 / USER-WP-0028-T03) is pending, and route + `net-kingdom-privacyidea-admin-token` is still `resolvable: false` + (railiance-platform). user-engine proposes running the pilot's + user-perspective acceptance in that same attended session (enrollment detour + -> return -> lost-factor recovery, end to end once). + +NetKingdom's reading: the proposal fits the T01 contract (issuer owns factor +screens, workload enforces issued assurance, return is not evidence). The +message dependency is cleared; T02 stays `wait` on the founder under decision +cef97ccd: choose the pilot, then accept the journey in the combined attended +session. Note that coulomb.social fits oidc-browser-relying-party 1.0 only partly +(NK-WP-0048 README fit table), so the pilot's KeyCape `acr_values` handling is +checked on its existing registration. + ## Infrastructure review — 2026-09-28 Build T02 on the already completed USER-WP-0033 and KEY-WP-0035 P06 work.