ADR-0016: MFA is a user preference; workloads opt in. Close NK-WP-0037.

- The operator's Vergabe recipient journey completed after the KeyCape
  fresh-login fix: sign-in, callback and account confirmation.
- ADR-0016 records MFA as user preference by default, workload-requested
  step-up for all or part of a feature set, and an unchanged IAM v0.3 floor.
- NK-WP-0042 (proposed) plans the step-up contract and user journey.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e

workplans/NK-WP-0037-vergabe-company-welcome.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Bind password setup to the Vergabe company welcome and sign-in"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 flavor: implementation
 owner: codex
 topic_slug: netkingdom
@@ -38,7 +38,7 @@ Existing setup links remain process-local and expire on restart.
 
 ```task
 id: NK-WP-0037-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"
 ```
@@ -114,3 +114,28 @@ are two candidate fixes:
 
 T02 waits on key-cape. MFA enrollment and account confirmation were not
 reached. Rerun the same recipient once the fix is live.
+
+### Attended rerun 2026-09-23 — T02 done
+
+key-cape shipped the fix under KEY-WP-0033-T02 (`key-cape@11ce29a`, image
+`key-cape@sha256:8dc35801…`). The operator rolled it out on railiance01, and
+it is pinned at net-kingdom `8ee0f8b`. Post-rollout checks:
+
+- `verify-openbao-client.sh` passed.
+- The Vergabe callback with PKCE returned 302; a wrong callback and missing
+  PKCE each returned 400.
+- `prompt=login` now reaches Authelia as `max_age=10`.
+
+Recipient `bernd.worsch-99` then completed the journey in a new private
+window:
+
+- KeyCape `auth_start` at 20:16:36, `auth_success` at 20:17:28 and
+  `token_issued` at 20:17:29 for `vergabe-demo-company`.
+- Vergabe logged `/accounts/oidc/callback/` 302, the confirmation page 200,
+  and the confirmation POST 302.
+
+No MFA was involved, by design. P06 permits AAL1 when privacyIDEA
+authoritatively reports no active factor; privacyIDEA logged the no-factor
+token lookup at 20:17:28. The operator decided that MFA stays a user
+preference for Vergabe Teilnahme for now (ADR-0016). That supersedes the
+"provider-required MFA" wording above. Workload-requested MFA is NK-WP-0042.