From bc507455da96caa07e30016821d6e5dbefd9b7f9 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 00:21:08 +0200 Subject: [PATCH] MASON-WP-0005-T05: member check waits on a TOTP factor for tegwick Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0 --- ...ASON-WP-0005-fluid-telegram-operator-credential-lane.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md index 6059ca6..53f03e2 100644 --- a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md +++ b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md @@ -218,7 +218,7 @@ id: MASON-WP-0005-T05 status: progress depends_on: [MASON-WP-0005-T04] blocked_on: human -blocking_reason: "ops-mason checks and the non-member refusal pass (2026-10-09). Founder runs scripts/verify-fluid-telegram-lane.sh member as tegwick (MFA) and shares the receipt; fluid-telegram runs the salt create-once probe (FT-WP-0002)." +blocking_reason: "ops-mason checks and the non-member refusal pass (2026-10-09). tegwick has no MFA factor, so it cannot reach aal2: founder enrolls TOTP for tegwick in privacyIDEA self-service, then runs scripts/verify-fluid-telegram-lane.sh member; fluid-telegram runs the salt create-once probe (FT-WP-0002)." priority: high state_hub_task_id: "4c205be7-4f1f-5dd1-aafa-fc112fdd640e" ``` @@ -255,6 +255,11 @@ the salt create-once probe by fluid-telegram (message `f966db1c`). does not match any associated bound claim values" (receipt `fluid-telegram-lane-non-member.txt`, 18:11Z). Member run as `tegwick` pending. +2026-10-10: the member run cannot pass yet: `tegwick` has no enrolled factor, so +KeyCape asks for an OTP it cannot satisfy, and the role requires `aal2` anyway. +`tegwick` enrolls TOTP through privacyIDEA self-service (net-kingdom +platform-root-custody.md steps 6-7, same procedure), then the member run. + ## Hand off routing and keep the adapter lane separate ```task