Attended window checklist — 2026-10-11 (revised after the guided session)

Regenerate with python3 ~/the-custodian/scripts/security_flow_report.py (ATTENDED section).

Cleared in the guided session

C1 / C2 / C4: decided (Round 3 in docs/decisions/2026-10-11-security-unblock-decisions.md).
B1 policy-nexus precheck: run read-only by an agent (railiance-platform/docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json).
B2 / B3: not founder-ready (no packaged commands). Returned to their owners.
B4 (RPF-WP-0035-T10): access removal is blue lane. No window needed.
C3 (USER-WP-0035-T02): owner work, not a choice.
A3 (FLEX-WP-0027-T03): already done on 2026-10-04. The stale hub decision e1868a8d was resolved.

Remaining: only you (≈40 min)

1. MFA journeys with your real factor (USER-WP-0027-T04, USER-WP-0028-T03) — ≈25 min

Use https://users.coulomb.social (login via https://kc.coulomb.social). Have your authenticator app ready. Use a private browser window so that old sessions don't interfere.

Step	Do	Expect
U05	Sign in as an ordinary user and enroll an OTP factor	Enrollment completes; account shows MFA active
U06	Start a second enrollment, then cancel it	Nothing changes; the first factor stays active
U07	Replace the factor (enroll new, remove old)	Only the new code works
U08	Lost-factor recovery path	Recovery works without inventing access; you must re-enroll
—	Sign out, then fresh login	OTP is required
P04–P06	As platform admin: recovery via tenant access; delivery denial/retry; try an admin action from a session without MFA (AAL1)	AAL1 session gets no administration

Note any oddity in one line each. Tell Claude or Sol: "journeys done, findings: …". The agent writes the receipt, and findings become defects.

2. Signed-in access readback (USER-WP-0026-T03) — ≈5 min

Still signed in, open your account page and confirm that it lists your real application access (allow / deny / unavailable), not just memberships. Report "matches" or what's wrong.

3. CoulombCore ArgoCD, read-only (RPF-WP-0044-T08) — ≈2 min

In the Claude prompt:

! ssh coulombcore 'sudo k3s kubectl get applications -n argocd'

(The agent identity has no kube rights there. Your admin login does.)

Later, not now

NK-WP-0022-T08: the CoulombCore deletion batch. It appears here only after Sol's railiance01 restore/restart drill has a passing receipt.

Added by the critical-path run

D2 already approves the exact private issue-core repository reader. The actual remaining human act is the existing Platform OpenBao OIDC/MFA login. No second reader-scope decision is requested. The bounded issuer is prepared in railiance-platform/scripts/provision_argocd_issue_core_repository.py; review and rollback are recorded in that repo’s docs/evidence/2026-10-11-issue-core-credential/owner-review.json.

Before the window, complete the public SSH host/project prerequisite and seal the fixed contract with its exact digest, host pin, owner review, existing-egress proof, runtime identity, expiry and rollback references. The example contract is incomplete; it is not an execution approval. During the window, the operator uses the reviewed fixed command through the existing Platform admin login. The agent does not receive credential values. Preserve the exclusive private journal; any ambiguous provider/write/unwrap/destination result stops replay for owner reconciliation. Verify one-time consumption, exact destination and then independent Argo adoption. This has not been executed.

Run results — 2026-10-11 evening (guided)

Item 1 (MFA journeys): U05, U06 and U07 were accepted with tegwick (TOTP …E1D). U07 ran on users.coulomb.social. coulomb.social stays password-only by intent. U08 is blocked by a recovery-preview defect (key-cape KEY-WP-0040-T01) and will be re-run after the fix with platform-root as operator. Evidence: user-engine docs/evidence/2026-10-11-mfa-attended-u05-u08.md.
Item 2 (signed-in access readback, USER-WP-0026-T03): deny path accepted (tegwick → Informed Decision "Not available", correct). Optional 2-minute positive check: sign in as platform-root (an admin with OTP) and expect "Informed Decision - Available".
Item 3 (CoulombCore ArgoCD read-only): no longer needed. k3s certificates expired on 2026-08-31, so the old ArgoCD is frozen. The founder retires coulombcore and reuses the machine (NK-WP-0022-T08).
Findings filed: F1 → coulomb-social CSOC-WP-0016; F3 → key-cape KEY-WP-0040-T02 + user-engine wording; F6 → KEY-WP-0040-T01.

Later: KEY-WP-0039-T02 owner token session

This follows the first Forgejo SecurityCase and KEY-WP-0038-T02/T03 native registration/claims proofs. It is not ready for the current window. Existing registration authorization remains resolved; no additional go-ahead is requested. After those prerequisites, NetKingdom supplies the registry/env session and the attended human token through the already prepared runner, with the coding-agent owner custody path and Platform refusal/capability/cleanup proof. The runner passes 17 local checks; those do not prove native identity or cleanup.

Added: FORGE-WP-0006-T02 authenticated route acceptance

The prepared contained command combines the existing Forgejo-reader OIDC/MFA login with the complete HTTP/API probe and owned disposable-repository cleanup. The exact shared suite passes 27 isolated checks and five boundary tests; live execution remains pending. No new policy scope or token provisioning is requested.

5.7 KiB Raw Blame History Unescape Escape