user-engine/docs/mfa-attended-run.md

# Attended MFA acceptance run: U05–U08, first real user tegwick

Prepared 2026-10-10 for the founder request relayed by ops-mason (hub message
ab89a591). It covers USER-WP-0028-T03 and USER-WP-0027-T04 and is gated by hub
decision cef97ccd (D10). The pilot is set in [mfa-pilot-decision.md](mfa-pilot-decision.md).

## What already exists

- **Enrollment surface.** privacyIDEA self-service runs at
  `https://pink-account.coulomb.social/` (net-kingdom `sso-mfa/k8s/privacyidea`).
  Realm `coulomb` resolves every LLDAP user. Policy `totp-self-enrollment` lets
  any user in that realm enroll, delete or disable their own TOTP token. Tokens
  are labelled `{user}@{realm}` and issued as `Coulomb`, so the app shows
  `tegwick@coulomb`.
- **Portal guidance.** `/security` explains setup, cancellation, a rejected
  code and a lost authenticator. It also covers the no-factor-yet case. Until
  `USER_ENGINE_MFA_MANAGEMENT_URL` is set, it says setup is unavailable and
  points to the tenant administrator.
- **Recovery and replacement.** P04 recovery and P06 policy are deployed and
  were verified with installed-provider fixtures
  ([P06 evidence](evidence/2026-09-13-p06-authentication-policy.md)).

What is missing is a real person going through it, plus the portal handoff
link.

## Does tegwick need to join the coulomb-social pilot?

Not to enroll. Enrollment is per realm, not per client. Joining is needed only
to observe U05 and U07 on the pilot client, where MFA is optional. On
`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in
(U05) cannot be observed there. **Decided (founder, 2026-10-10):** tegwick
runs on coulomb-social, so all four journeys run on one client. There is no
pilot member list. coulomb-social is a KeyCape client in realm `coulomb`, so
"joining" means tegwick signs in to coulomb-social once (U05). `openbao-admin` then serves as the second U07 check that ops-mason
needs (MASON-WP-0005-T05).

## Before the run (operator)

1. Done. `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social`
   is live. Its apply home is `rapp-user-engine` `manifests/runtime.yaml`; the
   net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` is only migration input.
   Verified on 2026-10-10: the public `https://users.coulomb.social/security`
   shows *Manage authenticator app* pointing to pink-account.
2. Confirm tegwick has no active token: privacyIDEA admin token list for
   `tegwick@coulomb`, token count only.

## Attended steps (tegwick at the keyboard, operator observing)

| Step | Journey | Where | Expected | Record |
| --- | --- | --- | --- | --- |
| 1 | U05 | coulomb-social sign-in | Password-only sign-in succeeds; no OTP prompt | time, client, outcome |
| 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) |
| 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome |
| 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status |
| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client |
| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome |

Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick
has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later.

## Evidence rules

Record times, outcomes, client ids, token serial suffixes and recovery record
ids in `docs/evidence/<date>-mfa-attended-u05-u08.md`. **Never** record a seed,
a QR code or image, an OTP value, a password or a session cookie, and do not
take screenshots of the enrollment page. No step is inferred from a redirect,
a return parameter or an assurance claim.

## After acceptance

Keep `USER_ENGINE_MFA_MANAGEMENT_URL` set for all users. It covers every LLDAP
user in realm `coulomb` and every KeyCape client, because enrollment does not
depend on the client. MFA stays optional except where KeyCape already asks for
it (`openbao-admin`).

Still deferred:

- admin-required MFA, which would be an issuer-side client policy applied
  through P06 and needs the founder's go;
- showing authoritative enrollment status in the portal;
- a link from KeyCape's OTP prompt to `/security` for users who have no factor
  yet. That page belongs to key-cape, and today it is the dead end tegwick hit.

## Hand-off

USER-WP-0028-T03, USER-WP-0027-T04 and decision cef97ccd close only on the
recorded evidence.