user-engine/docs/mfa-attended-run.md

# Attended MFA acceptance run: U05–U08, first real user tegwick

Prepared 2026-10-10 for the founder request relayed by ops-mason (hub message
ab89a591). It covers USER-WP-0028-T03 and USER-WP-0027-T04 and is gated by hub
decision cef97ccd (D10). The pilot is set in [mfa-pilot-decision.md](mfa-pilot-decision.md).

## What already exists

- **Enrollment surface.** privacyIDEA self-service runs at
  `https://pink-account.coulomb.social/` (net-kingdom `sso-mfa/k8s/privacyidea`).
  Realm `coulomb` resolves every LLDAP user. Policy `totp-self-enrollment` lets
  any user in that realm enroll, delete or disable their own TOTP token. Tokens
  are labelled `{user}@{realm}` and issued as `Coulomb`, so the app shows
  `tegwick@coulomb`.
- **Portal guidance.** `/security` explains setup, cancellation, a rejected
  code and a lost authenticator. It also covers the no-factor-yet case. Until
  `USER_ENGINE_MFA_MANAGEMENT_URL` is set, it says setup is unavailable and
  points to the tenant administrator.
- **Recovery and replacement.** P04 recovery and P06 policy are deployed and
  were verified with installed-provider fixtures
  ([P06 evidence](evidence/2026-09-13-p06-authentication-policy.md)).

What is missing is a real person going through it, plus the portal handoff
link.

## Does tegwick need to join the coulomb-social pilot?

Not to enroll. Enrollment is per realm, not per client. Joining is needed only
to observe U05 and U07 on the pilot client, where MFA is optional. On
`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in
(U05) cannot be observed there. **Decided (founder, 2026-10-10):** tegwick
runs on coulomb-social, so all four journeys run on one client. There is no
pilot member list. coulomb-social is a KeyCape client in realm `coulomb`, so
"joining" means tegwick signs in to coulomb-social once (U05). `openbao-admin` then serves as the second U07 check that ops-mason
needs (MASON-WP-0005-T05).

## Before the run (operator)

1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/`
   in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out.
   Founder go given 2026-10-10. The change was sent to net-kingdom as hub
   message 58e999b3; we wait for its rollout reply. The
   portal accepts only a fixed HTTPS URL with no query or credentials. Without
   this step, start U06 at the provider URL directly and record that the handoff
   was not exercised.
2. Confirm tegwick has no active token: privacyIDEA admin token list for
   `tegwick@coulomb`, token count only.

## Attended steps (tegwick at the keyboard, operator observing)

| Step | Journey | Where | Expected | Record |
| --- | --- | --- | --- | --- |
| 1 | U05 | coulomb-social sign-in | Password-only sign-in succeeds; no OTP prompt | time, client, outcome |
| 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) |
| 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome |
| 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status |
| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client |
| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome |

Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick
has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later.

## Evidence rules

Record times, outcomes, client ids, token serial suffixes and recovery record
ids in `docs/evidence/<date>-mfa-attended-u05-u08.md`. **Never** record a seed,
a QR code or image, an OTP value, a password or a session cookie, and do not
take screenshots of the enrollment page. No step is inferred from a redirect,
a return parameter or an assurance claim.

## After acceptance

Keep `USER_ENGINE_MFA_MANAGEMENT_URL` set for all users. It covers every LLDAP
user in realm `coulomb` and every KeyCape client, because enrollment does not
depend on the client. MFA stays optional except where KeyCape already asks for
it (`openbao-admin`).

Still deferred:

- admin-required MFA, which would be an issuer-side client policy applied
  through P06 and needs the founder's go;
- showing authoritative enrollment status in the portal;
- a link from KeyCape's OTP prompt to `/security` for users who have no factor
  yet. That page belongs to key-cape, and today it is the dead end tegwick hit.

## Hand-off

USER-WP-0028-T03, USER-WP-0027-T04 and decision cef97ccd close only on the
recorded evidence.