coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): name the audited recovery path in lost-authenticator help (F3); close U08 follow-ups
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details
Account journey acceptance / journeys (push) Successful in 1m53s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
This commit is contained in:
tegwick 2026-10-21 00:01:47 +02:00
parent 9787cd7523
commit 15c41970a6
5 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -209,12 +209,12 @@
| task | USER-WP-0027-T01 | done | — | workplans/USER-WP-0027-account-journey-clarity.md |
| task | USER-WP-0027-T02 | done | — | workplans/USER-WP-0027-account-journey-clarity.md |
| task | USER-WP-0027-T03 | done | — | workplans/USER-WP-0027-account-journey-clarity.md |
| task | USER-WP-0027-T04 | wait | — | workplans/USER-WP-0027-account-journey-clarity.md |
| task | USER-WP-0027-T04 | done | — | workplans/USER-WP-0027-account-journey-clarity.md |
| task | USER-WP-0027-T05 | done | — | workplans/USER-WP-0027-account-journey-clarity.md |
| task | USER-WP-0027-T06 | wait | — | workplans/USER-WP-0027-account-journey-clarity.md |
| task | USER-WP-0028-T01 | done | — | workplans/USER-WP-0028-user-journey-acceptance.md |
| task | USER-WP-0028-T02 | wait | — | workplans/USER-WP-0028-user-journey-acceptance.md |
| task | USER-WP-0028-T03 | wait | — | workplans/USER-WP-0028-user-journey-acceptance.md |
| task | USER-WP-0028-T03 | done | — | workplans/USER-WP-0028-user-journey-acceptance.md |
| task | USER-WP-0029-T01 | done | — | workplans/USER-WP-0029-tenant-admin-journeys.md |
| task | USER-WP-0029-T02 | done | — | workplans/USER-WP-0029-tenant-admin-journeys.md |
| task | USER-WP-0029-T03 | done | — | workplans/USER-WP-0029-tenant-admin-journeys.md |

2
src/user_engine/web.py
View file

@ -1990,7 +1990,7 @@ This account site cannot currently confirm whether an authenticator is enabled f
<p>Opening the setup page does not activate two-step verification. To cancel unfinished setup, open All Tokens, select the pending token, and choose Delete. A confirmed authenticator cannot be removed or replaced from this password-only management session; ask your administrator to use audited authenticator recovery.</p></details>
<details><summary>A code is rejected, or I have lost my authenticator</summary>
<p>Use the newest code for the correct account and check that your device sets its time automatically.
If you cannot use your authenticator, follow the sign-in service's recovery instructions or ask your tenant administrator for account recovery.
If you cannot use your authenticator, ask your tenant administrator for audited authenticator recovery. They confirm your identity and remove the lost authenticator; you then sign in with your password and set up a new one here. There is no self-service bypass.
Never send your password, QR code, or verification codes to an administrator.</p></details></section>
<section><h2>Password help</h2><p>Use password recovery on the sign-in page.
If the recovery message does not arrive, ask your tenant administrator for a new password setup link.

6
workplans/USER-WP-0026-account-recovery.md
View file

@ -62,12 +62,14 @@ logout. This does not accept the remaining multi-user Vergabe pilot.
```task
id: USER-WP-0026-T03
status: wait
needs_human: true
blocking_reason: "Deny (2026-10-11) and positive (2026-10-20, platform-root: Available) readback accepted attended. Remaining: catalogue-management restoration before customers (FLEX-IN-0003)."
blocked_on: message-from:access-engine
blocking_reason: "Both readback paths accepted attended (deny 2026-10-11, positive 2026-10-20). Remaining owner work, no human gate: catalogue-management restoration before customers (FLEX-IN-0003, access-engine)."
priority: high
state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
```
2026-10-21: requalified. The human gate is cleared, and what remains is an owner return from access-engine.
2026-10-11: deny-path acceptance recorded; positive-path check stays on the attended-window checklist.
2026-10-20: positive-path acceptance recorded in the attended window (CUST-WP-0079-T06): founder signed in as platform-root (net-kingdom-admins, AAL2 pwd+otp) at users.coulomb.social; "Application access" showed **Informed Decision - Available**. Both readback paths now accepted. Remaining: catalogue-management restoration before customers (FLEX-IN-0003).

6
workplans/USER-WP-0027-account-journey-clarity.md
View file

@ -64,13 +64,13 @@ Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b9
```task
id: USER-WP-0027-T04
status: wait
blocking_reason: "U05-U07 accepted 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md); P04 live recovery (U08) blocked by KEY-WP-0040-T01."
status: done
priority: high
depends_on: [KEY-WP-0040-T01]
state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b"
```
2026-10-21: KEY-WP-0040-T01 is fixed, and P04 live recovery (U08) was accepted attended on 2026-10-20 (USER-WP-0028-T03). U05-U08 are now accepted with a real OTP factor. Done.
2026-10-11: see USER-WP-0028-T03.
2026-10-11: requalified — cef97ccd resolved; live acceptance is an attended-window item. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.

6
workplans/USER-WP-0028-user-journey-acceptance.md
View file

@ -50,13 +50,13 @@ source, entry-point registry, identity/action mapping and mutation contract.
```task
id: USER-WP-0028-T03
status: wait
blocking_reason: "U05-U08 accepted attended (2026-10-11, U08 2026-10-20). Remaining: fix the vague 'sign-in service's recovery instructions' wording on /security (F3)."
status: done
priority: high
depends_on: [KEY-WP-0040-T01]
state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3"
```
2026-10-21: F3 wording fixed. On `/security`, the lost-authenticator help no longer points to non-existent "sign-in service's recovery instructions". It now names the audited administrator recovery and re-enrollment path exercised in U08, and states that there is no self-service bypass. Linking the help from the OTP prompt is key-cape KEY-WP-0040-T02. With U05-U08 accepted, T03 is done.
2026-10-11: attended run done for U05-U07; U08 waits on key-cape KEY-WP-0040-T01. The re-run will need the founder again (attended window).
2026-10-20: U08 accepted in the attended window (CUST-WP-0079-T06), re-run from step 6.3 after KEY-WP-0040-T01: operator platform-root (fresh AAL2) previewed and recovered tegwick's lost factor at /platform/factor-recovery (reference U08-2026-10-20); tegwick re-enrolled TOTP on pink-account via /security and completed a fresh OTP sign-in. Founder-reported all steps pass; no seeds, codes or QR retained. U05-U08 are now accepted. Only F3 (/security recovery-instructions wording) remains.