From 15c41970a619c110807fca596f1a427caf930504 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 21 Oct 2026 00:01:47 +0200 Subject: [PATCH] fix(security): name the audited recovery path in lost-authenticator help (F3); close U08 follow-ups Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 527080@bnt-lap001 Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292 --- WORK-RECORDS.md | 4 ++-- src/user_engine/web.py | 2 +- workplans/USER-WP-0026-account-recovery.md | 6 ++++-- workplans/USER-WP-0027-account-journey-clarity.md | 6 +++--- workplans/USER-WP-0028-user-journey-acceptance.md | 6 +++--- 5 files changed, 13 insertions(+), 11 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index db4f905..348aecb 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -209,12 +209,12 @@ | task | USER-WP-0027-T01 | done | — | workplans/USER-WP-0027-account-journey-clarity.md | | task | USER-WP-0027-T02 | done | — | workplans/USER-WP-0027-account-journey-clarity.md | | task | USER-WP-0027-T03 | done | — | workplans/USER-WP-0027-account-journey-clarity.md | -| task | USER-WP-0027-T04 | wait | — | workplans/USER-WP-0027-account-journey-clarity.md | +| task | USER-WP-0027-T04 | done | — | workplans/USER-WP-0027-account-journey-clarity.md | | task | USER-WP-0027-T05 | done | — | workplans/USER-WP-0027-account-journey-clarity.md | | task | USER-WP-0027-T06 | wait | — | workplans/USER-WP-0027-account-journey-clarity.md | | task | USER-WP-0028-T01 | done | — | workplans/USER-WP-0028-user-journey-acceptance.md | | task | USER-WP-0028-T02 | wait | — | workplans/USER-WP-0028-user-journey-acceptance.md | -| task | USER-WP-0028-T03 | wait | — | workplans/USER-WP-0028-user-journey-acceptance.md | +| task | USER-WP-0028-T03 | done | — | workplans/USER-WP-0028-user-journey-acceptance.md | | task | USER-WP-0029-T01 | done | — | workplans/USER-WP-0029-tenant-admin-journeys.md | | task | USER-WP-0029-T02 | done | — | workplans/USER-WP-0029-tenant-admin-journeys.md | | task | USER-WP-0029-T03 | done | — | workplans/USER-WP-0029-tenant-admin-journeys.md | diff --git a/src/user_engine/web.py b/src/user_engine/web.py index 7b338fa..1e35150 100644 --- a/src/user_engine/web.py +++ b/src/user_engine/web.py @@ -1990,7 +1990,7 @@ This account site cannot currently confirm whether an authenticator is enabled f

Opening the setup page does not activate two-step verification. To cancel unfinished setup, open All Tokens, select the pending token, and choose Delete. A confirmed authenticator cannot be removed or replaced from this password-only management session; ask your administrator to use audited authenticator recovery.

A code is rejected, or I have lost my authenticator

Use the newest code for the correct account and check that your device sets its time automatically. -If you cannot use your authenticator, follow the sign-in service's recovery instructions or ask your tenant administrator for account recovery. +If you cannot use your authenticator, ask your tenant administrator for audited authenticator recovery. They confirm your identity and remove the lost authenticator; you then sign in with your password and set up a new one here. There is no self-service bypass. Never send your password, QR code, or verification codes to an administrator.

Password help

Use password recovery on the sign-in page. If the recovery message does not arrive, ask your tenant administrator for a new password setup link. diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md index 52fa365..1aaa5ff 100644 --- a/workplans/USER-WP-0026-account-recovery.md +++ b/workplans/USER-WP-0026-account-recovery.md @@ -62,12 +62,14 @@ logout. This does not accept the remaining multi-user Vergabe pilot. ```task id: USER-WP-0026-T03 status: wait -needs_human: true -blocking_reason: "Deny (2026-10-11) and positive (2026-10-20, platform-root: Available) readback accepted attended. Remaining: catalogue-management restoration before customers (FLEX-IN-0003)." +blocked_on: message-from:access-engine +blocking_reason: "Both readback paths accepted attended (deny 2026-10-11, positive 2026-10-20). Remaining owner work, no human gate: catalogue-management restoration before customers (FLEX-IN-0003, access-engine)." priority: high state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767" ``` +2026-10-21: requalified. The human gate is cleared, and what remains is an owner return from access-engine. + 2026-10-11: deny-path acceptance recorded; positive-path check stays on the attended-window checklist. 2026-10-20: positive-path acceptance recorded in the attended window (CUST-WP-0079-T06): founder signed in as platform-root (net-kingdom-admins, AAL2 pwd+otp) at users.coulomb.social; "Application access" showed **Informed Decision - Available**. Both readback paths now accepted. Remaining: catalogue-management restoration before customers (FLEX-IN-0003). diff --git a/workplans/USER-WP-0027-account-journey-clarity.md b/workplans/USER-WP-0027-account-journey-clarity.md index 286cfda..3ef485b 100644 --- a/workplans/USER-WP-0027-account-journey-clarity.md +++ b/workplans/USER-WP-0027-account-journey-clarity.md @@ -64,13 +64,13 @@ Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b9 ```task id: USER-WP-0027-T04 -status: wait -blocking_reason: "U05-U07 accepted 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md); P04 live recovery (U08) blocked by KEY-WP-0040-T01." +status: done priority: high -depends_on: [KEY-WP-0040-T01] state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b" ``` +2026-10-21: KEY-WP-0040-T01 is fixed, and P04 live recovery (U08) was accepted attended on 2026-10-20 (USER-WP-0028-T03). U05-U08 are now accepted with a real OTP factor. Done. + 2026-10-11: see USER-WP-0028-T03. 2026-10-11: requalified — cef97ccd resolved; live acceptance is an attended-window item. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md. diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md index 9c72dd9..8b38ae1 100644 --- a/workplans/USER-WP-0028-user-journey-acceptance.md +++ b/workplans/USER-WP-0028-user-journey-acceptance.md @@ -50,13 +50,13 @@ source, entry-point registry, identity/action mapping and mutation contract. ```task id: USER-WP-0028-T03 -status: wait -blocking_reason: "U05-U08 accepted attended (2026-10-11, U08 2026-10-20). Remaining: fix the vague 'sign-in service's recovery instructions' wording on /security (F3)." +status: done priority: high -depends_on: [KEY-WP-0040-T01] state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3" ``` +2026-10-21: F3 wording fixed. On `/security`, the lost-authenticator help no longer points to non-existent "sign-in service's recovery instructions". It now names the audited administrator recovery and re-enrollment path exercised in U08, and states that there is no self-service bypass. Linking the help from the OTP prompt is key-cape KEY-WP-0040-T02. With U05-U08 accepted, T03 is done. + 2026-10-11: attended run done for U05-U07; U08 waits on key-cape KEY-WP-0040-T01. The re-run will need the founder again (attended window). 2026-10-20: U08 accepted in the attended window (CUST-WP-0079-T06), re-run from step 6.3 after KEY-WP-0040-T01: operator platform-root (fresh AAL2) previewed and recovered tegwick's lost factor at /platform/factor-recovery (reference U08-2026-10-20); tegwick re-enrolled TOTP on pink-account via /security and completed a fresh OTP sign-in. Founder-reported all steps pass; no seeds, codes or QR retained. U05-U08 are now accepted. Only F3 (/security recovery-instructions wording) remains.