coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): name the audited recovery path in lost-authenticator help (F3); close U08 follow-ups
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details
Account journey acceptance / journeys (push) Successful in 1m53s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
This commit is contained in:
tegwick 2026-10-21 00:01:47 +02:00
parent 9787cd7523
commit 15c41970a6
5 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

6
workplans/USER-WP-0026-account-recovery.md
View file

@ -62,12 +62,14 @@ logout. This does not accept the remaining multi-user Vergabe pilot.
```task
id: USER-WP-0026-T03
status: wait
needs_human: true
blocking_reason: "Deny (2026-10-11) and positive (2026-10-20, platform-root: Available) readback accepted attended. Remaining: catalogue-management restoration before customers (FLEX-IN-0003)."
blocked_on: message-from:access-engine
blocking_reason: "Both readback paths accepted attended (deny 2026-10-11, positive 2026-10-20). Remaining owner work, no human gate: catalogue-management restoration before customers (FLEX-IN-0003, access-engine)."
priority: high
state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
```
2026-10-21: requalified. The human gate is cleared, and what remains is an owner return from access-engine.
2026-10-11: deny-path acceptance recorded; positive-path check stays on the attended-window checklist.
2026-10-20: positive-path acceptance recorded in the attended window (CUST-WP-0079-T06): founder signed in as platform-root (net-kingdom-admins, AAL2 pwd+otp) at users.coulomb.social; "Application access" showed **Informed Decision - Available**. Both readback paths now accepted. Remaining: catalogue-management restoration before customers (FLEX-IN-0003).

6
workplans/USER-WP-0027-account-journey-clarity.md
View file

@ -64,13 +64,13 @@ Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b9
```task
id: USER-WP-0027-T04
status: wait
blocking_reason: "U05-U07 accepted 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md); P04 live recovery (U08) blocked by KEY-WP-0040-T01."
status: done
priority: high
depends_on: [KEY-WP-0040-T01]
state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b"
```
2026-10-21: KEY-WP-0040-T01 is fixed, and P04 live recovery (U08) was accepted attended on 2026-10-20 (USER-WP-0028-T03). U05-U08 are now accepted with a real OTP factor. Done.
2026-10-11: see USER-WP-0028-T03.
2026-10-11: requalified — cef97ccd resolved; live acceptance is an attended-window item. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.

6
workplans/USER-WP-0028-user-journey-acceptance.md
View file

@ -50,13 +50,13 @@ source, entry-point registry, identity/action mapping and mutation contract.
```task
id: USER-WP-0028-T03
status: wait
blocking_reason: "U05-U08 accepted attended (2026-10-11, U08 2026-10-20). Remaining: fix the vague 'sign-in service's recovery instructions' wording on /security (F3)."
status: done
priority: high
depends_on: [KEY-WP-0040-T01]
state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3"
```
2026-10-21: F3 wording fixed. On `/security`, the lost-authenticator help no longer points to non-existent "sign-in service's recovery instructions". It now names the audited administrator recovery and re-enrollment path exercised in U08, and states that there is no self-service bypass. Linking the help from the OTP prompt is key-cape KEY-WP-0040-T02. With U05-U08 accepted, T03 is done.
2026-10-11: attended run done for U05-U07; U08 waits on key-cape KEY-WP-0040-T01. The re-run will need the founder again (attended window).
2026-10-20: U08 accepted in the attended window (CUST-WP-0079-T06), re-run from step 6.3 after KEY-WP-0040-T01: operator platform-root (fresh AAL2) previewed and recovered tegwick's lost factor at /platform/factor-recovery (reference U08-2026-10-20); tegwick re-enrolled TOTP on pink-account via /security and completed a fresh OTP sign-in. Founder-reported all steps pass; no seeds, codes or QR retained. U05-U08 are now accepted. Only F3 (/security recovery-instructions wording) remains.