coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record MFA pilot decision: coulomb-social, optional, NetKingdom-held
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 445231@bnt-lap001
Assistant-Session: 024a807e-0cc5-4f2c-bc8a-b83322d1395d
This commit is contained in:
tegwick 2026-10-09 11:58:45 +02:00
parent fd9ec559f5
commit 2edb4f1e43
2 changed files with 44 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

37
docs/mfa-pilot-decision.md Normal file
View file

@ -0,0 +1,37 @@
# MFA pilot: coulomb-social, optional, NetKingdom-held — 2026-10-09
Founder decision (Bernd, 2026-10-09). It answers the pilot and policy part of
NK-WP-0042-T02 (hub thread 892fd489). It does not resolve decision cef97ccd: user-perspective acceptance of the MFA journey still
needs the attended run (USER-WP-0027-T04, USER-WP-0028-T03).
## Decision
1. **Pilot workload:** coulomb-social.
2. **MFA code stays in NetKingdom infrastructure.** Enrollment, verification,
replacement, recovery, and the policy that requires MFA live with the issuer
(KeyCape / Keycloak, the provider factor) and user-engine (`/security`, the
provider-management handoff, P04 recovery, P06 policy). coulomb-social does
not gain factor, enrollment, recovery, or MFA policy code. It stays a plain
OIDC relying party.
3. **MFA is optional for coulomb-social users.** Password-only sign-in stays
valid (U05). Users may enroll voluntarily through the NetKingdom path (U06).
Once a user has enrolled, the issuer enforces their factor (U07).
4. **Admin-required MFA is deferred, not urgent.** When a coulomb-social admin
later wants MFA required for users, it will be an issuer-side client policy
applied through the NetKingdom admin surface (P06 preview/apply/rollback). It
will not be a coulomb-social code path. Turning it on is a separate change that
needs the founder's go.
## Consequences
- No `acr_values=aal2` switch-on for coulomb-social now. Under optional MFA,
coulomb-social requests no assurance level.
- coulomb-social already contains a dormant relying-party hook
(`?assurance=aal2` → `acr_values`, plus a local acr check in
`apps/identity/views.py`). Nothing links to it. Whether to keep it dormant or
remove it is coulomb-social's call. The issuer-side policy route in (4) does
not need it.
- coulomb-social may link users to the NetKingdom `/security` page for
optional enrollment and recovery help. That link is navigation, not MFA logic.
- This narrows the SCOPE line "action step-up — consuming apps": for this
pilot, step-up sits with KeyCape client policy.

7
workplans/USER-WP-0028-user-journey-acceptance.md
View file

@ -77,3 +77,10 @@ portal setup handoff, not another service token. See USER-WP-0027-T04 and
`docs/evidence/2026-09-13-p06-authentication-policy.md`.
2026-10-03: human gate routed to hub decision cef97ccd-4ee7-40fe-859e-1df9c9360ecb (D10: Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience) by CUST-WP-0075; resolving that decision raises C-40 here.
2026-10-09: founder chose coulomb-social as the MFA pilot (docs/mfa-pilot-decision.md).
MFA stays optional there, and all MFA code stays in NetKingdom infrastructure:
the issuer plus user-engine. Admin-required MFA is deferred and would be an
issuer-side client policy. The attended run accepts U05-U08 for a coulomb-social user:
optional enrollment, then return, then lost-factor recovery. cef97ccd stays open for
that acceptance.