USER-WP-0028-T03: prepare attended U05-U08 MFA run for tegwick

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720

docs/mfa-attended-run.md

@@ -0,0 +1,86 @@
+# Attended MFA acceptance run: U05–U08, first real user tegwick
+
+Prepared 2026-10-10 for the founder request relayed by ops-mason (hub message
+ab89a591). It covers USER-WP-0028-T03 and USER-WP-0027-T04 and is gated by hub
+decision cef97ccd (D10). The pilot is set in [mfa-pilot-decision.md](mfa-pilot-decision.md).
+
+## What already exists
+
+- **Enrollment surface.** privacyIDEA self-service runs at
+  `https://pink-account.coulomb.social/` (net-kingdom `sso-mfa/k8s/privacyidea`).
+  Realm `coulomb` resolves every LLDAP user. Policy `totp-self-enrollment` lets
+  any user in that realm enroll, delete or disable their own TOTP token. Tokens
+  are labelled `{user}@{realm}` and issued as `Coulomb`, so the app shows
+  `tegwick@coulomb`.
+- **Portal guidance.** `/security` explains setup, cancellation, a rejected
+  code and a lost authenticator. It also covers the no-factor-yet case. Until
+  `USER_ENGINE_MFA_MANAGEMENT_URL` is set, it says setup is unavailable and
+  points to the tenant administrator.
+- **Recovery and replacement.** P04 recovery and P06 policy are deployed and
+  were verified with installed-provider fixtures
+  ([P06 evidence](evidence/2026-09-13-p06-authentication-policy.md)).
+
+What is missing is a real person going through it, plus the portal handoff
+link.
+
+## Does tegwick need to join the coulomb-social pilot?
+
+Not to enroll. Enrollment is per realm, not per client. Joining is needed only
+to observe U05 and U07 on the pilot client, where MFA is optional. On
+`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in
+(U05) cannot be observed there. **Recommendation:** add tegwick to the
+coulomb-social pilot if they are not already in it, so all four journeys run on
+one client. `openbao-admin` then serves as the second U07 check that ops-mason
+needs (MASON-WP-0005-T05).
+
+## Before the run (operator, needs the founder's go)
+
+1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/`
+   in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. The
+   portal accepts only a fixed HTTPS URL with no query or credentials. Without
+   this step, start U06 at the provider URL directly and record that the handoff
+   was not exercised.
+2. Confirm tegwick has no active token: privacyIDEA admin token list for
+   `tegwick@coulomb`, token count only.
+
+## Attended steps (tegwick at the keyboard, operator observing)
+
+| Step | Journey | Where | Expected | Record |
+| --- | --- | --- | --- | --- |
+| 1 | U05 | coulomb-social sign-in | Password-only sign-in succeeds; no OTP prompt | time, client, outcome |
+| 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) |
+| 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome |
+| 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status |
+| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client |
+| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome |
+
+Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick
+has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later.
+
+## Evidence rules
+
+Record times, outcomes, client ids, token serial suffixes and recovery record
+ids in `docs/evidence/<date>-mfa-attended-u05-u08.md`. **Never** record a seed,
+a QR code or image, an OTP value, a password or a session cookie, and do not
+take screenshots of the enrollment page. No step is inferred from a redirect,
+a return parameter or an assurance claim.
+
+## After acceptance
+
+Keep `USER_ENGINE_MFA_MANAGEMENT_URL` set for all users. It covers every LLDAP
+user in realm `coulomb` and every KeyCape client, because enrollment does not
+depend on the client. MFA stays optional except where KeyCape already asks for
+it (`openbao-admin`).
+
+Still deferred:
+
+- admin-required MFA, which would be an issuer-side client policy applied
+  through P06 and needs the founder's go;
+- showing authoritative enrollment status in the portal;
+- a link from KeyCape's OTP prompt to `/security` for users who have no factor
+  yet. That page belongs to key-cape, and today it is the dead end tegwick hit.
+
+## Hand-off
+
+USER-WP-0028-T03, USER-WP-0027-T04 and decision cef97ccd close only on the
+recorded evidence.