coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USER-WP-0026/0028: record live MFA handoff, apply home and readback T04 values
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720
This commit is contained in:
tegwick 2026-10-10 12:41:16 +02:00
parent f03d9aaa2b
commit c460e2b0df
3 changed files with 20 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/mfa-attended-run.md
View file

@ -36,13 +36,11 @@ needs (MASON-WP-0005-T05).
## Before the run (operator)
1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/`
in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out.
Founder go given 2026-10-10. The change was sent to net-kingdom as hub
message 58e999b3; we wait for its rollout reply. The
portal accepts only a fixed HTTPS URL with no query or credentials. Without
this step, start U06 at the provider URL directly and record that the handoff
was not exercised.
1. Done. `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social`
is live. Its apply home is `rapp-user-engine` `manifests/runtime.yaml`; the
net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` is only migration input.
Verified on 2026-10-10: the public `https://users.coulomb.social/security`
shows *Manage authenticator app* pointing to pink-account.
2. Confirm tegwick has no active token: privacyIDEA admin token list for
`tegwick@coulomb`, token count only.

10
workplans/USER-WP-0026-account-recovery.md
View file

@ -113,6 +113,16 @@ Remaining before this task is done: access-engine T04 (readback pin values,
digest-equality test, founder go), operator-installed readback URL and token
file, and a live check against the pin.
2026-10-10: access-engine gave the T04 values (hub 12cefad4), not live yet.
URL `http://flex-auth-application-readback.flex-auth.svc.cluster.local.:8080`
(the trailing dot is required). Projected service-account token audience
`flex-auth`, the same as the /v1/check pin. The admitted caller is
system:serviceaccount:user-engine:user-engine, for readback routes only. The
operator change goes into the apply home, rapp-user-engine
manifests/runtime.yaml: set `USER_ENGINE_READBACK_URL`, mount a second
projected token, and set `USER_ENGINE_READBACK_TOKEN_FILE`. T04 itself waits on
informed-decision accepting lifecycle v2, then the founder go.
### Live recovery rollout — 2026-09-12
Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993

5
workplans/USER-WP-0028-user-journey-acceptance.md
View file

@ -96,3 +96,8 @@ a decision on whether tegwick joins the coulomb-social pilot.
coulomb-social; there is no pilot member list, a first sign-in is enough. The
handoff URL change was sent to net-kingdom (hub 58e999b3), env only. Next:
net-kingdom's rollout reply, then the attended run with tegwick.
2026-10-10: net-kingdom replied (7ee2459e) that the handoff URL was already
live from rapp-user-engine manifests/runtime.yaml, the apply home. The net-kingdom
file is migration input only. Public /security verified showing the
pink-account link. Next: the attended run with tegwick.