From c460e2b0df1c7b0e2388db0615fc127d10e58052 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 12:41:16 +0200 Subject: [PATCH] USER-WP-0026/0028: record live MFA handoff, apply home and readback T04 values Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 629164@bnt-lap001 Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720 --- docs/mfa-attended-run.md | 12 +++++------- workplans/USER-WP-0026-account-recovery.md | 10 ++++++++++ workplans/USER-WP-0028-user-journey-acceptance.md | 5 +++++ 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/docs/mfa-attended-run.md b/docs/mfa-attended-run.md index 546cc3f..69848a5 100644 --- a/docs/mfa-attended-run.md +++ b/docs/mfa-attended-run.md @@ -36,13 +36,11 @@ needs (MASON-WP-0005-T05). ## Before the run (operator) -1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/` - in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. - Founder go given 2026-10-10. The change was sent to net-kingdom as hub - message 58e999b3; we wait for its rollout reply. The - portal accepts only a fixed HTTPS URL with no query or credentials. Without - this step, start U06 at the provider URL directly and record that the handoff - was not exercised. +1. Done. `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social` + is live. Its apply home is `rapp-user-engine` `manifests/runtime.yaml`; the + net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` is only migration input. + Verified on 2026-10-10: the public `https://users.coulomb.social/security` + shows *Manage authenticator app* pointing to pink-account. 2. Confirm tegwick has no active token: privacyIDEA admin token list for `tegwick@coulomb`, token count only. diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md index 12405e3..d002c2b 100644 --- a/workplans/USER-WP-0026-account-recovery.md +++ b/workplans/USER-WP-0026-account-recovery.md @@ -113,6 +113,16 @@ Remaining before this task is done: access-engine T04 (readback pin values, digest-equality test, founder go), operator-installed readback URL and token file, and a live check against the pin. +2026-10-10: access-engine gave the T04 values (hub 12cefad4), not live yet. +URL `http://flex-auth-application-readback.flex-auth.svc.cluster.local.:8080` +(the trailing dot is required). Projected service-account token audience +`flex-auth`, the same as the /v1/check pin. The admitted caller is +system:serviceaccount:user-engine:user-engine, for readback routes only. The +operator change goes into the apply home, rapp-user-engine +manifests/runtime.yaml: set `USER_ENGINE_READBACK_URL`, mount a second +projected token, and set `USER_ENGINE_READBACK_TOKEN_FILE`. T04 itself waits on +informed-decision accepting lifecycle v2, then the founder go. + ### Live recovery rollout — 2026-09-12 Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993 diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md index 5d6d415..8761f5b 100644 --- a/workplans/USER-WP-0028-user-journey-acceptance.md +++ b/workplans/USER-WP-0028-user-journey-acceptance.md @@ -96,3 +96,8 @@ a decision on whether tegwick joins the coulomb-social pilot. coulomb-social; there is no pilot member list, a first sign-in is enough. The handoff URL change was sent to net-kingdom (hub 58e999b3), env only. Next: net-kingdom's rollout reply, then the attended run with tegwick. + +2026-10-10: net-kingdom replied (7ee2459e) that the handoff URL was already +live from rapp-user-engine manifests/runtime.yaml, the apply home. The net-kingdom +file is migration input only. Public /security verified showing the +pink-account link. Next: the attended run with tegwick.