From f03d9aaa2bed70c3672732246dbf6aaa2058f7f1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 10:20:33 +0200 Subject: [PATCH] USER-WP-0028-T03: record founder go for tegwick run and MFA handoff URL Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 629164@bnt-lap001 Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720 --- docs/mfa-attended-run.md | 13 ++++++++----- workplans/USER-WP-0028-user-journey-acceptance.md | 5 +++++ 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/docs/mfa-attended-run.md b/docs/mfa-attended-run.md index e023e2e..546cc3f 100644 --- a/docs/mfa-attended-run.md +++ b/docs/mfa-attended-run.md @@ -28,15 +28,18 @@ link. Not to enroll. Enrollment is per realm, not per client. Joining is needed only to observe U05 and U07 on the pilot client, where MFA is optional. On `openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in -(U05) cannot be observed there. **Recommendation:** add tegwick to the -coulomb-social pilot if they are not already in it, so all four journeys run on -one client. `openbao-admin` then serves as the second U07 check that ops-mason +(U05) cannot be observed there. **Decided (founder, 2026-10-10):** tegwick +runs on coulomb-social, so all four journeys run on one client. There is no +pilot member list. coulomb-social is a KeyCape client in realm `coulomb`, so +"joining" means tegwick signs in to coulomb-social once (U05). `openbao-admin` then serves as the second U07 check that ops-mason needs (MASON-WP-0005-T05). -## Before the run (operator, needs the founder's go) +## Before the run (operator) 1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/` - in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. The + in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. + Founder go given 2026-10-10. The change was sent to net-kingdom as hub + message 58e999b3; we wait for its rollout reply. The portal accepts only a fixed HTTPS URL with no query or credentials. Without this step, start U06 at the provider URL directly and record that the handoff was not exercised. diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md index c0aa729..5d6d415 100644 --- a/workplans/USER-WP-0028-user-journey-acceptance.md +++ b/workplans/USER-WP-0028-user-journey-acceptance.md @@ -91,3 +91,8 @@ prepared in docs/mfa-attended-run.md. It covers the start point, the attended steps, evidence rules (no seeds, codes or QR), the handoff URL and what stays deferred. It needs the founder's go to set USER_ENGINE_MFA_MANAGEMENT_URL, and a decision on whether tegwick joins the coulomb-social pilot. + +2026-10-10 (later): the founder approved both points. tegwick runs U05-U08 on +coulomb-social; there is no pilot member list, a first sign-in is enough. The +handoff URL change was sent to net-kingdom (hub 58e999b3), env only. Next: +net-kingdom's rollout reply, then the attended run with tegwick.