coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USER-WP-0028-T03: record founder go for tegwick run and MFA handoff URL
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720
This commit is contained in:
tegwick 2026-10-10 10:20:33 +02:00
parent 80a6204f7e
commit f03d9aaa2b
2 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/mfa-attended-run.md
View file

@ -28,15 +28,18 @@ link.
Not to enroll. Enrollment is per realm, not per client. Joining is needed only
to observe U05 and U07 on the pilot client, where MFA is optional. On
`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in
(U05) cannot be observed there. **Recommendation:** add tegwick to the
coulomb-social pilot if they are not already in it, so all four journeys run on
one client. `openbao-admin` then serves as the second U07 check that ops-mason
(U05) cannot be observed there. **Decided (founder, 2026-10-10):** tegwick
runs on coulomb-social, so all four journeys run on one client. There is no
pilot member list. coulomb-social is a KeyCape client in realm `coulomb`, so
"joining" means tegwick signs in to coulomb-social once (U05). `openbao-admin` then serves as the second U07 check that ops-mason
needs (MASON-WP-0005-T05).
## Before the run (operator, needs the founder's go)
## Before the run (operator)
1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/`
in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. The
in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out.
Founder go given 2026-10-10. The change was sent to net-kingdom as hub
message 58e999b3; we wait for its rollout reply. The
portal accepts only a fixed HTTPS URL with no query or credentials. Without
this step, start U06 at the provider URL directly and record that the handoff
was not exercised.