coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USER-WP-0028-T03: record founder go for tegwick run and MFA handoff URL
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720
This commit is contained in:
tegwick 2026-10-10 10:20:33 +02:00
parent 80a6204f7e
commit f03d9aaa2b
2 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/mfa-attended-run.md
View file

@ -28,15 +28,18 @@ link.
Not to enroll. Enrollment is per realm, not per client. Joining is needed only Not to enroll. Enrollment is per realm, not per client. Joining is needed only
to observe U05 and U07 on the pilot client, where MFA is optional. On to observe U05 and U07 on the pilot client, where MFA is optional. On
`openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in `openbao-admin`, KeyCape asks every user for an OTP, so password-only sign-in
(U05) cannot be observed there. **Recommendation:** add tegwick to the (U05) cannot be observed there. **Decided (founder, 2026-10-10):** tegwick
coulomb-social pilot if they are not already in it, so all four journeys run on runs on coulomb-social, so all four journeys run on one client. There is no
one client. `openbao-admin` then serves as the second U07 check that ops-mason pilot member list. coulomb-social is a KeyCape client in realm `coulomb`, so
"joining" means tegwick signs in to coulomb-social once (U05). `openbao-admin` then serves as the second U07 check that ops-mason
needs (MASON-WP-0005-T05). needs (MASON-WP-0005-T05).
## Before the run (operator, needs the founder's go) ## Before the run (operator)
1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/` 1. Set `USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/`
in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out. The in net-kingdom `sso-mfa/k8s/user-engine/runtime.yaml` and roll out.
Founder go given 2026-10-10. The change was sent to net-kingdom as hub
message 58e999b3; we wait for its rollout reply. The
portal accepts only a fixed HTTPS URL with no query or credentials. Without portal accepts only a fixed HTTPS URL with no query or credentials. Without
this step, start U06 at the provider URL directly and record that the handoff this step, start U06 at the provider URL directly and record that the handoff
was not exercised. was not exercised.

5
workplans/USER-WP-0028-user-journey-acceptance.md
View file

@ -91,3 +91,8 @@ prepared in docs/mfa-attended-run.md. It covers the start point, the attended
steps, evidence rules (no seeds, codes or QR), the handoff URL and what stays steps, evidence rules (no seeds, codes or QR), the handoff URL and what stays
deferred. It needs the founder's go to set USER_ENGINE_MFA_MANAGEMENT_URL, and deferred. It needs the founder's go to set USER_ENGINE_MFA_MANAGEMENT_URL, and
a decision on whether tegwick joins the coulomb-social pilot. a decision on whether tegwick joins the coulomb-social pilot.
2026-10-10 (later): the founder approved both points. tegwick runs U05-U08 on
coulomb-social; there is no pilot member list, a first sign-in is enough. The
handoff URL change was sent to net-kingdom (hub 58e999b3), env only. Next:
net-kingdom's rollout reply, then the attended run with tegwick.