From f1ed086da0a61db084470aeeef6c58445ef7bd98 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 23:02:23 +0200 Subject: [PATCH] Record attended MFA run 2026-10-11: U05-U07 accepted, U08 blocked by KEY-WP-0040-T01; correct run doc Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1370019@bnt-lap001 Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87 --- .../2026-10-11-mfa-attended-u05-u08.md | 44 +++++++++++++++++++ docs/mfa-attended-run.md | 8 +++- .../USER-WP-0027-account-journey-clarity.md | 6 ++- .../USER-WP-0028-user-journey-acceptance.md | 6 ++- 4 files changed, 58 insertions(+), 6 deletions(-) create mode 100644 docs/evidence/2026-10-11-mfa-attended-u05-u08.md diff --git a/docs/evidence/2026-10-11-mfa-attended-u05-u08.md b/docs/evidence/2026-10-11-mfa-attended-u05-u08.md new file mode 100644 index 0000000..ec10dbc --- /dev/null +++ b/docs/evidence/2026-10-11-mfa-attended-u05-u08.md @@ -0,0 +1,44 @@ +# Attended MFA acceptance run U05–U08 — tegwick — 2026-10-11 + +Procedure: `docs/mfa-attended-run.md`. Covers USER-WP-0028-T03 and USER-WP-0027-T04 (decision cef97ccd). +Operator: founder (Bernd Worsch). Coached by: Claude Code. Evidence rules apply: no seeds, QR codes, +OTP values, passwords, cookies or enrollment screenshots. + +| Step | Journey | Time (local) | Client | Outcome | +|---|---|---|---|---| +| 0.2 | pre-check | 22:13 | privacyIDEA admin | tegwick@coulomb token count: 0 (operator-reported) | +| 1 | U05 | 22:16 | coulomb-social | Password-only sign-in succeeded; no OTP prompt. PASS | +| 0.1 | pre-check | 22:17 | users.coulomb.social/security | "Manage authenticator app" leads to pink-account (confirmed via step 2) | +| 2 | U06 | 22:17 | portal /security → pink-account | Landed on pink-account; provider asked for password; account shown: tegwick. PASS | +| 3 | U06 cancel | 22:20 | pink-account | Pending TOTP enrollment deleted before confirmation; no active token shown. PASS | +| 4 | U06 enroll | 22:22 | pink-account | TOTP enrolled and confirmed with a current code; token active; app label tegwick@coulomb (issuer Coulomb); serial suffix …E1D. PASS | +| 5a | U07 | 22:2x | coulomb-social | New private browser, password-only: signed in WITHOUT OTP prompt. Expected for current config: KeyCape client coulomb-social has mfaRequired: false (always AAL1; OTP only on acr_values=aal2 step-up). Enrollment-dependent mode (mfaOptional) is wired only for user-engine-portal and vergabe-demo-company (key-cape src/internal/server/policy/policy.go clientModes). Founder confirmed 2026-10-11: intended — coulomb.social must not depend on OTP for now. Run-doc expectation corrected. U07 continues on user-engine-portal | +| 5b | U07 | 22:30 | user-engine-portal (users.coulomb.social) | Fresh private window: OTP prompt shown after password; wrong code rejected with retry; current code completed sign-in. PASS | +| 6.1 | U08 | 22:3x | user-engine-portal /security | Lost-authenticator guidance found under "Sign-in security" → "A code is rejected, or I have lost my authenticator": newest code + device time; else provider recovery or tenant administrator; never send password/QR/codes. Guidance correct but not reachable from the OTP prompt — finding F3 | +| 6.2 | U08 | 22:4x | user-engine-portal /platform/factor-recovery | Operator = platform-root (own OTP, fresh AAL2). Recovery form shown (directory login, support reference, preview, existing-reference check) → platform-root holds platform-operator. Warning text present: verify person first; changes shared identity across apps/tenants; password, tenant access and other factors retained. PASS | +| 6.3 | U08 | 22:5x | /platform/factor-recovery preview | Login `tegwick`, reference `U08-2026-10-11` (typed by hand, valid per the service's character rule) → "Enter a valid login and support reference." on every attempt (portal log: POST 200 at 20:55–20:57 UTC). Recovery sidecar `mfa/privacyidea` container `factor-recovery` logged nothing. Operator login `platform-root` is plain. **BLOCKED by defect F6** — no factor was disabled; …E1D stays active | + +## Outcome + +- **U05, U06, U07: accepted.** U07 is accepted on user-engine-portal. coulomb-social is + `mfaRequired: false` by founder intent (no OTP dependency for now), so it is not a U07 check. + The openbao-admin half of U07 was handed to ops-mason (hub message 36b443ab, MASON-WP-0005-T05). +- **U08: blocked** by F6 (key-cape KEY-WP-0040-T01). Re-run steps 6.3 onwards after the fix, + with platform-root as operator. + +## Findings + +- **F1:** coulomb.social's session/account details page should link "Manage authenticator app" + (pink-account). Owner: coulomb-social (CSOC-WP-0016-T01). +- **F2:** closed, intended. coulomb-social stays password-only for now. +- **F3:** the lost-authenticator help on `/security` is not reachable from the KeyCape OTP prompt, + and "follow the sign-in service's recovery instructions" names no concrete instructions. + Owners: key-cape (prompt link, KEY-WP-0040-T02); user-engine (wording, USER-WP-0028). +- **F4:** the run doc had the recovery order backwards. The deployed P04 design disables the lost + factor first, then the user re-enrolls. Run doc corrected. +- **F5:** none. platform-root holds platform-operator. +- **F6:** the recovery preview rejects valid input from a legitimate operator with `invalid_request` + and leaves no diagnostics. Valid-input causes in `key-cape/scripts/recovery_service.py` + + `factor_recovery.py`: the actor `sub` (KeyCape `user.ID`) or a privacyIDEA serial failing + `[A-Za-z0-9_.@:/-]`, or the request body arriving differently than validated. The sidecar must log + the failing check (field name only, no values). diff --git a/docs/mfa-attended-run.md b/docs/mfa-attended-run.md index 69848a5..8b6b52e 100644 --- a/docs/mfa-attended-run.md +++ b/docs/mfa-attended-run.md @@ -52,12 +52,16 @@ needs (MASON-WP-0005-T05). | 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) | | 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome | | 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status | -| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client | -| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome | +| 5 | U07 | close **all** private windows, new one, users.coulomb.social (user-engine-portal, enrollment-dependent MFA), then `openbao-admin` (ops-mason, CLI via tunnel) | OTP is asked and a current code completes sign-in; a wrong code is retried | outcome per client | +| 6 | U08 | portal `/security` → lost-authenticator guidance; operator (platform-root, own fresh MFA) uses `/platform/factor-recovery` (P04) | Operator disables the lost factor first (audited, attested); the user then re-enrolls on pink-account and proves a fresh login; no bypass link | recovery record id, outcome | Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later. +> 2026-10-11 corrections after the first run: coulomb-social is `mfaRequired: false` by founder +> intent and never asks for OTP, so U07 runs on user-engine-portal. The P04 order is disable first, +> then re-enroll. See `docs/evidence/2026-10-11-mfa-attended-u05-u08.md`. + ## Evidence rules Record times, outcomes, client ids, token serial suffixes and recovery record diff --git a/workplans/USER-WP-0027-account-journey-clarity.md b/workplans/USER-WP-0027-account-journey-clarity.md index ca2413d..286cfda 100644 --- a/workplans/USER-WP-0027-account-journey-clarity.md +++ b/workplans/USER-WP-0027-account-journey-clarity.md @@ -65,12 +65,14 @@ Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b9 ```task id: USER-WP-0027-T04 status: wait -needs_human: true -blocking_reason: "Attended-window item: founder real-factor run of U05-U08/P04-P06. UX accepted in principle (cef97ccd); findings become defects." +blocking_reason: "U05-U07 accepted 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md); P04 live recovery (U08) blocked by KEY-WP-0040-T01." priority: high +depends_on: [KEY-WP-0040-T01] state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b" ``` +2026-10-11: see USER-WP-0028-T03. + 2026-10-11: requalified — cef97ccd resolved; live acceptance is an attended-window item. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md. 2026-10-03: depends_on targets terminal (C-40); re-qualified by CUST-WP-0075: KEY-WP-0035-T02/T03 are done (2026-09-13 custody activation superseded the owner-handoff gate) and NK-WP-0033 finished 2026-09-23 with the custody gap closed, so no owner return is outstanding from key-cape or net-kingdom. What remains is attended: live U05-U08/P04-P06 acceptance with a real OTP factor, and the net-kingdom-privacyidea-admin-token route still reports resolvable:false (owner railiance-platform, custody contract unpublished). diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md index b11ce3c..17834e2 100644 --- a/workplans/USER-WP-0028-user-journey-acceptance.md +++ b/workplans/USER-WP-0028-user-journey-acceptance.md @@ -51,12 +51,14 @@ source, entry-point registry, identity/action mapping and mutation contract. ```task id: USER-WP-0028-T03 status: wait -needs_human: true -blocking_reason: "Attended-window item: founder real-factor run of U05-U08. UX accepted in principle (cef97ccd); findings become defects." +blocking_reason: "U05-U07 accepted in the attended run of 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md). U08 blocked by the recovery-preview defect KEY-WP-0040-T01; re-run steps 6.3 onwards after the fix with platform-root as operator. Also fix the vague 'sign-in service's recovery instructions' wording on /security (F3)." priority: high +depends_on: [KEY-WP-0040-T01] state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3" ``` +2026-10-11: attended run done for U05-U07; U08 waits on key-cape KEY-WP-0040-T01. The re-run will need the founder again (attended window). + 2026-10-11: requalified — cef97ccd resolved; live acceptance is an attended-window item. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md. 2026-10-03: depends_on targets terminal (C-40); re-qualified by CUST-WP-0075: KEY-WP-0035 and NK-WP-0033 are both finished (custody gap closed 2026-09-23), so credential custody is no longer the gate. What remains is attended live acceptance of U05-U08 with a real OTP factor; see USER-WP-0027-T04 for the still-unresolvable net-kingdom-privacyidea-admin-token route (owner railiance-platform).