Record attended MFA run 2026-10-11: U05-U07 accepted, U08 blocked by KEY-WP-0040-T01; correct run doc

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87

docs/evidence/2026-10-11-mfa-attended-u05-u08.md

@@ -0,0 +1,44 @@
+# Attended MFA acceptance run U05–U08 — tegwick — 2026-10-11
+
+Procedure: `docs/mfa-attended-run.md`. Covers USER-WP-0028-T03 and USER-WP-0027-T04 (decision cef97ccd).
+Operator: founder (Bernd Worsch). Coached by: Claude Code. Evidence rules apply: no seeds, QR codes,
+OTP values, passwords, cookies or enrollment screenshots.
+
+| Step | Journey | Time (local) | Client | Outcome |
+|---|---|---|---|---|
+| 0.2 | pre-check | 22:13 | privacyIDEA admin | tegwick@coulomb token count: 0 (operator-reported) |
+| 1 | U05 | 22:16 | coulomb-social | Password-only sign-in succeeded; no OTP prompt. PASS |
+| 0.1 | pre-check | 22:17 | users.coulomb.social/security | "Manage authenticator app" leads to pink-account (confirmed via step 2) |
+| 2 | U06 | 22:17 | portal /security → pink-account | Landed on pink-account; provider asked for password; account shown: tegwick. PASS |
+| 3 | U06 cancel | 22:20 | pink-account | Pending TOTP enrollment deleted before confirmation; no active token shown. PASS |
+| 4 | U06 enroll | 22:22 | pink-account | TOTP enrolled and confirmed with a current code; token active; app label tegwick@coulomb (issuer Coulomb); serial suffix …E1D. PASS |
+| 5a | U07 | 22:2x | coulomb-social | New private browser, password-only: signed in WITHOUT OTP prompt. Expected for current config: KeyCape client coulomb-social has mfaRequired: false (always AAL1; OTP only on acr_values=aal2 step-up). Enrollment-dependent mode (mfaOptional) is wired only for user-engine-portal and vergabe-demo-company (key-cape src/internal/server/policy/policy.go clientModes). Founder confirmed 2026-10-11: intended — coulomb.social must not depend on OTP for now. Run-doc expectation corrected. U07 continues on user-engine-portal |
+| 5b | U07 | 22:30 | user-engine-portal (users.coulomb.social) | Fresh private window: OTP prompt shown after password; wrong code rejected with retry; current code completed sign-in. PASS |
+| 6.1 | U08 | 22:3x | user-engine-portal /security | Lost-authenticator guidance found under "Sign-in security" → "A code is rejected, or I have lost my authenticator": newest code + device time; else provider recovery or tenant administrator; never send password/QR/codes. Guidance correct but not reachable from the OTP prompt — finding F3 |
+| 6.2 | U08 | 22:4x | user-engine-portal /platform/factor-recovery | Operator = platform-root (own OTP, fresh AAL2). Recovery form shown (directory login, support reference, preview, existing-reference check) → platform-root holds platform-operator. Warning text present: verify person first; changes shared identity across apps/tenants; password, tenant access and other factors retained. PASS |
+| 6.3 | U08 | 22:5x | /platform/factor-recovery preview | Login `tegwick`, reference `U08-2026-10-11` (typed by hand, valid per the service's character rule) → "Enter a valid login and support reference." on every attempt (portal log: POST 200 at 20:55–20:57 UTC). Recovery sidecar `mfa/privacyidea` container `factor-recovery` logged nothing. Operator login `platform-root` is plain. **BLOCKED by defect F6** — no factor was disabled; …E1D stays active |
+
+## Outcome
+
+- **U05, U06, U07: accepted.** U07 is accepted on user-engine-portal. coulomb-social is
+  `mfaRequired: false` by founder intent (no OTP dependency for now), so it is not a U07 check.
+  The openbao-admin half of U07 was handed to ops-mason (hub message 36b443ab, MASON-WP-0005-T05).
+- **U08: blocked** by F6 (key-cape KEY-WP-0040-T01). Re-run steps 6.3 onwards after the fix,
+  with platform-root as operator.
+
+## Findings
+
+- **F1:** coulomb.social's session/account details page should link "Manage authenticator app"
+  (pink-account). Owner: coulomb-social (CSOC-WP-0016-T01).
+- **F2:** closed, intended. coulomb-social stays password-only for now.
+- **F3:** the lost-authenticator help on `/security` is not reachable from the KeyCape OTP prompt,
+  and "follow the sign-in service's recovery instructions" names no concrete instructions.
+  Owners: key-cape (prompt link, KEY-WP-0040-T02); user-engine (wording, USER-WP-0028).
+- **F4:** the run doc had the recovery order backwards. The deployed P04 design disables the lost
+  factor first, then the user re-enrolls. Run doc corrected.
+- **F5:** none. platform-root holds platform-operator.
+- **F6:** the recovery preview rejects valid input from a legitimate operator with `invalid_request`
+  and leaves no diagnostics. Valid-input causes in `key-cape/scripts/recovery_service.py` +
+  `factor_recovery.py`: the actor `sub` (KeyCape `user.ID`) or a privacyIDEA serial failing
+  `[A-Za-z0-9_.@:/-]`, or the request body arriving differently than validated. The sidecar must log
+  the failing check (field name only, no values).