coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record attended MFA run 2026-10-11: U05-U07 accepted, U08 blocked by KEY-WP-0040-T01; correct run doc
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
This commit is contained in:
tegwick 2026-10-11 23:02:23 +02:00
parent 2a2de76dfa
commit f1ed086da0
4 changed files with 58 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/mfa-attended-run.md
View file

@ -52,12 +52,16 @@ needs (MASON-WP-0005-T05).
| 2 | U06 | portal `/security` → *Manage authenticator app* | Lands on pink-account; provider asks for the password; account shown is `tegwick` | time, account name seen (yes/no) |
| 3 | U06 cancel | pink-account → Enroll TOTP, then delete the pending token | Pending token removed; nothing reports enabled | outcome |
| 4 | U06 | pink-account → Enroll TOTP, scan, confirm with a current code | Token active; label `tegwick@coulomb` | token serial suffix only, status |
| 5 | U07 | new private window, coulomb-social, then `openbao-admin` | OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP | outcome per client |
| 6 | U08 | portal `/security` → recovery route; operator uses audited recovery (P04) | Replacement is verified before the old factor is removed; no bypass link | recovery record id, outcome |
| 5 | U07 | close **all** private windows, new one, users.coulomb.social (user-engine-portal, enrollment-dependent MFA), then `openbao-admin` (ops-mason, CLI via tunnel) | OTP is asked and a current code completes sign-in; a wrong code is retried | outcome per client |
| 6 | U08 | portal `/security` → lost-authenticator guidance; operator (platform-root, own fresh MFA) uses `/platform/factor-recovery` (P04) | Operator disables the lost factor first (audited, attested); the user then re-enrolls on pink-account and proves a fresh login; no bypass link | recovery record id, outcome |
Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick
has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later.
> 2026-10-11 corrections after the first run: coulomb-social is `mfaRequired: false` by founder
> intent and never asks for OTP, so U07 runs on user-engine-portal. The P04 order is disable first,
> then re-enroll. See `docs/evidence/2026-10-11-mfa-attended-u05-u08.md`.
## Evidence rules
Record times, outcomes, client ids, token serial suffixes and recovery record