From cd33bed0f0a7acb98f903b08379eaa156fafea3c Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 20 Oct 2026 09:35:24 +0200 Subject: [PATCH 1/2] USER-WP-0026-T03: record attended positive readback (Available) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 527080@bnt-lap001 Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292 --- workplans/USER-WP-0026-account-recovery.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md index 4d567c8..52fa365 100644 --- a/workplans/USER-WP-0026-account-recovery.md +++ b/workplans/USER-WP-0026-account-recovery.md @@ -63,13 +63,15 @@ logout. This does not accept the remaining multi-user Vergabe pilot. id: USER-WP-0026-T03 status: wait needs_human: true -blocking_reason: "Signed-in readback live and correct for the deny path (tegwick: Informed Decision - Not available, founder-confirmed correct; docs/evidence/2026-10-11-signed-in-application-readback.md). Remaining: attended positive check with a net-kingdom-admins account (expect Available), then catalogue-management restoration before customers (FLEX-IN-0003)." +blocking_reason: "Deny (2026-10-11) and positive (2026-10-20, platform-root: Available) readback accepted attended. Remaining: catalogue-management restoration before customers (FLEX-IN-0003)." priority: high state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767" ``` 2026-10-11: deny-path acceptance recorded; positive-path check stays on the attended-window checklist. +2026-10-20: positive-path acceptance recorded in the attended window (CUST-WP-0079-T06): founder signed in as platform-root (net-kingdom-admins, AAL2 pwd+otp) at users.coulomb.social; "Application access" showed **Informed Decision - Available**. Both readback paths now accepted. Remaining: catalogue-management restoration before customers (FLEX-IN-0003). + The requested cross-application allow list is not represented by the current User Engine membership store. Establish a provider-owned workload catalogue and read current application access decisions for the signed-in identity. Link only From 9787cd752358d532f361460b18c4e05f5d3dbef6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 20 Oct 2026 09:45:36 +0200 Subject: [PATCH 2/2] USER-WP-0028-T03: record attended U08 recovery acceptance Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 527080@bnt-lap001 Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292 --- workplans/USER-WP-0028-user-journey-acceptance.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md index 17834e2..9c72dd9 100644 --- a/workplans/USER-WP-0028-user-journey-acceptance.md +++ b/workplans/USER-WP-0028-user-journey-acceptance.md @@ -51,7 +51,7 @@ source, entry-point registry, identity/action mapping and mutation contract. ```task id: USER-WP-0028-T03 status: wait -blocking_reason: "U05-U07 accepted in the attended run of 2026-10-11 (docs/evidence/2026-10-11-mfa-attended-u05-u08.md). U08 blocked by the recovery-preview defect KEY-WP-0040-T01; re-run steps 6.3 onwards after the fix with platform-root as operator. Also fix the vague 'sign-in service's recovery instructions' wording on /security (F3)." +blocking_reason: "U05-U08 accepted attended (2026-10-11, U08 2026-10-20). Remaining: fix the vague 'sign-in service's recovery instructions' wording on /security (F3)." priority: high depends_on: [KEY-WP-0040-T01] state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3" @@ -59,6 +59,8 @@ state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3" 2026-10-11: attended run done for U05-U07; U08 waits on key-cape KEY-WP-0040-T01. The re-run will need the founder again (attended window). +2026-10-20: U08 accepted in the attended window (CUST-WP-0079-T06), re-run from step 6.3 after KEY-WP-0040-T01: operator platform-root (fresh AAL2) previewed and recovered tegwick's lost factor at /platform/factor-recovery (reference U08-2026-10-20); tegwick re-enrolled TOTP on pink-account via /security and completed a fresh OTP sign-in. Founder-reported all steps pass; no seeds, codes or QR retained. U05-U08 are now accepted. Only F3 (/security recovery-instructions wording) remains. + 2026-10-11: requalified — cef97ccd resolved; live acceptance is an attended-window item. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md. 2026-10-03: depends_on targets terminal (C-40); re-qualified by CUST-WP-0075: KEY-WP-0035 and NK-WP-0033 are both finished (custody gap closed 2026-09-23), so credential custody is no longer the gate. What remains is attended live acceptance of U05-U08 with a real OTP factor; see USER-WP-0027-T04 for the still-unresolvable net-kingdom-privacyidea-admin-token route (owner railiance-platform).