user-engine/docs/evidence/2026-10-11-mfa-attended-u05-u08.md

Attended MFA acceptance run U05–U08 — tegwick — 2026-10-11

Procedure: docs/mfa-attended-run.md. Covers USER-WP-0028-T03 and USER-WP-0027-T04 (decision cef97ccd). Operator: founder (Bernd Worsch). Coached by: Claude Code. Evidence rules apply: no seeds, QR codes, OTP values, passwords, cookies or enrollment screenshots.

Step	Journey	Time (local)	Client	Outcome
0.2	pre-check	22:13	privacyIDEA admin	tegwick@coulomb token count: 0 (operator-reported)
1	U05	22:16	coulomb-social	Password-only sign-in succeeded; no OTP prompt. PASS
0.1	pre-check	22:17	users.coulomb.social/security	"Manage authenticator app" leads to pink-account (confirmed via step 2)
2	U06	22:17	portal /security → pink-account	Landed on pink-account; provider asked for password; account shown: tegwick. PASS
3	U06 cancel	22:20	pink-account	Pending TOTP enrollment deleted before confirmation; no active token shown. PASS
4	U06 enroll	22:22	pink-account	TOTP enrolled and confirmed with a current code; token active; app label tegwick@coulomb (issuer Coulomb); serial suffix …E1D. PASS
5a	U07	22:2x	coulomb-social	New private browser, password-only: signed in WITHOUT OTP prompt. Expected for current config: KeyCape client coulomb-social has mfaRequired: false (always AAL1; OTP only on acr_values=aal2 step-up). Enrollment-dependent mode (mfaOptional) is wired only for user-engine-portal and vergabe-demo-company (key-cape src/internal/server/policy/policy.go clientModes). Founder confirmed 2026-10-11: intended — coulomb.social must not depend on OTP for now. Run-doc expectation corrected. U07 continues on user-engine-portal
5b	U07	22:30	user-engine-portal (users.coulomb.social)	Fresh private window: OTP prompt shown after password; wrong code rejected with retry; current code completed sign-in. PASS
6.1	U08	22:3x	user-engine-portal /security	Lost-authenticator guidance found under "Sign-in security" → "A code is rejected, or I have lost my authenticator": newest code + device time; else provider recovery or tenant administrator; never send password/QR/codes. Guidance correct but not reachable from the OTP prompt — finding F3
6.2	U08	22:4x	user-engine-portal /platform/factor-recovery	Operator = platform-root (own OTP, fresh AAL2). Recovery form shown (directory login, support reference, preview, existing-reference check) → platform-root holds platform-operator. Warning text present: verify person first; changes shared identity across apps/tenants; password, tenant access and other factors retained. PASS
6.3	U08	22:5x	/platform/factor-recovery preview	Login tegwick, reference U08-2026-10-11 (typed by hand, valid per the service's character rule) → "Enter a valid login and support reference." on every attempt (portal log: POST 200 at 20:55–20:57 UTC). Recovery sidecar mfa/privacyidea container factor-recovery logged nothing. Operator login platform-root is plain. BLOCKED by defect F6 — no factor was disabled; …E1D stays active

Outcome

• U05, U06, U07: accepted. U07 is accepted on user-engine-portal. coulomb-social is mfaRequired: false by founder intent (no OTP dependency for now), so it is not a U07 check. The openbao-admin half of U07 was handed to ops-mason (hub message 36b443ab, MASON-WP-0005-T05).
• U08: blocked by F6 (key-cape KEY-WP-0040-T01). Re-run steps 6.3 onwards after the fix, with platform-root as operator.

Findings

• F1: coulomb.social's session/account details page should link "Manage authenticator app" (pink-account). Owner: coulomb-social (CSOC-WP-0016-T01).
• F2: closed, intended. coulomb-social stays password-only for now.
• F3: the lost-authenticator help on /security is not reachable from the KeyCape OTP prompt, and "follow the sign-in service's recovery instructions" names no concrete instructions. Owners: key-cape (prompt link, KEY-WP-0040-T02); user-engine (wording, USER-WP-0028).
• F4: the run doc had the recovery order backwards. The deployed P04 design disables the lost factor first, then the user re-enrolls. Run doc corrected.
• F5: none. platform-root holds platform-operator.
• F6: the recovery preview rejects valid input from a legitimate operator with invalid_request and leaves no diagnostics. Valid-input causes in key-cape/scripts/recovery_service.py + factor_recovery.py: the actor sub (KeyCape user.ID) or a privacyIDEA serial failing [A-Za-z0-9_.@:/-], or the request body arriving differently than validated. The sidecar must log the failing check (field name only, no values).