user-engine/docs/mfa-attended-run.md

Attended MFA acceptance run: U05–U08, first real user tegwick

Prepared 2026-10-10 for the founder request relayed by ops-mason (hub message ab89a591). It covers USER-WP-0028-T03 and USER-WP-0027-T04 and is gated by hub decision cef97ccd (D10). The pilot is set in mfa-pilot-decision.md.

What already exists

• Enrollment surface. privacyIDEA self-service runs at https://pink-account.coulomb.social/ (net-kingdom sso-mfa/k8s/privacyidea). Realm coulomb resolves every LLDAP user. Policy totp-self-enrollment lets any user in that realm enroll, delete or disable their own TOTP token. Tokens are labelled {user}@{realm} and issued as Coulomb, so the app shows tegwick@coulomb.
• Portal guidance. /security explains setup, cancellation, a rejected code and a lost authenticator. It also covers the no-factor-yet case. Until USER_ENGINE_MFA_MANAGEMENT_URL is set, it says setup is unavailable and points to the tenant administrator.
• Recovery and replacement. P04 recovery and P06 policy are deployed and were verified with installed-provider fixtures (P06 evidence).

What is missing is a real person going through it, plus the portal handoff link.

Does tegwick need to join the coulomb-social pilot?

Not to enroll. Enrollment is per realm, not per client. Joining is needed only to observe U05 and U07 on the pilot client, where MFA is optional. On openbao-admin, KeyCape asks every user for an OTP, so password-only sign-in (U05) cannot be observed there. Decided (founder, 2026-10-10): tegwick runs on coulomb-social, so all four journeys run on one client. There is no pilot member list. coulomb-social is a KeyCape client in realm coulomb, so "joining" means tegwick signs in to coulomb-social once (U05). openbao-admin then serves as the second U07 check that ops-mason needs (MASON-WP-0005-T05).

Before the run (operator)

1. Set USER_ENGINE_MFA_MANAGEMENT_URL=https://pink-account.coulomb.social/ in net-kingdom sso-mfa/k8s/user-engine/runtime.yaml and roll out. Founder go given 2026-10-10. The change was sent to net-kingdom as hub message 58e999b3; we wait for its rollout reply. The portal accepts only a fixed HTTPS URL with no query or credentials. Without this step, start U06 at the provider URL directly and record that the handoff was not exercised.
2. Confirm tegwick has no active token: privacyIDEA admin token list for tegwick@coulomb, token count only.

Attended steps (tegwick at the keyboard, operator observing)

Step	Journey	Where	Expected	Record
1	U05	coulomb-social sign-in	Password-only sign-in succeeds; no OTP prompt	time, client, outcome
2	U06	portal /security → Manage authenticator app	Lands on pink-account; provider asks for the password; account shown is tegwick	time, account name seen (yes/no)
3	U06 cancel	pink-account → Enroll TOTP, then delete the pending token	Pending token removed; nothing reports enabled	outcome
4	U06	pink-account → Enroll TOTP, scan, confirm with a current code	Token active; label tegwick@coulomb	token serial suffix only, status
5	U07	new private window, coulomb-social, then openbao-admin	OTP is asked and a current code completes sign-in; a wrong code is retried; the old password-only session cannot skip OTP	outcome per client
6	U08	portal /security → recovery route; operator uses audited recovery (P04)	Replacement is verified before the old factor is removed; no bypass link	recovery record id, outcome

Steps 5 and 6 can be split. Once step 5 passes, reply to ops-mason (tegwick has an active factor) and MASON-WP-0005-T05 can run. Step 6 may follow later.

Evidence rules

Record times, outcomes, client ids, token serial suffixes and recovery record ids in docs/evidence/<date>-mfa-attended-u05-u08.md. Never record a seed, a QR code or image, an OTP value, a password or a session cookie, and do not take screenshots of the enrollment page. No step is inferred from a redirect, a return parameter or an assurance claim.

After acceptance

Keep USER_ENGINE_MFA_MANAGEMENT_URL set for all users. It covers every LLDAP user in realm coulomb and every KeyCape client, because enrollment does not depend on the client. MFA stays optional except where KeyCape already asks for it (openbao-admin).

Still deferred:

• admin-required MFA, which would be an issuer-side client policy applied through P06 and needs the founder's go;
• showing authoritative enrollment status in the portal;
• a link from KeyCape's OTP prompt to /security for users who have no factor yet. That page belongs to key-cape, and today it is the dead end tegwick hit.

Hand-off

USER-WP-0028-T03, USER-WP-0027-T04 and decision cef97ccd close only on the recorded evidence.