[wshallwshall]

Merge danger

Low. Docs only: six operator-doc passages, plus same-document siblings, on sign-in, step-up and the load-balancer probe token. No code or test changes. Line conflict expected with open PR 2564, which edits another cell of the same docs/ASVS-L2-PHASE0-CHANGES.md AD row. Many open PRs also touch docs/SECURITY.md and docs/CONFIGURATION.md. git merge-tree against origin/main at open time was clean.

Evidence

The Builder read each passage against the auth code at engine origin/main. All six were wrong, and none needed a code change. pytest over every test that reads the changed docs: 2654 passed, 90 skipped, plus 2309 passed in an earlier pass over the rest. ruff clean. mypy was not run, because no Python changed. Code review ran at xhigh, two rounds, both repaired; the QA line is posted as a comment.

BACKLOG #1133: research an honest pass for ASVS 6.1.3 -- whether documenting an inconsistently enforced strength can satisfy the verb

Batch 447. Source branch b447-1133-doc-sentences, head 5b3c9d447674b61fd99bcdf891860054a6193656 (three commits: the fix, then review rounds 1 and 2).

• docs/CLOUD-DEPLOYMENT.md 3.1: there is no static monitoring token and no route that mints one. The only bearer is a sign-in session token, so something beside the LB must sign in non-interactively (local password, or Kerberos through POST /auth/negotiate) and refresh it. It names which token to hand over under require_mfa.
• docs/AOAG-DEPLOYMENT.md: cut to one sentence that links to CLOUD 3.1.
• docs/ASVS-L2-PHASE0-CHANGES.md, AD "login binds" row: directory password sign-in is retired. The bind as the user now happens only on a directory account's password step-up. The row label is kept because tests key on it.
• docs/REMOTE-CONSOLE.md: step-up now says what each sign-in type re-proves.
• docs/CONFIGURATION.md (step_up_max_age_seconds) and the docs/SECURITY.md step-up section: both now include the combined passkey sign-in.
• docs/SECURITY.md Table A lockout row and first-seen-address rows: the lock exception now includes the passkey form.

Checks run: /simplify; ruff check; ruff format --check; targeted pytest as above. Skipped: mypy (no Python changed); the full suite. Legs to read: the pytest legs and the docs drift tests.

Proposed ledger banner: "ENGINE FIX 2026-10-27: six operator-doc sentences (and their same-doc siblings) corrected; a vault re-read of the cell is owed".

Critic notes, open and not built, for follow-up rows:

• docs/SECURITY.md account lockout row (~5913) names only the TOTP combined form.
• docs/EARLY-ADOPTER-GUIDE.md (~777) and the /metrics docstring in api/app.py still promise a "service token", the same false premise.
• docs/CLOUD-DEPLOYMENT.md 3.3 is loose.
• "Combined sign-in" is defined in several places in SECURITY.md and should be defined once.
• An L7 probe needs an automated refresher that holds a password and a TOTP seed. Admitting the existing mTLS service identity on /cluster/status would remove that need.

Confidence Score: 5/5

The documentation changes appear safe to merge.

Summary

Corrects six operator guides to match the existing sign-in and step-up code.

• Load-balancer guides explain how to keep an authenticated status probe working.
• The directory bind table puts password checks at step-up, not sign-in.
• The console guide explains what each sign-in type re-proves.
• Security guidance includes eligible passkeys in combined sign-in rules.

Acknowledged follow-ups from wshallwshall, not reported again:

• The account-lockout row still names only combined TOTP sign-in; deferred.
• docs/EARLY-ADOPTER-GUIDE.md and the /metrics docstring still promise a service token; deferred.
• Section 3.3 of docs/CLOUD-DEPLOYMENT.md remains loose; deferred.
• Repeated combined-sign-in definitions in docs/SECURITY.md should be consolidated; deferred.
• Allowing an mTLS service identity on /cluster/status would remove the probe refresher’s password and TOTP-seed requirement; deferred.

_{Reviews (1) · Last reviewed commit: "docs: review round 2 on the sign-in and ..." · Reviewed by Greptile}

[wshallwshall]

QA (BACKLOG #1133): code-review skill at level xhigh, two rounds, both repaired; round 2 nonce round-1a865754; review_tag.py exit 0; tag verbatim: "xhigh effort -> 10 inline angles -> dedup (no verify) -> sweep -> <=15 findings". Note: inline review with no verifier pass, per the tag.

[wshallwshall]

Manager 784448: one re-run of the failed legs (run 40586462740). This PR changes docs only. The one failure is tests/test_coord_lane_statement.py::test_show_with_no_lanes_dir_creates_nothing_and_says_absent, which is unrelated to this diff. Failed log: https://github.com/MEFORORG/MessageFoundry/actions/runs/40586462740/job/122479191787. Head 5b3c9d4. A second red on the same leg is a finding, not another re-run.