Repository navigation
ADR 0207 accepted with Amendment A: the enrolment code is the factorless re-proof once the directory re-bind goes (BACKLOG #1137) - #2584
Merged
Conversation
…ind goes, re-baseline, enforced engine-stopped host command BACKLOG #1137. Decided by the batch 447 Manager under the owner's delegation of 2026-10-27, after an adversarial review. Status stays Proposed. A1: once owner ruling A5 removes _reauth_ad, the enrolment code is a factorless directory session's re-proof at the binding step; begins are admitted with a new budget draw; every other step-up action, session termination included, stays refused until a factor exists (AC-16). A2: re-baselined against #3014, #3025, #3061; AC-5, AC-13, AC-14 become regression pins. A3: check order after the #3061 lookup; the TOTP spend folds into the enable's conditional write; label read before the spend. A4: host command refuses a held, non-store or unchecked SQLite store (AC-17); the audit-fork premise is recorded as not borne out by the tree. A5: the issuer gets a spent-notice row and email (AC-18). A6: 24h kept; IdP-bound first factor noted, not adopted. Proposed PR title: ADR 0207 amendment A: factorless re-proof, re-baseline, enforced host-command check
…legation record Applies the second adversarial review of Amendment A (accept after named small fixes): - A1: the build that removes _reauth_ad must cite A1 and AC-16 and carry the gate change in the same change; its row is unfiled. - A1: that build owes the docs/SECURITY.md passages saying a no-factor user can still end its sessions, and a vault re-read of the session-termination cell. - A3 step 10: the passkey spend is conditional on TOTP off and no passkey; AC-19 pins it. - Section 7: auth.enrolment_code_spent_notice, actor marked recipient, documented in SECURITY.md's Audit section. - To resolve on acceptance: require_mfa-off answered yes. - The delegation record quotes the owner's question verbatim. BACKLOG #1137
…026-10-27 Status moves from Proposed to Accepted (2026-10-27). Accepted by the batch 447 Manager under the Owner's delegation of 2026-10-27 (CLAUDE.md section 5, "A delegated decision counts as that ruling", owner ruling 2026-10-22), after two adversarial reviews. The Proposed history is kept in the Status line. README row: Accepted; Amended (A, 2026-10-27). Three To-resolve items stay open with their recommendations. BACKLOG #1137 Proposed PR title: ADR 0207 accepted with Amendment A: the enrolment code is the factorless re-proof once the directory re-bind goes (BACKLOG #1137)
- AC-19 reaches only a code refused at the code read; the later race is named, not pinned as staged. - The TOTP fold also requires no passkey; AC-19 pins that direction too. - README row no longer says the TOTP code is spent before the stamp. - The begin routes' budget draw and the A1 table belong to the build that removes _reauth_ad, which must not admit a begin without it. - The new-address check is named as absent with admin_new_ip_step_up off or no recorded client; the budget drain is not bounded for a password holder who re-mints sessions. - A4: a non-SQLite file is refused before the open; the unchecked SQLite availability cost is named; the shared-gate follow-up is named by subject. - The three new users columns are sealed fields; the require_mfa-off step-up loss is named in Consequences; A6 cites ADR 0142 Amendment C. BACKLOG #1137 Proposed PR title: ADR 0207 accepted with Amendment A: the enrolment code is the factorless re-proof once the directory re-bind goes (BACKLOG #1137)
- A1's headline names the begins and the TOTP confirm form as admitted, matching its table; the README row says the same. - A1 and the require_mfa-off answer rest on A5 leaving that posture to this ADR (A5's record says so), not on A5 removing it outright. - AC-3 is scoped to a code refused at the read; AC-19's race clause says that ceremony spends nothing. - The TOTP fold's no-passkey condition binds only the code-carrying write; a fold failing on its code keeps today's refused reason. - Superseded section 3 and 7 passages carry pointers to A2 and A3. - AC-16 pins the new-address refusal where that check runs. - A6 no longer counts the issuer's notice as a bound; the drain's detection path is named truthfully; the spent notice carries the client address; the residual's awaited reads are corrected. - The delegation record names the option taken and that the code-review rounds changed design text after both adversarial reviews. - Qualifies require_mfa as [security].require_mfa (docs config-key test). BACKLOG #1137 Proposed PR title: ADR 0207 accepted with Amendment A: the enrolment code is the factorless re-proof once the directory re-bind goes (BACKLOG #1137)
The Status line and Amendment A now say the two repair rounds (2a6f300, 83d038b) came after both adversarial reviews, and that a third adversarial read at 83d038b covered them and returned keep accepted after named small fixes. Amendment A names how the three new users columns survive the users-row seal: each enters the sealed field set only when non-null, as passkey_digest does for discoverable. Every code write is named a conditional sealed write through _write_user. docs/PHI.md lists the spent notice among the audit_log.detail rows that store a client address. BACKLOG #1137 Proposed PR title: ADR 0207 accepted with Amendment A: the enrolment code is the factorless re-proof once the directory re-bind goes (BACKLOG #1137)
Code-review findings on 082741c: the spend captures the issuer from the record _write_user read; the host command's write names what the seal compare guards, and that a keyless store has no compare; the seal claims are qualified to a store with a row sealer; the write list is "at least" and names the revoke and the unconditional disable clear; the test_user_seal claim names a static scan; Amendment A says which text of the fix commit no adversarial read has seen; the decision log id is named as the original acceptance's; PHI.md cites vault BACKLOG #2609 for the spent notice. BACKLOG #1137 Proposed PR title: ADR 0207 accepted with Amendment A: the enrolment code is the factorless re-proof once the directory re-bind goes (BACKLOG #1137)
Collaborator
Author
|
QA (BACKLOG #1137, ADR 0207): code-review skill at level xhigh. Amendment A rounds round-e1a39052 and round-b460b167 (korus review_tag.py exit 0); acceptance and F-fix rounds round-30fccfa1 and round-b32a42b5 (exit 0); third-read fix round round-b20ee988 (exit 0). Tag verbatim, every round: "xhigh effort -> 10 inline angles -> dedup (no verify) -> sweep -> <=15 findings". Inline review with no verifier, per the tag; the three adversarial reads in the PR body cover the design. The round-b20ee988 repairs (5ae0f71) have had no review of their own; Amendment A names which text no adversarial read has seen. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
github-actions
Bot
added
the
ci-red
Collaborator
Author
|
Lander (session 8a04c9f3), 2026-10-28. Covering review of the unreviewed repair commit
Next: the 14 findings go into ledger rows, alongside #4676 and #4677, before this merges. Each will be named here with its row. |
Collaborator
Author
|
Lander (session 8a04c9f3), 2026-10-28. Enqueuing at pinned head Review proof: the QA rounds cover everything up to Open findings. None changes shipped behaviour or weakens a shipped control:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge danger
Medium, docs only. This moves ADR 0207 (a single-use enrolment code for a directory account's first engine factor) from Proposed to Accepted, with Amendment A. Acceptance frees the build rows it governs, including the build that removes the directory re-bind under owner ruling A5. Per the Lander's rule 4i it gets its own PR. It touches only
docs/adr/0207-...md,docs/adr/README.md(its index row) and onedocs/PHI.mdlist line.git merge-treeagainstorigin/mainat open time was clean.Evidence: how it was accepted
The owner was asked, verbatim (AskUserQuestion, 2026-10-27, about 13:35Z): "ADR 0207 review result: ACCEPT WITH NAMED AMENDMENTS ... How do you want to proceed?" The options were "Amend, then I accept (Recommended)", "Accept as written now" and "Not now". The owner answered
/driver. The full question is quoted in the ADR's delegation record.Under CLAUDE.md section 5 (owner ruling 2026-10-22), that delegates this question to the asking seat. The seat decides after adversarial review, and the record counts as the owner's ruling.
Three adversarial reviews ran:
Decision log records: d20261027T133727170-18c43f (amend, then accept) and d20261027T163534931-960b5f (keep accepted).
BACKLOG #1137: research an honest pass for ASVS 6.3.4 -- consistent authentication strength when AD MFA is delegated by design
Batch 447. Source branch
b447-adr0207-amend, head5ae0f71bc4adc960bc47d3ffc50c6be1b501ecd6. These SHAs will not survive the squash merge, so they are kept here:passkey_digestdoes fordiscoverable), conditional sealed writes through_write_user, and the spent notice added todocs/PHI.md.What acceptance unblocks: the build that removes
_reauth_admust cite Amendment A1 and AC-16 and carry the gate change in the same change. That build row is unfiled. Open acceptance boxes, each with a recommended default the build follows unless the owner rules: the 24h lifetime, whether an MFA reset issues a code, and the host command's reach.Checks: ruff clean.
pytest -k "adr or phi": 1791 passed, 95 skipped at the head. mypy was not run, because no Python changed.QA: the code-review skill ran at level xhigh across four rounds; the tags are in the QA comment.
Known defects, shipped as critic notes:
RowSealErrorhas no defined refusal on these paths.Unfiled follow-ups, for the Lander to file as rows:
_reauth_adremoval build under A1/AC-16;docs/SECURITY.mdrevoke passages and the vault re-read of the session-termination cell that A1 owes at that build.
This documentation-only PR appears safe to merge.Summary
Accepts ADR 0207 with Amendment A. No new actionable issue was established.
Acknowledgments by wshallwshall:
RowSealErrorrefusals remain undefined.Diagram
%%{init: {'theme': 'neutral'}}%% flowchart TD A[Future binding request] --> B[Directory lookup and factor checks] B --> C{Valid enrolment code?} C -->|No| D[Refuse without consuming the staged proof] C -->|Yes: TOTP| E[Verify TOTP and rotate session] E --> F[Enable TOTP and spend code in one conditional write] C -->|Yes: passkey| G[Verify attestation and check duplicates] G --> H[Spend code before writing credential] F --> I[Record use and notify issuer] H --> IReviews (1) · Last reviewed commit: "ADR 0207: repair round on the third-read..." · Reviewed by Greptile