id: design: 2FA step-up gates & org-escrowed credential proxying (from #5683) #5881

Activity

1. dezren39

   added

   app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)

   on Nov 5, 2026
2. developing-today commented on Nov 5, 2026

   

   developing-todayBot

   on Nov 5, 2026 – with developing.today

   Contributor

   More actions

   CODE-1564
3. dezren39

   added

   queue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queue

   task/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item

   work/assignedQueue worker lifecycle stateQueue worker lifecycle state

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

   and removed

   queue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queue

   on Nov 5, 2026
4. dezren39 commented on Nov 5, 2026

   

   dezren39

   on Nov 5, 2026

   MemberAuthor

   More actions

   🤖 Agent note · done

   • Agent: queue worker (repo-worker-code), lane code-m
   • Session / ID: task 10283
   • Found via: queue claim
   • Task: Triage of issue id: design: 2FA step-up gates & org-escrowed credential proxying (from #5683) #5881 (design: 2FA step-up gates & org-escrowed credential proxying, from design(id): residency & boundaries framework — opt-in evidence, sanctions, and intranet-mode capabilities #5683) — completed, findings below
   • Expectation: s — triage only; design decision itself is a separate, later effort
   • Links: parent issue design(id): residency & boundaries framework — opt-in evidence, sanctions, and intranet-mode capabilities #5683 · epic epic: ID platform expansion — apps, comms, currency, hosting, boards (2026-10-28 directive, LIST 6–15) #2056

   Triage findings (verified fresh 2026-11-05)

   • State: issue id: design: 2FA step-up gates & org-escrowed credential proxying (from #5683) #5881 is OPEN, no hard-stop labels, no open PR references it, and no substantive comments yet. Parent issue design(id): residency & boundaries framework — opt-in evidence, sanctions, and intranet-mode capabilities #5683 is still OPEN (priority/low, effort/l, kind/design) and epic epic: ID platform expansion — apps, comms, currency, hosting, boards (2026-10-28 directive, LIST 6–15) #2056 is OPEN.
   • Not already done / not superseded: code search on current main finds no implementation for this design — credential proxy returns no hits; escrow hits are unrelated docs (key-recovery investigation, currency control-plane designs) and step-up hits are unrelated mcpx docs. Nothing to close against.
   • Nature: this is a pure design ticket, not a bug or a scoped fix. Its own body states implementation timing is "a separate decision, possibly months out" and requires a recorded decision (chosen shape, rejected alternatives, invariants implementation must hold) as its closing artifact.
   • Ordering / blocker: the design must not re-decide the parent framework in issue design(id): residency & boundaries framework — opt-in evidence, sanctions, and intranet-mode capabilities #5683 (Drew-ruled opt-in, framework-first: residency evidence, sanctions boundaries, intranet mode). Until that framework decision is recorded, settling escrow contents, proxied assertions, audit, and user visibility here risks silently forking a parent decision — which the issue body explicitly forbids. Correct order: record the design(id): residency & boundaries framework — opt-in evidence, sanctions, and intranet-mode capabilities #5683 framework decision first (or concurrently, with any divergence recorded explicitly on both issues), then run this design.
   • Scoped next step when unblocked: a single design pass producing the decision record named in the body — (1) escrow contents and key custody, (2) which assertions may be proxied and their lifetime/revocation, (3) audit trail shape, (4) what the user/org admin can see — filed as a doc/ record linked from issue id: design: 2FA step-up gates & org-escrowed credential proxying (from #5683) #5881, closing this issue. Effort class: l (design), matching the parent.
   • Routing: issue id: design: 2FA step-up gates & org-escrowed credential proxying (from #5683) #5881 stays OPEN as the design ticket; no implementation task should be enqueued until its decision record exists.
5. dezren39

   added

   status/triagedTriaged and routed (see agent note)Triaged and routed (see agent note)

   status/waiting-dependencyWaiting on a dependencyWaiting on a dependency

   and removed

   status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   work/assignedQueue worker lifecycle stateQueue worker lifecycle state

   on Nov 5, 2026
6. github-actions

   assigned

   dezren39

   on Nov 5, 2026