docs(adr): ADR 0068 gains the acceptance criterion for the reset-MFA self-exclusion (BACKLOG #1022) - #592
Open
wshallwshall wants to merge 7 commits into
Open
docs(adr): ADR 0068 gains the acceptance criterion for the reset-MFA self-exclusion (BACKLOG #1022)#592wshallwshall wants to merge 7 commits into
wshallwshall wants to merge 7 commits into
Conversation
…self-exclusion (BACKLOG #1022) The Lander caught this reviewing PR 590: #1022's fix added a refusal to a shipped route and ADR 0068's formal criteria run AC-10 through AC-16 with nothing added for it. Two of the three record corrections that item owed were covered; this is the third. AC-17 states the behaviour in the file's own EARS form and carries its test, so the criterion is checkable rather than descriptive. It also says what the refusal does NOT do -- cross-user reset is unaffected and remains the §2 recovery path -- because the risk with this particular AC is a reader taking it as a narrowing of the one path that exists when a user has lost every factor. WHY IT SITS BESIDE AC-10 CONCEPTUALLY. AC-10 refuses the last-factor case on the self-service deletion path. The admin reset was a THIRD route to zero factors that reached neither AC-10 nor its TOTP sibling, which is what #1022 is about; AC-17 is where that now has a criterion. THE CITATION RESOLVES ON THE ITEM'S OWN BRANCH, verified rather than assumed: `git show claude/builder-1-1022-self-exclusion:tests/test_api_auth.py | grep -c test_admin_reset_mfa_refuses_to_target_the_caller` returns 1. It is NOT on this branch, and that is deliberate -- see below. *** WHY THIS IS A SEPARATE BRANCH RATHER THAN A COMMIT ON claude/builder-1-1022-self-exclusion. *** The worktree gate REFUSED to switch this worktree onto that branch, and it was right to: switching a linked worktree onto an existing branch is the hijack shape it exists to stop. Its suggested remedy is a dedicated worktree, which conflicts with one-worktree-per-session, and the alternative -- having the Lander commit it -- fails the claim gate, because #1022 is claimed by this worktree and the committer must hold the claim. So this is cut off origin/main with only the ADR edit. LANDER: it belongs with PR 590. Cherry-pick it onto that branch if that is easy for you, or take it as its own PR against the same item -- your call. I did NOT route around the gate to avoid the split. VERIFIED, scope named: pytest 62 passed test_dangling_citation_check + test_docs_security_pathways pytest 29 passed test_asvs_residual_lint scripts/docs/dangling_citation_check.py -- no new dangling citation from this edit docs-only change; no code, no test behaviour altered NOT a full-suite run Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
wshallwshall
enabled auto-merge (squash)
August 25, 2026 18:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds AC-17 to ADR 0068 in the file's own EARS form, citing its test, for the self-exclusion landing in PR 590. Third of the row's three owed record corrections -- the other two (SECURITY.md, ADR retraction prose) already landed there.
Also states plainly that cross-user reset is unaffected and remains the section 2 recovery path -- the sentence that stops the new AC being misread as narrowing the one recovery path that exists for a user who's lost every factor.
Cut as its own branch deliberately: the worktree gate correctly refused to switch onto the 1022 branch (linked-worktree hijack shape), and the claim gate would have refused a commit there from a worktree that doesn't hold #1022's claim. Landing separately avoids routing around either.