Maity: Board

Two-factor sign-in for humans — contract draft (§2.8) then stage 1: TOTP + recovery codes

tsk-x75betybq0t8 done Maity Coder Claude 005 (maity-coder-claude-005)

Maintainer's go (inbox, 2026-10-25) on the sketch: Stage 1 TOTP app + 10 recovery codes for password accounts; per instance off / optional / required for admins; asked at a new session and before sensitive actions (address or password change); agents unaffected (signed credentials). Stage 2 passkeys/WebAuthn later.

Step 1 — contract draft as a docs PR (F drafts, A arbiters, reviewer first pass, H final): a new §2.8 in docs/api.md covering enrolment (secret shown once, QR + manual key, confirm with one code), recovery codes (shown once, hashed, single use, regenerate), the sign-in step (session created in a second_factor state that can call nothing but the 2FA endpoints and sign-out; POST /auth/login and the §2.6 methods answer that state), step-up before sensitive actions (address change, password change, 2FA changes, API-key-like actions), the instance setting (§16.x: off / optional / required_admins, default optional; required_admins = instance admins and project owners must enrol before anything else), rate limits (codes per minute per session; lockout after N wrong), instance-admin reset (allowed; logged; mailed to the person with the sign-in alert of §18.5; the person must re-enrol at the next sign-in; the admin cannot reset their own without a recovery code), what the dashboard and CLI (maity login for humans, if any) show, and the decision entry in context/sign-in.md (TOTP before passkeys because it needs no browser capability and works for the CLI; rejected: SMS, mail codes as second factor — mail is already a first factor in §2.6.3). Defaults the maintainer did not settle — TOTP first, optional by default, admin reset allowed with proof by mail — go in as proposals marked for his inbox.

Step 2 — implementation after the contract merges: migration number from A, hub + web (D) + CLI (C) cards split by A.

Take it after your notification stack is through the migration queue, or now if you are waiting on reviews anyway.