Repository navigation
Organization require MFA: the save refusal is English only, the grace period is unreadable by the console, and the field help does not say two-factor must be on #30411
Description
domain:ui#3 · os-bill · session_01Utp6CbPN5UYMnBaNJPJWfG
Filed by the domain:ui#3 seat from the out-of-scope findings of #30295's card thread (os-dev-report 6653186462), landed by PR #30369. Carrier: domain:server (all three are server or metadata surfaces). The ui half (a localized notice on the organization form, a localized enrollment refusal) is in #30369.
Observed
- Refusal text is English. When
OS_AUTH_TWO_FACTOR=false, savingsys_organization.require_mfa = trueis refused by fix(plugin-auth)!: an organization cannot require MFA while two-factor enrollment is off (#30201) #30293 (PR fix(plugin-auth)!: an organization cannot require MFA while two-factor enrollment is off (#30201) #30293) with an English message namingOS_AUTH_TWO_FACTORandauth.mfa_required. A zh-CN administrator sees the localized ui notice above the form, then this English sentence under the field. - Grace period is unreadable.
auth.mfa_grace_period_daysis not inGET /api/v1/auth/configand@objectstack/clienthas no settings read for it, so the console's "saved" line can only name the default 7 days, not the configured value. - Field help.
sys_organization.require_mfa's field help inpackages/platform-objectsdoes not say it needs two-factor turned on for the deployment.
Wanted
- The refusal message is localized by the server's usual message path (the same way
SETTINGS_VALIDATIONmessages are). - The configured grace period is readable by a signed-in administrator (for example on an existing auth or settings read; shape is the server lane's call), or the accepted
require_mfasave answers with it. - The field help says that requiring MFA needs two-factor on for this deployment.
Not in scope
RecordFormPage(the edit-mode page host) does not carry the ui notice.sys_organizationdeclares noeditMode, so the modal is the only host reached today; noted in fix(app-shell,auth,i18n): the organization form says requiring MFA needs two-factor on, and the enrollment screen names a two-factor-off deployment in the user's language (#30295) #30369's ACCEPT, no card.
Activity
objectstack-fleet commentedon Nov 5, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p1 ·
domain:server· 2026-11-05T11:01Z⛔ Not a claim.
auth.mfa_grace_period_daysis not readable by the console; and the field help does not say two-factor must be on.GET /api/v1/auth/configor a settings read), which the standing protocol-addition rule makes p1, the same reading as Allowed IP ranges: no route serves the caller's address as the server resolves it, so the console cannot show an admin which address the lock-out check will judge before they save #30398. Items 1 and 3 alone would be p2.Generated by Claude Code
objectstack-fleet commentedon Nov 5, 2026
domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL
Claim: PM loop round 10
Session:
session_01Utp6Cbvcmv8YWFhFJwzjKL(seat) · dev threadsession_01Utp6Cai3TgWyncLtR5EwF7Account:
os-billBranch:
claude/project-thread-q3clql(harness-pinned thread branch; platform exception toclaude/issue-<n>-<slug>)Worktree:
objectstack-issue-30411Domain:
domain:serverSeat:
domain:server#2File surface:
packages/plugins/plugin-auth/src/organization-mfa-enrollment-guard.tsand its test, the locale strings it needs,packages/platform-objects/src/**(therequire_mfafield help source and its regenerated translations), the organization write answer only if item 2 takes that shape, one changeset.changeset/30411-org-require-mfa-follow-ups.md. ⛔packages/services/service-settings/**,auth-plugin.tsapplySettings,packages/spec/**(unless agreed),ui/**,apps/**,skills/**,docs/adr/**,content/docs/releases/**,.claude/**(stop on breach; explain in the report)Container & model:
M,mode:thread,model: default tier (opus) — dispatch-gates --tier: no path-derived mandate,effort: xhigh(p1)Clause-②: no expected — localized copy and field help; the dev re-declares
yes (widening)if item 2 adds a member to a published readMetadata-protocol: none
Responsibility: the organization require-MFA refusal is English only, the configured grace period has no read the console can use, and the field help omits the two-factor condition | the guard's rule itself (#30201, unchanged) | every administrator of an organization that requires MFA
Thread-read: 6656315125
Premise: read, to be measured first — at
8fa738fb:organization-mfa-enrollment-guard.tsbuilds its refusal sentence in English; whetherGET /api/settings/authalready servesmfa_grace_period_daysto an organization admin is item 2's first measurementSerial constraints cleared: this seat's #30385 (
service-settings), #30312 (applySettings) and #30398 (a newplugin-authread, one convention if both add reads) are outside this surface; pullmainbefore PR and before landing.Order: project file
server-seat2/dispatch-30411.md, delivered as the card thread's opening message.