Process

How the door works today — login ladder, enroll paths, security posture.

Login ladder (storyboard)

1. Username + Enter.
2. Password under Login (molecules still; no early white otpauth plate) → Next.
3. Next calls /api/auth/totp-qr (password required).
   • Already hooked (totp_enabled) → 6-digit code only, no enroll QR.
   • Needs setup → centered enroll QR + 6-digit code panel.
4. Enter → session → dining hall (stop: chat depth elsewhere).

Way-mark (triangles + dots) opens the password path. Scan TOTP / press here re-requests the enroll plate only with password in session.

Two enroll paths

• Account (correct bind): /api/account/totp/start stores secret OFF → first code → /confirm enables + returns backup codes once.
• Gate (soft hinge open): /totp-qr may mint + return otpauth:// while totp_enabled stays false; login can still issue a session on password alone until hooked; backup codes are not shown on this ladder yet.

Security / compliance notes

• Fail-closed: auth/UI failures must not bypass the face.
• House rule for members: AskRue™ never asks you to scan a QR from email or DM.
• Webroot backups / *.bak denied in static serve (closed 2026-07-24).
• China AI ban: no Chinese models or labs in agent brains, deps, API bases, or recommendations (house hard rule).

To fill… secrets-at-rest checklist (encryption of TOTP seeds, hash algo confirmation) — source verify.

Recovery

Lost authenticator → Contact Us + Rue-verified reset. Backup codes (once shown on account confirm) are the member-side escape hatch when available.

• After the door opens → RUEZALS chat (stop).
• Wiki meta → RUEZALS wiki stub only.