[StuartFerguson]

Summary

• Add TOTP MFA enrollment with QR-code and manual-key support.
• Add hashed, one-time recovery codes with concurrency protection.
• Add user and role MFA policies through the management API.
• Add protected MFA login completion and reject MFA accounts on the legacy password grant.
• Configure persistent Data Protection keys at C:\home\txnproc\keys.
• Document MFA operations and deployment requirements.

Verification

• Focused MFA tests: 16/16 passed.
• Full unit suite: 138/138 passed after the certificate-loader fix.
• OIDC endpoint tests: 3/3 passed.
• Integration projects build successfully.
• Final Codex Security diff scan: 0 reportable findings.

Notes

• Docker-backed integration execution was not completed because the EventStore test container remained in Created state.
• The deployment environment must create C:\home\txnproc\keys with restricted read/write permissions for the Security Service identity and apply the EF migrations.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T19:56:39.992582Z	167b15e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 132 complexity · 2 duplication

Metric	Results
Complexity	132
Duplication	2

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 167b15e1f7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".