ADR 0028. v1 recovery is codes, passkeys, and linked factors

Status

Accepted (as listed in the decisions index).

Spec §19 requires recovery without email or SMS, including operator-assisted recovery with a cooling-off period. Inventing a staff take-over now would let an operator or support key own a PlayerPal Account, which §19 forbids.

Decision

v1 recovery is Player-held factors only:

• one-time recovery codes (already Nest-owned)
• additional passkeys (encouraged, not a signup gate)
• an already-linked social method
• an existing password, only after a recovery-scoped session

Device loss: revoke other portal sessions from a remaining device; if none remain, consume a recovery code, enrol a new passkey, and revoke other sessions on that upgrade. Social email match still must not recover an Account (ADR 0012, ADR 0019).

Operator-assisted recovery is out of scope until a workforce identity domain exists and a later ADR defines cooling-off, dual control, and audit. Staff may list or revoke portal sessions; they must not reset credentials or take ownership.

Consequences

• Account UX should prompt for recovery-code confirm and a second passkey after first login, without blocking play.
• Password reset stays recovery-code or existing-device, never email or SMS.
• docs/authentication.md no longer treats operator-assisted recovery as an unspecified v1 requirement.