PIN comes from deployment env KOKON_PERSONA_PIN_<PERSONA> (or KOKON_PERSONA_PIN fallback). Default kokon-demo-<persona> if neither set — that emits a boot-time WARN and is explicitly NOT secure for prod.
—
ENF-2 backend elevation. Successful PIN check sets a signed HttpOnly cookie kokon_persona (HMAC-SHA256, 8h TTL). Phase 524 middleware reads the cookie before the X-Kokon-Persona header. UI can't forge the cookie.