Finish ACTIVITY-WP-0025 after NK-WP-0021 group allowlist.

Close T06: LLDAP activity-core-operators and Authelia domain rules are live
in net-kingdom. Mark the workplan finished, update G10/runbook/SSO design
with membership pointers, and clear residual handoff notes.

workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md

@@ -4,7 +4,7 @@ type: workplan
 title: "SSO access control for ops console and Temporal UI"
 domain: infotech
 repo: activity-core
-status: active
+status: finished
 owner: codex
 topic_slug: activity-core
 created: "2026-07-22"
@@ -170,7 +170,7 @@ token not required for normal operator use.
 
 ```task
 id: ACTIVITY-WP-0025-T06
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
 ```
@@ -182,6 +182,13 @@ state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
 **Done when:** login works for a test operator and fails for an unprivileged
 account.
 
+**Disposition (2026-07-22):** No new KeyCape/Keycloak OIDC client — fleet path
+is Traefik ForwardAuth → Authelia. Least-privilege group work implemented in
+**net-kingdom** `NK-WP-0021` (finished): LLDAP `activity-core-operators`,
+Authelia domain allow/deny for both public hosts, membership runbook
+`sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`. Intakes NK-IN-0001/0002 closed
+`promoted_to: NK-WP-0021`.
+
 ## Task: Docs and runbook cutover
 
 ```task
@@ -216,7 +223,7 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
 ## Success criteria
 
 - [x] HTTPS SSO URLs for ops console and Temporal UI (no port-forward required)
-- [ ] Only authorized IdP group can access — **MVP: any Authelia user; T06 residual**
+- [x] Only authorized IdP group can access (`activity-core-operators` via NK-WP-0021)
 - [x] Ops mutations attribute to SSO identity; audits show principal (`sso:<user>`)
 - [x] Ops nav Temporal link points at SSO Temporal URL
 - [x] Runbook documents SSO primary + break-glass port-forward
@@ -253,7 +260,7 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
 | T03 | done | Ingress + cert Ready; unauth → 302 auth.coulomb.social |
 | T04 | done | Temporal Ingress + cert Ready; `ACTIVITY_CORE_TEMPORAL_UI_URL` + CORS set |
 | T05 | done | SSO `Remote-User` preferred; token break-glass; tests + redeploy |
-| T06 | wait | LLDAP group activity-core-operators + Authelia domain rules (net-kingdom) |
+| T06 | done | NK-WP-0021 finished: LLDAP group + Authelia domain rules live |
 | T07 | done | Runbook + k8s README + design doc: SSO primary, port-forward break-glass |
 | T08 | done | See verification checklist below |
 
@@ -275,23 +282,20 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
 | NetworkPolicy ingress→services | **skipped** (optional; ClusterIP + Authelia sufficient for MVP) |
 | Full browser login + Run now under real MFA session | **operator smoke** (credentials not in agent) |
 
-### Residual (keeps WP active)
+### Closeout 2026-07-22
 
-**T06** — restrict Authelia access to LLDAP group `activity-core-operators`
-(net-kingdom Authelia access_control rules). Until then any authenticated
-Authelia user can reach the UIs (org-wide SSO, not least-privilege).
+All tasks **done**. Workplan **finished**.
 
-**Work-record handoff (implementer = net-kingdom):**
+| Cross-repo | Result |
+| --- | --- |
+| NK-IN-0001 / NK-IN-0002 | closed, `promoted_to: NK-WP-0021` |
+| NK-WP-0021 | **finished** (LLDAP group, Authelia rules, OPERATOR-GROUPS.md) |
+| Authelia rules | `group:activity-core-operators` allow + domain deny for both hosts |
+| Membership | `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md` + `manage-group-members.sh` |
 
-| Intake | Owner repo | Scope |
-| --- | --- | --- |
-| `NK-IN-0001` | net-kingdom | LLDAP group `activity-core-operators` + membership runbook |
-| `NK-IN-0002` | net-kingdom | Authelia `access_control` domain rules for both public hosts |
+**Operator grant:** add users to `activity-core-operators` per net-kingdom runbook
+before first SSO login to the public UIs.
 
-Source file (canonical):
-`net-kingdom/docs/intakes/activity-core-ops-sso-operators.md`
-
-When both intakes are promoted/done, mark **T06** `done` and finish this WP.
-
-**Operator:** open https://activity.coulomb.social/ops/ui once, confirm inventory
-loads and a safe mutation (or dry path) shows `sso:<you>` in `/ops/audits`.
+**activity-core ownership remaining (ops, not open WP work):** break-glass
+port-forward + `ACTIVITY_CORE_OPERATOR_TOKEN`; keep Ingress/middleware in
+`k8s/railiance/30–32`.