Point intent/scope at NetKingdom user-management path (CSOC-WP-0002)

Register CSOC-WP-0002 for identity-first reestablish; defer Bubble content
claim behind the authenticated shell. CSOC-WP-0001 notes the priority shift.

INTENT.md

@@ -69,6 +69,9 @@ The rebuild is deliberately **product-faithful first**: UI and content parity ma
 
 - `GOAL.md` — operator bootstrap note for this repo
 - `SCOPE.md` — in/out boundaries and orientation
+- `workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md` — **current path**: NetKingdom user management first; content later
+- `workplans/CSOC-WP-0001-bubble-io-exit-assessment.md` — Bubble assessment; content claim deferred
 - `the-custodian/docs/coulomb-social-rebuild-seed.md` — original workplan seed (CUST-WP-0058-T08)
 - `the-custodian/canon/standards/business-app-service-contract_v0.1.md`
+- NetKingdom: IAM Profile, user-engine boundary, KeyCape/Keycloak modes
 - Reference delivery lane: `vergabe-teilnahme`

SCOPE.md

@@ -65,11 +65,12 @@ coulomb.social connects people around shared projects and complementary capabili
 
 ## Current State
 
-- Status: bootstrap / greenfield
+- Status: bootstrap / greenfield — identity-first reestablish in progress
-- Implementation: orientation docs only; no application code yet
+- Implementation: orientation docs + design extract; application scaffold pending (`CSOC-WP-0002`)
 - Stability: evolving
 - Usage: internal — product rebuild not yet serving members from this stack
 - Prior art: rebuild seed from CUST-WP-0058-T08; topic `coulomb-social` already exists in State Hub under domain `communication`
+- Active path: **NetKingdom user management** (`CSOC-WP-0002`); Bubble content claim deferred
 
 ---
 

WORK-RECORDS.md

@@ -8,8 +8,17 @@
 
 | Kind | ID | Status | Lane | Source |
 | --- | --- | --- | --- | --- |
-| workplan | CSOC-WP-0001 | ready | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
+| workplan | CSOC-WP-0001 | active | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
+| workplan | CSOC-WP-0002 | ready | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
 | task | CSOC-WP-0001-T01 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
 | task | CSOC-WP-0001-T02 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
 | task | CSOC-WP-0001-T03 | wait | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
 | task | CSOC-WP-0001-T04 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md |
+| task | CSOC-WP-0002-T01 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
+| task | CSOC-WP-0002-T02 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
+| task | CSOC-WP-0002-T03 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
+| task | CSOC-WP-0002-T04 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
+| task | CSOC-WP-0002-T05 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
+| task | CSOC-WP-0002-T06 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
+| task | CSOC-WP-0002-T07 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |
+| task | CSOC-WP-0002-T08 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md |

workplans/CSOC-WP-0001-bubble-io-exit-assessment.md

@@ -24,6 +24,12 @@ schema. This plan originates from the CUST-WP-0058-T08 seed in
 Repo bootstrap (INTENT, SCOPE, TRSL LICENSE, State Hub registration, agent
 files) was completed as part of opening this workplan.
 
+**Priority note (2026-08-09):** product **reestablish** proceeds first via
+`CSOC-WP-0002` (NetKingdom user management + authenticated shell). **Content
+claim / migration** from Bubble remains in this workplan’s scope but is
+**deferred** until after the identity shell lands — do not block WP-0002 on
+inventory completion.
+
 ## Inventory bubble.io app
 
 ```task

workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md

@@ -0,0 +1,286 @@
+---
+id: CSOC-WP-0002
+type: workplan
+title: "Reestablish coulomb.social with NetKingdom user management"
+domain: communication
+repo: coulomb-social
+status: ready
+owner: bernd
+topic_slug: coulomb-social
+created: "2026-08-09"
+updated: "2026-08-09"
+depends_on:
+  - CSOC-WP-0001
+related:
+  - NK-WP-0023
+  - NK-WP-0024
+  - KEY-WP-0004
+  - USER-WP-0020
+origin: operator
+origin_ref: session-2026-08-09-netkingdom-users
+state_hub_workstream_id: "b9addc9a-cc08-4b08-bb67-b6544579beb8"
+---
+
+# Reestablish coulomb.social with NetKingdom user management
+
+Stand up a **new** coulomb.social application whose members authenticate and are
+administered through **NetKingdom infrastructure** (IAM Profile + issuer,
+user-engine for user-domain facts, flex-auth for authorization decisions) —
+not Bubble app-local accounts and not a password store inside this repo.
+
+**Content and product parity with the live Bubble app are deferred.** This
+workplan delivers identity, membership, and a minimal authenticated shell so
+the platform can exist again on the Railiance delivery lane. Claiming /
+migrating Bubble content is a later workplan (after or alongside
+`CSOC-WP-0001` assessment), not a gate for user management.
+
+## Why NetKingdom (not pure app-local)
+
+Business-app service contract v0.1 baseline is app-local accounts (DR-3 A)
+with a bounded auth module for a later OIDC switch. coulomb.social is a
+**multi-member social product**: platform identity and user-domain services
+are the intended long-term shape.
+
+| Concern | Owner | This repo does |
+|---------|--------|----------------|
+| OIDC login, MFA, token lifecycle | NetKingdom issuer (KeyCape lightweight or Keycloak expanded) via **IAM Profile** | OIDC client + PKCE; no password store |
+| User account, profile, membership facts | **user-engine** | Consumes projections / APIs; maps `(issuer, sub)` → local app context |
+| Fine-grained authorization | **flex-auth** (PDP) | PEP only — register protected system + check decisions |
+| Session cookie for browser | This app | Short-lived app session after successful OIDC; secrets via OpenBao at deploy |
+| Product content (pages, artefacts, chunks) | **Later workplan** | Out of scope here |
+
+Canonical references:
+
+- `net-kingdom/canon/standards/iam-profile_v0.2.md` (or current v0.3)
+- `net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md`
+- `net-kingdom/docs/user-engine-interface-guidance.md`
+- `the-custodian/canon/standards/business-app-service-contract_v0.1.md` §§1–2
+- Delivery lane reference: `vergabe-teilnahme`
+
+## Out of scope (explicit)
+
+- Bubble content inventory, export, or migration (CSOC-WP-0001 / follow-on)
+- Full UI parity with the live product
+- Marketplace / co-creation domain features beyond auth shell
+- Owning KeyCape, Keycloak, user-engine, or flex-auth implementation
+- Platform SSO for *other* Binky apps (this work only onboards **this** app)
+
+## Acceptance (workplan done when)
+
+1. A deployed (or locally runnable) coulomb.social instance completes OIDC login
+   against a NetKingdom IAM Profile issuer (dev/bootstrap allowed).
+2. Successful login creates or links a **user-engine** identity link and
+   application membership for coulomb.social; logout ends the app session.
+3. Unauthenticated visitors cannot reach member routes; at least one protected
+   “signed-in home” shell renders with principal display name/subject.
+4. Auth is isolated behind a single module/boundary (service contract §2.3).
+5. Tenant key present from migration one (Binky / client #1).
+6. Docs record the onboarding bindings (OIDC client, user-engine app id,
+   flex-auth system id if registered) without secrets.
+7. No Bubble dependency for login or member identity.
+
+---
+
+## T01 — ADR: NetKingdom identity for coulomb.social
+
+```task
+id: CSOC-WP-0002-T01
+status: todo
+priority: high
+state_hub_task_id: "57a7b778-b1d6-44fe-95ba-f12373c0355c"
+```
+
+Write `docs/adr/ADR-0001-netkingdom-identity.md` deciding:
+
+- IAM Profile as the only authentication contract (issuer-agnostic).
+- user-engine as source of truth for user-domain facts and memberships.
+- flex-auth as PDP for protected actions (fail-closed for sensitive writes).
+- Explicit **non-goals**: app-local password DB; Bubble as IdP; content migration in this plan.
+- Relationship to DR-3 A (contract baseline) vs this product’s NetKingdom path.
+- Dev/bootstrap path (local-identity or KeyCape) vs production issuer.
+
+**Done when:** ADR reviewed and linked from INTENT/SCOPE.
+
+## T02 — Application scaffold and tenant model
+
+```task
+id: CSOC-WP-0002-T02
+status: todo
+priority: high
+state_hub_task_id: "7ffa6485-4929-4958-b3b1-af98241beb02"
+```
+
+Scaffold the standalone service (stack choice recorded; prefer alignment with
+the business delivery lane unless ADR says otherwise):
+
+- App entrypoints, config, health/ready probes.
+- DB migrations: `tenant_id` on all client-owned tables from day one.
+- Empty **member context** table(s) keyed by tenant + stable user-engine
+  `user_id` / external identity link — **no password columns**.
+- Dev compose / run instructions in README or `docs/dev.md`.
+
+**Done when:** `make test` (or equivalent) passes smoke tests for boot +
+migrations; no product domain models beyond auth shell.
+
+## T03 — NetKingdom OIDC client binding
+
+```task
+id: CSOC-WP-0002-T03
+status: todo
+priority: high
+state_hub_task_id: "1b1d1162-d44a-45db-b906-05ebd7110f21"
+```
+
+Register coulomb.social as an OIDC client against the active NetKingdom issuer
+mode (document which: KeyCape vs Keycloak vs local-identity for dev):
+
+- client_id, redirect URIs (no wildcards), scopes, PKCE.
+- Secrets only in OpenBao / local 0600 files — never Git.
+- Conformance: tokens satisfy IAM Profile claims needed by the app
+  (`sub`, issuer, tenant/principal claims as required).
+
+Record non-secret binding facts under `docs/identity/oidc-client.md`.
+
+**Done when:** browser authorization code + PKCE login completes against the
+chosen issuer in a dev environment; evidence in `docs/identity/`.
+
+## T04 — user-engine application onboarding
+
+```task
+id: CSOC-WP-0002-T04
+status: todo
+priority: high
+state_hub_task_id: "bbf8183c-2dd6-448b-a257-8d837d2d5ebf"
+```
+
+Per application onboarding contract
+(`user-engine-interface-guidance.md`):
+
+- Register application `coulomb-social` in user-engine (display name, owner,
+  allowed profile scopes, projection types).
+- On first successful OIDC login: create/link external identity
+  `(issuer, sub)` → `user_id`; ensure tenant membership for Binky / client #1.
+- Define minimal application profile attributes needed for shell (display
+  name, avatar optional) — **not** Bubble content fields.
+- Document bindings in `docs/identity/user-engine-binding.md`.
+
+Coordinate with NetKingdom/user-engine operators if platform registration
+steps are outside this repo’s authority (NK-WP-0023/0024, USER-WP-*).
+
+**Done when:** login yields a resolvable user-engine projection usable by the
+app; second login is idempotent (same user_id).
+
+## T05 — App auth module (OIDC session boundary)
+
+```task
+id: CSOC-WP-0002-T05
+status: todo
+priority: high
+state_hub_task_id: "ea546dd7-e1c8-4040-a738-270d5004fd73"
+```
+
+Implement a **single** auth boundary module (§2.3):
+
+- Login start / callback / logout routes.
+- Secure session after code exchange (httpOnly cookie or equivalent).
+- Middleware: unauthenticated → login; authenticated → attach principal
+  (issuer, sub, user_id, tenant_id, display claims).
+- No credentials stored in app DB; refresh strategy documented.
+- Unit/integration tests for happy path + rejected/expired tokens.
+
+**Done when:** tests green; module is the only place that talks OIDC.
+
+## T06 — Authenticated shell and member routes
+
+```task
+id: CSOC-WP-0002-T06
+status: todo
+priority: medium
+state_hub_task_id: "b2d48db3-a216-440e-afbf-51fa9c33b4da"
+```
+
+Ship a minimal product surface that proves user management works:
+
+- Public landing (unauthenticated) with “Sign in”.
+- Protected home (`/app` or similar) showing signed-in identity summary.
+- Sign out control.
+- Optional: admin-only stub route gated via flex-auth or coarse IAM role
+  (if flex-auth not ready, document temporary claim check + follow-up).
+
+**Do not** rebuild Bubble Research / Pages / Artefacts here.
+
+**Done when:** manual smoke checklist in `docs/identity/smoke.md` passes.
+
+## T07 — flex-auth protected system (minimal)
+
+```task
+id: CSOC-WP-0002-T07
+status: todo
+priority: medium
+state_hub_task_id: "04c13dad-1c6e-45b9-96ba-438458e2c388"
+```
+
+Register coulomb.social as a flex-auth protected system with a **tiny**
+resource/action vocabulary (e.g. `shell:view`, `member:self:read`). Wire the
+app as PEP (fail-closed when policy engine unavailable for protected actions).
+
+If cluster flex-auth is not yet available for this app, deliver:
+
+- local policy adapter for dev, and
+- a blocked residual / intake for production flex-auth binding.
+
+**Done when:** at least one protected action is decided via the authz port;
+docs record system id and vocabulary.
+
+## T08 — Delivery-lane packaging stub
+
+```task
+id: CSOC-WP-0002-T08
+status: todo
+priority: medium
+state_hub_task_id: "4718f21c-d509-45b9-a8f5-31de2099fd3f"
+```
+
+Align with business-app delivery lane without full production cutover:
+
+- Container image build from commit SHA (or documented path to it).
+- Placeholder railiance-apps values notes / chart stub.
+- Runtime secret references (OIDC client secret, DB) named for OpenBao —
+  values not in Git.
+- Health endpoints suitable for deploy smoke.
+
+**Done when:** image builds in CI or documented local script; deploy notes in
+`docs/deploy.md`.
+
+---
+
+## Sequencing
+
+```text
+T01 ADR
+  └─► T02 scaffold + tenant model
+        ├─► T03 OIDC client
+        └─► T04 user-engine binding
+              └─► T05 auth module
+                    └─► T06 shell
+                          ├─► T07 flex-auth
+                          └─► T08 packaging stub
+```
+
+T03 and T04 can proceed in parallel after T02 once redirect URIs and app id
+are known.
+
+## Handoffs / residuals (later plans)
+
+| Residual | Future home |
+|----------|-------------|
+| Bubble content claim & migration | New workplan after CSOC-WP-0001 T03 cut |
+| Full product UI (Research, Pages, …) | Post-shell product workplans |
+| Production Keycloak expanded mode | NetKingdom (NK-WP-0011 triggers) if demand |
+| Member invitation email at scale | email-connect / NK-WP-0024 lanes |
+
+## Related
+
+- `workplans/CSOC-WP-0001-bubble-io-exit-assessment.md` — assessment; content later
+- `docs/design-extract/` — visual language for future UI (not blocking T01–T08)
+- `docs/design-extract-auth.md` — Bubble scrape auth only; not product IdP