Complete identity smoke path: id_token claims, registration entry, cutover docs

Prefer verified KeyCape id_token claims when /userinfo returns 401; soft-fail
userinfo. Add CSOC-WP-0003 registration entry (disabled until NetKingdom URL),
AAL step-up hooks, smoke/cutover evidence for tegwick OIDC without MFA.

workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md

@@ -268,6 +268,8 @@ Align with business-app delivery lane without full production cutover:
 
 2026-08-09: `Dockerfile` added; `railiance-apps` chart + values + ingress stub + Makefile targets. Image `7067145` published and Helm release deployed; migrations applied; in-cluster /healthz+landing OK. Public DNS still Cloudflare/Bubble; TLS cert pending DNS cutover to 92.205.62.239.
 
+2026-08-09 (smoke continuation): Offline checklist + `make test` (15) passed. Port-forward with `Host: coulomb.social`: healthz/landing OK; `/auth/login/` 302 to KeyCape with prod redirect + PKCE. KeyCape authorize accepts local and prod redirect URIs (→ Authelia). Full browser MFA login still human step (`docs/identity/smoke.md`); cutover steps in `docs/deploy.md`.
+
 ---
 
 ## Sequencing

workplans/CSOC-WP-0003-self-registration-and-assurance.md

@@ -0,0 +1,96 @@
+---
+id: CSOC-WP-0003
+type: workplan
+title: "Add NetKingdom self-registration and profile-aware assurance"
+domain: communication
+repo: coulomb-social
+status: active
+owner: codex
+topic_slug: coulomb-social
+created: "2026-08-09"
+updated: "2026-08-09"
+depends_on:
+  - CSOC-WP-0002
+  - NK-WP-0025
+  - USER-WP-0022
+  - KEY-WP-0008
+state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
+---
+
+# CSOC-WP-0003 - self-registration and assurance
+
+Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
+creation entry point and optional profile/action step-up.
+
+## T01 - Preserve and prove first-login JIT profile creation
+
+```task
+id: CSOC-WP-0003-T01
+status: done
+priority: high
+state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"
+```
+
+Harden the existing issuer/subject keyed Member creation, concurrent callback
+behavior, verified ID-token processing, and user-engine link. Preserve the
+current uncommitted CSOC-WP-0002 claim-verification work.
+
+Done when an existing LLDAP identity gets exactly one ordinary Member and
+repeat login updates safe display fields without changing identity ownership.
+
+Covered by the issuer/subject uniqueness constraint, unusable local passwords,
+idempotent session establishment tests, and verified ID-token claim handling.
+
+## T02 - Add Create NetKingdom account
+
+```task
+id: CSOC-WP-0003-T02
+status: progress
+priority: high
+state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"
+```
+
+Add a landing-page registration choice using the configured NetKingdom public
+registration URL. The configured URL owns any signed return context. Completion must
+start a fresh OIDC flow before creating an application session.
+
+Done when a new user can leave coulomb.social, register, and return through
+the same callback/JIT path without open redirects.
+
+The application entry point is implemented and ignores browser-supplied
+redirect parameters. It remains disabled until the NetKingdom public
+registration URL and verified-mail flow are deployed.
+
+## T03 - Support profile/action step-up
+
+```task
+id: CSOC-WP-0003-T03
+status: done
+priority: high
+state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"
+```
+
+Use AAL1 for ordinary member sessions. When profile policy or a protected
+action requires MFA, restart authorization with AAL2 acr_values and verify the
+returned assurance claim before completing the action.
+
+Done when tegwick can use ordinary login without MFA and opt into or encounter
+MFA step-up without affecting another member.
+
+Implemented explicit `?assurance=aal2`, OIDC `acr_values`, and callback-side
+assurance validation. Ordinary login sends no ACR request.
+
+## T04 - Deploy and run Case A / Case B matrix
+
+```task
+id: CSOC-WP-0003-T04
+status: todo
+priority: high
+state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
+```
+
+Test known LLDAP user, new registration, repeated/concurrent callback,
+email collision, state replay, disabled identity, local-account coexistence,
+password-only login, AAL2 step-up, logout, and rollback on railiance01.
+
+Done when both requested cases pass with non-secret evidence.