Reconcile public registration acceptance residuals

docs/identity/smoke.md

@@ -1,6 +1,6 @@
 # Identity smoke checklist
 
-Evidence updated: **2026-08-12**.
+Evidence updated: **2026-08-14**.
 
 ## Offline (dev claims) — **passed**
 
@@ -39,8 +39,8 @@ logout → app 302 to /auth/login/?next=/app/
 | Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
 | Landing | 200; **Sign in** present |
 | Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
-| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
-| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
+| Create account | enabled; `/auth/register/` redirects to the configured NetKingdom URL |
+| Case B — public registration → OIDC → Member | **done** via disposable mailbox, KeyCape PKCE callback, and Member JIT (`NK-WP-0025`) |
 | Apex | **do not** repoint until Bubble retirement |
 
 ### Product smoke (spaces — after deploy + seed)
@@ -87,25 +87,26 @@ Content plane: `CONTENT_ROOT` (default `var/content/`) with
 | Case | Status |
 |------|--------|
 | A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
-| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
+| B — brand-new public registration → OIDC → Member | **done 2026-08-14**; repeat login retained exactly one Member |
 
-### Negatives to run when Case B unblocks (or ad-hoc)
+### Identity negatives
 
-Record results here or in residual notes; residual `CSOC-IN-0002`.
+The completed checks below are backed by application tests and NK-WP-0025 live
+evidence. Two focused callback/account-takeover checks remain in
+`CSOC-IN-0002`.
 
 | Negative | Intent |
 |----------|--------|
-| State / nonce replay | callback with recycled `state` fails closed |
-| Subject collision | same issuer+subject always one Member |
-| Email-only collision | email must not take over another subject |
-| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
-| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
+| State / nonce replay | **remaining** — add direct callback replay regression |
+| Subject collision | **passed** — repeat live login and idempotency test retain one Member |
+| Email-only collision | **remaining** — add explicit different-subject/same-email takeover regression |
+| Step-up ACR | **passed** — explicit AAL2 request and insufficient-assurance rejection are policy-covered |
+| Registration open redirect | **passed** — `/auth/register/` ignores hostile `?next=` and uses only configured URL |
 
 App registration entry (when URL configured):
 
 ```bash
-# only after NetKingdom publishes public registration URL
-# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
+# NETKINGDOM_REGISTRATION_URL is published in coulomb-social-env (no secret)
 ```
 
 ## Platform OIDC (local redirect) — optional

docs/intakes/csoc-residuals.md

@@ -12,7 +12,7 @@ id: CSOC-IN-0001
 kind: intake
 title: "Enable Create account and Case B registration smoke on app.coulomb.social"
 lane: blue
-status: open
+status: closed
 priority: medium
 owner: coulomb-social
 repo: coulomb-social
@@ -35,8 +35,10 @@ description: |
 
   DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
 notes: |
-  Depends on NK-WP-0025 (registration orchestration + mail path).
-  Related: CSOC-IN-0002 (identity negatives after Case B).
+  Closed 2026-08-14. NK-WP-0025 published the registration URL and completed
+  disposable mailbox verification, KeyCape PKCE, Member JIT, and repeat-login
+  evidence. The live app redirect uses the configured URL only.
+  Related: narrowed CSOC-IN-0002 for two focused regression checks.
 state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
 ```
 
@@ -47,7 +49,7 @@ state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
 ```yaml
 id: CSOC-IN-0002
 kind: intake
-title: "Record identity negatives: state replay, collision, step-up"
+title: "Add callback replay and email-only takeover regressions"
 lane: green
 status: open
 priority: low
@@ -56,19 +58,17 @@ repo: coulomb-social
 origin: residual
 origin_ref: CSOC-WP-0003
 description: |
-  CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed
-  in docs/identity/smoke.md should be executed when Case B unblocks (or sooner
-  offline/dev if useful):
+  Case B, repeat-login issuer+subject idempotency, registration redirect
+  confinement, and AAL1/AAL2 isolation are now proven. Add direct application
+  regressions for the two checks not yet independently covered:
 
-  - OIDC state/nonce replay
-  - issuer+subject collision (single Member)
-  - email-only must not take over another subject
-  - step-up ACR rejection when assurance insufficient
-  - registration redirect allow-list only
+  - a consumed/replayed OIDC callback state fails closed; and
+  - the same email with a different issuer+subject cannot take over a Member.
 
-  Capture pass/fail in docs/identity/smoke.md; close this intake when recorded.
+  Capture the results in docs/identity/smoke.md and close this intake.
 notes: |
-  Pulls from CSOC-IN-0001 for live registration path; some checks can run offline.
+  Narrowed 2026-08-14 after NK-WP-0025 completed live Case B. No longer blocked
+  on the registration or mailbox path.
 state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"
 ```
 
@@ -136,4 +136,3 @@ notes: |
   Pickup: docs/session-pickup.md
 state_hub_intake_id: "019ffac3-fc7d-7850-93b6-b0d289881ec7"
 ```
-