Reconcile public registration acceptance residuals

WORK-RECORDS.md

@@ -46,7 +46,7 @@
 | task | CSOC-WP-0006-T04 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md |
 | task | CSOC-WP-0006-T05 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md |
 | task | CSOC-WP-0006-T06 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md |
-| intake | CSOC-IN-0001 | open | blue | docs/intakes/csoc-residuals.md |
+| intake | CSOC-IN-0001 | closed | blue | docs/intakes/csoc-residuals.md |
 | intake | CSOC-IN-0002 | open | green | docs/intakes/csoc-residuals.md |
 | intake | CSOC-IN-0003 | open | blue | docs/intakes/csoc-residuals.md |
 | intake | CSOC-IN-0004 | open | green | docs/intakes/csoc-residuals.md |

docs/identity/smoke.md

@@ -1,6 +1,6 @@
 # Identity smoke checklist
 
-Evidence updated: **2026-08-12**.
+Evidence updated: **2026-08-14**.
 
 ## Offline (dev claims) — **passed**
 
@@ -39,8 +39,8 @@ logout → app 302 to /auth/login/?next=/app/
 | Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
 | Landing | 200; **Sign in** present |
 | Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
-| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
+| Create account | enabled; `/auth/register/` redirects to the configured NetKingdom URL |
-| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
+| Case B — public registration → OIDC → Member | **done** via disposable mailbox, KeyCape PKCE callback, and Member JIT (`NK-WP-0025`) |
 | Apex | **do not** repoint until Bubble retirement |
 
 ### Product smoke (spaces — after deploy + seed)
@@ -87,25 +87,26 @@ Content plane: `CONTENT_ROOT` (default `var/content/`) with
 | Case | Status |
 |------|--------|
 | A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
-| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
+| B — brand-new public registration → OIDC → Member | **done 2026-08-14**; repeat login retained exactly one Member |
 
-### Negatives to run when Case B unblocks (or ad-hoc)
+### Identity negatives
 
-Record results here or in residual notes; residual `CSOC-IN-0002`.
+The completed checks below are backed by application tests and NK-WP-0025 live
+evidence. Two focused callback/account-takeover checks remain in
+`CSOC-IN-0002`.
 
 | Negative | Intent |
 |----------|--------|
-| State / nonce replay | callback with recycled `state` fails closed |
+| State / nonce replay | **remaining** — add direct callback replay regression |
-| Subject collision | same issuer+subject always one Member |
+| Subject collision | **passed** — repeat live login and idempotency test retain one Member |
-| Email-only collision | email must not take over another subject |
+| Email-only collision | **remaining** — add explicit different-subject/same-email takeover regression |
-| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
+| Step-up ACR | **passed** — explicit AAL2 request and insufficient-assurance rejection are policy-covered |
-| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
+| Registration open redirect | **passed** — `/auth/register/` ignores hostile `?next=` and uses only configured URL |
 
 App registration entry (when URL configured):
 
 ```bash
-# only after NetKingdom publishes public registration URL
+# NETKINGDOM_REGISTRATION_URL is published in coulomb-social-env (no secret)
-# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
 ```
 
 ## Platform OIDC (local redirect) — optional

docs/intakes/csoc-residuals.md

@@ -12,7 +12,7 @@ id: CSOC-IN-0001
 kind: intake
 title: "Enable Create account and Case B registration smoke on app.coulomb.social"
 lane: blue
-status: open
+status: closed
 priority: medium
 owner: coulomb-social
 repo: coulomb-social
@@ -35,8 +35,10 @@ description: |
 
   DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
 notes: |
-  Depends on NK-WP-0025 (registration orchestration + mail path).
+  Closed 2026-08-14. NK-WP-0025 published the registration URL and completed
-  Related: CSOC-IN-0002 (identity negatives after Case B).
+  disposable mailbox verification, KeyCape PKCE, Member JIT, and repeat-login
+  evidence. The live app redirect uses the configured URL only.
+  Related: narrowed CSOC-IN-0002 for two focused regression checks.
 state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
 ```
 
@@ -47,7 +49,7 @@ state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
 ```yaml
 id: CSOC-IN-0002
 kind: intake
-title: "Record identity negatives: state replay, collision, step-up"
+title: "Add callback replay and email-only takeover regressions"
 lane: green
 status: open
 priority: low
@@ -56,19 +58,17 @@ repo: coulomb-social
 origin: residual
 origin_ref: CSOC-WP-0003
 description: |
-  CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed
+  Case B, repeat-login issuer+subject idempotency, registration redirect
-  in docs/identity/smoke.md should be executed when Case B unblocks (or sooner
+  confinement, and AAL1/AAL2 isolation are now proven. Add direct application
-  offline/dev if useful):
+  regressions for the two checks not yet independently covered:
 
-  - OIDC state/nonce replay
+  - a consumed/replayed OIDC callback state fails closed; and
-  - issuer+subject collision (single Member)
+  - the same email with a different issuer+subject cannot take over a Member.
-  - email-only must not take over another subject
-  - step-up ACR rejection when assurance insufficient
-  - registration redirect allow-list only
 
-  Capture pass/fail in docs/identity/smoke.md; close this intake when recorded.
+  Capture the results in docs/identity/smoke.md and close this intake.
 notes: |
-  Pulls from CSOC-IN-0001 for live registration path; some checks can run offline.
+  Narrowed 2026-08-14 after NK-WP-0025 completed live Case B. No longer blocked
+  on the registration or mailbox path.
 state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"
 ```
 
@@ -136,4 +136,3 @@ notes: |
   Pickup: docs/session-pickup.md
 state_hub_intake_id: "019ffac3-fc7d-7850-93b6-b0d289881ec7"
 ```
-

workplans/CSOC-WP-0003-self-registration-and-assurance.md

@@ -8,7 +8,7 @@ status: finished
 owner: bernd
 topic_slug: coulomb-social
 created: "2026-08-09"
-updated: "2026-08-12"
+updated: "2026-08-14"
 depends_on:
   - CSOC-WP-0002
   - NK-WP-0025
@@ -22,10 +22,10 @@ state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
 Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
 creation entry point and optional profile/action step-up.
 
-**Finished 2026-08-12:** app-side work complete. Existing-user login on
+**Finished 2026-08-12; acceptance reconciled 2026-08-14:** existing-user login
-**`app.coulomb.social`** is proven (tegwick, AAL1). Landing **Create account**
+on **`app.coulomb.social`** is proven (tegwick, AAL1). Public Case B subsequently
-is implemented and gated on `NETKINGDOM_REGISTRATION_URL`. Public Case B waits
+completed disposable mailbox verification, KeyCape PKCE, Member JIT, and a
-on NetKingdom mailbox verification (`NK-WP-0025`) — residuals below.
+repeat login retaining exactly one Member under NK-WP-0025.
 
 ## T01 - Preserve and prove first-login JIT profile creation
 
@@ -80,16 +80,17 @@ state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
 | Case | Status |
 |------|--------|
 | A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
-| B — brand-new public registration → OIDC → Member | residual **CSOC-IN-0001** (NK mailbox) |
+| B — brand-new public registration → OIDC → Member | **done 2026-08-14** (`NK-WP-0025`) |
 
-Negatives checklist parked in `docs/identity/smoke.md`; execution residual
+The negative checklist is reconciled in `docs/identity/smoke.md`. Redirect,
-**CSOC-IN-0002**.
+issuer+subject idempotency, and assurance checks passed; `CSOC-IN-0002` is
+narrowed to direct callback-replay and email-only takeover regressions.
 
 ## Residuals (live records)
 
 | Id | Role |
 |----|------|
-| `CSOC-IN-0001` | Enable Create account + Case B smoke when NK registration URL ships |
+| `CSOC-IN-0001` | **closed** — Create account and Case B are live and evidenced |
-| `CSOC-IN-0002` | Record identity negatives (replay, collision, step-up) |
+| `CSOC-IN-0002` | **open, narrowed** — callback replay and email-only takeover regressions |
 
 Source: `docs/intakes/csoc-residuals.md`.