---
id: CSOC-WP-0003
type: workplan
title: "Add NetKingdom self-registration and profile-aware assurance"
domain: communication
repo: coulomb-social
status: active
owner: codex
topic_slug: coulomb-social
created: "2026-08-09"
updated: "2026-08-09"
depends_on:
  - CSOC-WP-0002
  - NK-WP-0025
  - USER-WP-0022
  - KEY-WP-0008
state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
---

# CSOC-WP-0003 - self-registration and assurance

Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
creation entry point and optional profile/action step-up.

## T01 - Preserve and prove first-login JIT profile creation

```task
id: CSOC-WP-0003-T01
status: done
priority: high
state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"
```

Harden the existing issuer/subject keyed Member creation, concurrent callback
behavior, verified ID-token processing, and user-engine link. Preserve the
current uncommitted CSOC-WP-0002 claim-verification work.

Done when an existing LLDAP identity gets exactly one ordinary Member and
repeat login updates safe display fields without changing identity ownership.

Covered by the issuer/subject uniqueness constraint, unusable local passwords,
idempotent session establishment tests, and verified ID-token claim handling.

## T02 - Add Create NetKingdom account

```task
id: CSOC-WP-0003-T02
status: progress
priority: high
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"
```

Add a landing-page registration choice using the configured NetKingdom public
registration URL. The configured URL owns any signed return context. Completion must
start a fresh OIDC flow before creating an application session.

Done when a new user can leave coulomb.social, register, and return through
the same callback/JIT path without open redirects.

The application entry point is implemented and ignores browser-supplied
redirect parameters. It remains disabled until the NetKingdom public
registration URL and verified-mail flow are deployed.

## T03 - Support profile/action step-up

```task
id: CSOC-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"
```

Use AAL1 for ordinary member sessions. When profile policy or a protected
action requires MFA, restart authorization with AAL2 acr_values and verify the
returned assurance claim before completing the action.

Done when tegwick can use ordinary login without MFA and opt into or encounter
MFA step-up without affecting another member.

Implemented explicit `?assurance=aal2`, OIDC `acr_values`, and callback-side
assurance validation. Ordinary login sends no ACR request.

## T04 - Deploy and run Case A / Case B matrix

```task
id: CSOC-WP-0003-T04
status: todo
priority: high
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
```

Test known LLDAP user, new registration, repeated/concurrent callback,
email collision, state replay, disabled identity, local-account coexistence,
password-only login, AAL2 step-up, logout, and rollback on railiance01.

Done when both requested cases pass with non-secret evidence.