---
id: CSOC-WP-0003
type: workplan
title: "Add NetKingdom self-registration and profile-aware assurance"
domain: communication
repo: coulomb-social
status: finished
owner: bernd
topic_slug: coulomb-social
created: "2026-08-09"
updated: "2026-08-14"
depends_on:
  - CSOC-WP-0002
  - NK-WP-0025
  - USER-WP-0022
  - KEY-WP-0008
state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
---

# CSOC-WP-0003 - self-registration and assurance

Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
creation entry point and optional profile/action step-up.

**Finished 2026-08-12; acceptance reconciled 2026-08-14:** existing-user login
on **`app.coulomb.social`** is proven (tegwick, AAL1). Public Case B subsequently
completed disposable mailbox verification, KeyCape PKCE, Member JIT, and a
repeat login retaining exactly one Member under NK-WP-0025.

## T01 - Preserve and prove first-login JIT profile creation

```task
id: CSOC-WP-0003-T01
status: done
priority: high
state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"
```

Harden issuer/subject keyed Member creation, concurrent callback behavior,
verified ID-token processing, and user-engine link.

**2026-08-10 evidence:** live login on app.coulomb.social shows principal +
user-engine id; image `:f5537d8` uses id_token when `/userinfo` 401s.

## T02 - Add Create NetKingdom account

```task
id: CSOC-WP-0003-T02
status: done
priority: medium
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"
```

Landing-page **Create account** using configured `NETKINGDOM_REGISTRATION_URL`.
App entry implemented (`/auth/register/`, context processor, tests). Button
hidden until env URL is set. **Enablement residual:** `CSOC-IN-0001` after
NK-WP-0025 publishes registration + verified-mail flow.

## T03 - Support profile/action step-up

```task
id: CSOC-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"
```

AAL1 ordinary sessions; AAL2 via `acr_values` when required. Live coulomb-social
client uses `mfaRequired: false`.

## T04 - Deploy and run Case A / Case B matrix

```task
id: CSOC-WP-0003-T04
status: done
priority: medium
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
```

| Case | Status |
|------|--------|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
| B — brand-new public registration → OIDC → Member | **done 2026-08-14** (`NK-WP-0025`) |

The negative checklist is reconciled in `docs/identity/smoke.md`. Redirect,
issuer+subject idempotency, and assurance checks passed; `CSOC-IN-0002` is
narrowed to direct callback-replay and email-only takeover regressions.

## Residuals (live records)

| Id | Role |
|----|------|
| `CSOC-IN-0001` | **closed** — Create account and Case B are live and evidenced |
| `CSOC-IN-0002` | **open, narrowed** — callback replay and email-only takeover regressions |

Source: `docs/intakes/csoc-residuals.md`.