coulomb-social/workplans/CSOC-WP-0003-self-registration-and-assurance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	depends_on	state_hub_workstream_id
CSOC-WP-0003	workplan	Add NetKingdom self-registration and profile-aware assurance	communication	coulomb-social	finished	bernd	coulomb-social	2026-08-09	2026-08-14	CSOC-WP-0002 NK-WP-0025 USER-WP-0022 KEY-WP-0008	7cd7d6b8-e01d-4b34-8680-3c0cac68d80e

CSOC-WP-0003 - self-registration and assurance

Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account creation entry point and optional profile/action step-up.

Finished 2026-08-12; acceptance reconciled 2026-08-14: existing-user login on app.coulomb.social is proven (tegwick, AAL1). Public Case B subsequently completed disposable mailbox verification, KeyCape PKCE, Member JIT, and a repeat login retaining exactly one Member under NK-WP-0025.

T01 - Preserve and prove first-login JIT profile creation

id: CSOC-WP-0003-T01
status: done
priority: high
state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"

Harden issuer/subject keyed Member creation, concurrent callback behavior, verified ID-token processing, and user-engine link.

2026-08-10 evidence: live login on app.coulomb.social shows principal + user-engine id; image :f5537d8 uses id_token when /userinfo 401s.

T02 - Add Create NetKingdom account

id: CSOC-WP-0003-T02
status: done
priority: medium
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"

Landing-page Create account using configured NETKINGDOM_REGISTRATION_URL. App entry implemented (/auth/register/, context processor, tests). Button hidden until env URL is set. Enablement residual: CSOC-IN-0001 after NK-WP-0025 publishes registration + verified-mail flow.

T03 - Support profile/action step-up

id: CSOC-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"

AAL1 ordinary sessions; AAL2 via acr_values when required. Live coulomb-social client uses mfaRequired: false.

T04 - Deploy and run Case A / Case B matrix

id: CSOC-WP-0003-T04
status: done
priority: medium
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"

Case	Status
A — known LLDAP user, first/repeat login on app.*	done (tegwick)
B — brand-new public registration → OIDC → Member	done 2026-08-14 (NK-WP-0025)

The negative checklist is reconciled in docs/identity/smoke.md. Redirect, issuer+subject idempotency, and assurance checks passed; CSOC-IN-0002 is narrowed to direct callback-replay and email-only takeover regressions.

Residuals (live records)

Id	Role
CSOC-IN-0001	closed — Create account and Case B are live and evidenced
CSOC-IN-0002	open, narrowed — callback replay and email-only takeover regressions

Source: docs/intakes/csoc-residuals.md.