tegwick
d36795faa6
Mark CSOC-WP-0002 identity done on app.coulomb.social. Defer bulk Bubble migration until product foundation exists. Open CSOC-WP-0004 for post-login entry and space content as markdown bound to Forgejo.
2.4 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | depends_on | state_hub_workstream_id | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CSOC-WP-0003 | workplan | Add NetKingdom self-registration and profile-aware assurance | communication | coulomb-social | active | bernd | coulomb-social | 2026-08-09 | 2026-08-10 |
|
7cd7d6b8-e01d-4b34-8680-3c0cac68d80e |
CSOC-WP-0003 - self-registration and assurance
Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account creation entry point and optional profile/action step-up.
2026-08-10 posture: existing-user login on app.coulomb.social is proven
(tegwick, AAL1, no MFA). Public Create account remains blocked on NetKingdom
mailbox verification (NK-WP-0025 / USER-WP-0022). Product work proceeds via
CSOC-WP-0004 without waiting on public registration.
T01 - Preserve and prove first-login JIT profile creation
id: CSOC-WP-0003-T01
status: done
priority: high
state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"
Harden issuer/subject keyed Member creation, concurrent callback behavior, verified ID-token processing, and user-engine link.
2026-08-10 evidence: live login on app.coulomb.social shows principal +
user-engine id; image :f5537d8 uses id_token when /userinfo 401s.
T02 - Add Create NetKingdom account
id: CSOC-WP-0003-T02
status: progress
priority: medium
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"
Landing-page Create account using configured NETKINGDOM_REGISTRATION_URL.
App entry is implemented; remains disabled until NetKingdom public registration
URL + verified-mail flow ship.
T03 - Support profile/action step-up
id: CSOC-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"
AAL1 ordinary sessions; AAL2 via acr_values when required. Live coulomb-social
client uses mfaRequired: false.
T04 - Deploy and run Case A / Case B matrix
id: CSOC-WP-0003-T04
status: progress
priority: medium
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
| Case | Status |
|---|---|
| A — known LLDAP user, first/repeat login on app.* | done (tegwick) |
| B — brand-new public registration → OIDC → Member | blocked on NK mailbox verification |
Record remaining negatives (state replay, collision, step-up) when Case B unblocks
or in a short follow-up smoke note under docs/identity/smoke.md.