tegwick
edfdd79208
Close self-registration workplan with Case A proven and Create account entry implemented; park public registration enablement and identity negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06 operator runbook (seed, bind, webhook, smoke) and smoke doc updates.
73 lines
2.4 KiB
Markdown
73 lines
2.4 KiB
Markdown
# coulomb-social residual intakes
|
|
|
|
File-backed intakes for leftovers from finished workplans. Canon: work-record
|
|
types § Residuals (`origin: residual`, `origin_ref: <WP-id>`).
|
|
|
|
---
|
|
|
|
## CSOC-IN-0001 — Enable public Create account + Case B smoke
|
|
|
|
```yaml
|
|
id: CSOC-IN-0001
|
|
kind: intake
|
|
title: "Enable Create account and Case B registration smoke on app.coulomb.social"
|
|
lane: blue
|
|
status: open
|
|
priority: medium
|
|
owner: coulomb-social
|
|
repo: coulomb-social
|
|
origin: residual
|
|
origin_ref: CSOC-WP-0003
|
|
description: |
|
|
App entry for Create account is implemented (NETKINGDOM_REGISTRATION_URL,
|
|
/auth/register/, landing button). Public enablement waits on NetKingdom
|
|
mailbox verification and published registration URL (NK-WP-0025 / USER-WP-0022).
|
|
|
|
When the platform registration URL is live:
|
|
|
|
1. Set NETKINGDOM_REGISTRATION_URL on coulomb-social-env (names only in git;
|
|
example shape in .env.example).
|
|
2. Confirm landing shows Create account and /auth/register/ redirects only to
|
|
that URL (no open redirect via ?next=).
|
|
3. Run Case B: brand-new public registration → verified mail → OIDC → first
|
|
Member JIT on app.coulomb.social.
|
|
4. Record evidence under docs/identity/smoke.md.
|
|
|
|
DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
|
|
notes: |
|
|
Depends on NK-WP-0025 (registration orchestration + mail path).
|
|
Related: CSOC-IN-0002 (identity negatives after Case B).
|
|
state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
|
|
```
|
|
|
|
---
|
|
|
|
## CSOC-IN-0002 — Identity negative matrix after Case B
|
|
|
|
```yaml
|
|
id: CSOC-IN-0002
|
|
kind: intake
|
|
title: "Record identity negatives: state replay, collision, step-up"
|
|
lane: green
|
|
status: open
|
|
priority: low
|
|
owner: coulomb-social
|
|
repo: coulomb-social
|
|
origin: residual
|
|
origin_ref: CSOC-WP-0003
|
|
description: |
|
|
CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed
|
|
in docs/identity/smoke.md should be executed when Case B unblocks (or sooner
|
|
offline/dev if useful):
|
|
|
|
- OIDC state/nonce replay
|
|
- issuer+subject collision (single Member)
|
|
- email-only must not take over another subject
|
|
- step-up ACR rejection when assurance insufficient
|
|
- registration redirect allow-list only
|
|
|
|
Capture pass/fail in docs/identity/smoke.md; close this intake when recorded.
|
|
notes: |
|
|
Pulls from CSOC-IN-0001 for live registration path; some checks can run offline.
|
|
state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"
|
|
```
|