coulomb-social/workplans/CSOC-WP-0003-self-registration-and-assurance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	depends_on	state_hub_workstream_id
CSOC-WP-0003	workplan	Add NetKingdom self-registration and profile-aware assurance	communication	coulomb-social	active	codex	coulomb-social	2026-08-09	2026-08-09	CSOC-WP-0002 NK-WP-0025 USER-WP-0022 KEY-WP-0008	7cd7d6b8-e01d-4b34-8680-3c0cac68d80e

CSOC-WP-0003 - self-registration and assurance

Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account creation entry point and optional profile/action step-up.

T01 - Preserve and prove first-login JIT profile creation

id: CSOC-WP-0003-T01
status: done
priority: high
state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"

Harden the existing issuer/subject keyed Member creation, concurrent callback behavior, verified ID-token processing, and user-engine link. Preserve the current uncommitted CSOC-WP-0002 claim-verification work.

Done when an existing LLDAP identity gets exactly one ordinary Member and repeat login updates safe display fields without changing identity ownership.

Covered by the issuer/subject uniqueness constraint, unusable local passwords, idempotent session establishment tests, and verified ID-token claim handling.

T02 - Add Create NetKingdom account

id: CSOC-WP-0003-T02
status: progress
priority: high
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"

Add a landing-page registration choice using the configured NetKingdom public registration URL. The configured URL owns any signed return context. Completion must start a fresh OIDC flow before creating an application session.

Done when a new user can leave coulomb.social, register, and return through the same callback/JIT path without open redirects.

The application entry point is implemented and ignores browser-supplied redirect parameters. It remains disabled until the NetKingdom public registration URL and verified-mail flow are deployed.

T03 - Support profile/action step-up

id: CSOC-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"

Use AAL1 for ordinary member sessions. When profile policy or a protected action requires MFA, restart authorization with AAL2 acr_values and verify the returned assurance claim before completing the action.

Done when tegwick can use ordinary login without MFA and opt into or encounter MFA step-up without affecting another member.

Implemented explicit ?assurance=aal2, OIDC acr_values, and callback-side assurance validation. Ordinary login sends no ACR request.

T04 - Deploy and run Case A / Case B matrix

id: CSOC-WP-0003-T04
status: todo
priority: high
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"

Test known LLDAP user, new registration, repeated/concurrent callback, email collision, state replay, disabled identity, local-account coexistence, password-only login, AAL2 step-up, logout, and rollback on railiance01.

Done when both requested cases pass with non-secret evidence.