KEY-WP-0008: honor per-client mfaRequired and acr_values step-up

Allow coulomb-social ordinary login at AAL1 via mfaRequired: false while
keeping provider requireForAll for clients without an override. Preserve
explicit acr_values=aal2 for step-up.

workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md

@@ -0,0 +1,97 @@
+---
+id: KEY-WP-0008
+type: workplan
+title: "Registration handoff and client-aware MFA policy"
+domain: infotech
+repo: key-cape
+status: active
+owner: codex
+topic_slug: netkingdom
+created: "2026-08-09"
+updated: "2026-08-09"
+depends_on:
+  - NK-WP-0025
+state_hub_workstream_id: "70b78f21-be6d-4d6c-a537-037c38b2884a"
+---
+
+# KEY-WP-0008 - registration handoff and client-aware MFA
+
+Let a registered OIDC client offer NetKingdom signup and request step-up
+without making KeyCape an account store or weakening high-assurance clients.
+
+## T01 - Add a safe registration handoff
+
+```task
+id: KEY-WP-0008-T01
+status: done
+priority: high
+state_hub_task_id: "31627b02-4300-4f11-a8bb-8ff2bebb9566"
+```
+
+Define an allow-listed registration URL for eligible clients and preserve
+client ID, redirect URI, PKCE intent, tenant hint, and return context in a
+signed, expiring state envelope. Registration completion must restart the
+normal authorization flow and must not mint a token directly.
+
+Done when unknown users can choose signup from an eligible authorization flow
+without open redirect, client substitution, or state replay.
+
+## T02 - Replace global MFA with client-aware minimum assurance
+
+```task
+id: KEY-WP-0008-T02
+status: progress
+priority: high
+state_hub_task_id: "c2b56182-e717-4ca3-84e3-0963b69ce32f"
+```
+
+Replace the single require-for-all switch with policy that combines client
+minimum assurance, requested ACR/step-up, tenant policy, protected action, and
+current session assurance. Preserve mandatory MFA for platform/admin clients.
+Allow coulomb-social ordinary login at password assurance when no stronger
+rule applies.
+
+Done when one low-assurance client cannot suppress MFA for another client or
+reuse an under-assured session for a high-assurance request.
+
+Implemented with nullable per-client `mfaRequired`: an explicit client value
+overrides the provider default only for that client. Absent values preserve
+the existing provider-driven policy.
+
+## T03 - Support explicit step-up and fresh authentication
+
+```task
+id: KEY-WP-0008-T03
+status: done
+priority: high
+state_hub_task_id: "bfa56396-1b94-4404-a4d5-fc5b4ae2b8e8"
+```
+
+Implement supported ACR/max-age or equivalent IAM Profile parameters, invoke
+privacyIDEA only when policy requires it, and return verifiable assurance
+claims. Handle users without an enrolled factor through a safe enrollment
+handoff rather than an authorization bypass.
+
+Done when coulomb.social can request MFA for a profile/action and verify the
+result from token claims.
+
+Implemented `acr_values` preservation and AAL2/MFA forcing through the
+privacyIDEA challenge. The existing token `assurance` claim reports `aal2`
+and `mfa: true` only after successful verification.
+
+## T04 - Prove policy isolation and compatibility
+
+```task
+id: KEY-WP-0008-T04
+status: todo
+priority: high
+state_hub_task_id: "d4208f77-f4a6-4f2e-a436-de4f779cfaca"
+```
+
+Test known and unknown users, registration link eligibility, state expiry and
+replay, password-only coulomb-social login, profile/action step-up, no-factor
+enrollment, OpenBao mandatory MFA, cross-client session reuse, and logout.
+Keep static client registration and exact redirect rules unchanged.
+
+Done when existing high-assurance clients pass unchanged and the new
+coulomb-social journey passes live.