Finish portal OIDC integration

workplans/KEY-WP-0007-user-engine-portal-oidc-client.md

@@ -4,11 +4,11 @@ type: workplan
 title: "User-engine portal OIDC relying-party integration"
 domain: infotech
 repo: key-cape
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-28"
+updated: "2026-07-29"
 depends_on:
   - KEY-WP-0005
   - USER-WP-0020
@@ -51,7 +51,7 @@ unregistered callback denial and successful token exchange through the portal.
 
 ```task
 id: KEY-WP-0007-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2"
 ```
@@ -71,3 +71,11 @@ ambiguous multi-tenant directory envelopes fail closed to no explicit tenant.
 the `netkingdom-suspended` directory group. The portal admin surface uses this
 through the provider-neutral lifecycle API. The human Binky MFA/claims
 acceptance remains the final part of this task.
+
+2026-07-29 complete: the reusable browser path issued the Binky password
+handoff, completed privacyIDEA TOTP enrollment, and returned through the
+portal authorization-code flow. `/api/v1/me` verified the canonical issuer,
+`user-engine-portal` audience, `tenant:friendly:binky`, Binky-only groups,
+roles `user` + `tenant-admin`, and AAL2 assurance with `pwd` + `otp` and
+`mfa: true`. The same session was denied administration of
+`tenant:platform` and `tenant:coulomb`. All workplan tasks are complete.