diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 369d435..d2abad8 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -50,7 +50,7 @@
 | task | NK-WP-0022-T07 | wait | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
 | task | NK-WP-0022-T08 | wait | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
 | task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
-| task | NK-WP-0023-T02 | progress | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
+| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
 | task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
 | task | NK-WP-0023-T04 | wait | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
 | task | NK-WP-0023-T05 | progress | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
diff --git a/docs/user-engine-enterprise-identity-extension-points.md b/docs/user-engine-enterprise-identity-extension-points.md
index f70360d..26751e9 100644
--- a/docs/user-engine-enterprise-identity-extension-points.md
+++ b/docs/user-engine-enterprise-identity-extension-points.md
@@ -85,3 +85,21 @@ Enterprise implementation begins only when a named tenant supplies:
 - test tenant and rollback owner.
 
 Until then, local LLDAP plus KeyCape remains the managed identity path.
+
+## Provider reconciliation contract
+
+The local LLDAP adapter establishes the provider-neutral operational pattern
+that later enterprise adapters must preserve:
+
+- `drift` performs a read-only comparison of desired identity, tenant groups,
+  roles, and lifecycle status;
+- `reconcile` converges only adapter-owned attributes and reports every change;
+- ambiguous email/subject conflicts fail for explicit repair instead of
+  silently relinking an identity;
+- newly created identities are compensated when initial group projection
+  cannot complete;
+- deprovisioning is replay-safe, and transient transport failures may be
+  retried only with the caller's required idempotency key.
+
+SCIM and directory-synchronization adapters should implement this same seam
+instead of adding provider-specific repair behavior to user-engine.
diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml
index d961329..0897fd4 100644
--- a/sso-mfa/k8s/identity-provisioner/deployment.yaml
+++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml
@@ -23,7 +23,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: identity-provisioner:80adc31
+          image: identity-provisioner:12cdef5
           imagePullPolicy: Never
           ports: [{name: http, containerPort: 8080}]
           env:
diff --git a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md
index c8aac84..72b04d5 100644
--- a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md
+++ b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md
@@ -41,7 +41,7 @@ now so later enterprise directories do not require a domain rewrite.
 
 ```task
 id: NK-WP-0023-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "89fe51aa-f351-4763-a358-3eec79f28350"
 ```
@@ -61,6 +61,16 @@ only user-engine to call it and only LLDAP/DNS egress. A live create/replay/dele
 conformance run returned `resumed: false`, then `resumed: true`, and removed the
 disposable subject. Reconciliation, compensation, and drift reporting remain.
 
+2026-07-29 completion: image `identity-provisioner:12cdef5` adds read-only
+drift inspection, active convergence of adapter-owned tenant groups and
+suspension state, replay-safe deprovisioning, and best-effort compensation
+when initial group projection fails. User-engine exposes these operations
+through its provider-neutral port and retries one transient failure only under
+the mandatory idempotency key. A disposable live probe proved clean initial
+state, detected induced suspension drift, reported both the unexpected group
+and status mismatch, removed the drift, returned to `in_sync`, deprovisioned,
+and accepted the repeated deletion. The probe identity was removed.
+
 ## T03 - Integrate KeyCape login, claims, and MFA handoffs
 
 ```task
@@ -188,6 +198,11 @@ passed. The test also detected and corrected newline handling for mounted
 Kubernetes secrets before any identity was created. The broader negative,
 outage, suspension, restore, and browser/MFA matrix remains.
 
+2026-07-29 increment: provider-path conformance now also covers
+machine-readable drift detection, automated repair, compensation semantics,
+transient retry, and replay-safe deletion. The broader browser, authorization,
+provider-outage, and restore matrix remains open.
+
 ## T07 - Complete KEY-WP-0004 through the reusable portal
 
 ```task