Record deployed provisioner evidence

workplans/NK-WP-0023-user-engine-portal-platform-integration.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-27"
+updated: "2026-07-28"
 depends_on:
   - USER-WP-0020
   - KEY-WP-0004
@@ -53,6 +53,14 @@ transport. Never expose directory admin credentials to the browser or
 user-engine domain. Add reconciliation, retry, compensation, and drift
 reporting rather than assuming a distributed transaction.
 
+2026-07-28 implementation evidence: `identity-provisioner` now implements the
+provider-neutral lifecycle API over LLDAP and runs as a non-root, internal-only
+service in `sso`. Its directory credential remains confined to that pod;
+user-engine receives only a namespace-local bearer token. NetworkPolicy allows
+only user-engine to call it and only LLDAP/DNS egress. A live create/replay/delete
+conformance run returned `resumed: false`, then `resumed: true`, and removed the
+disposable subject. Reconciliation, compensation, and drift reporting remain.
+
 ## T03 - Integrate KeyCape login, claims, and MFA handoffs
 
 ```task
@@ -114,11 +122,17 @@ Public ingress remains intentionally absent until T03 supplies the verified
 KeyCape OIDC edge. Forgejo OCI publication is pending restoration of the
 OpenBao package-publisher capability; no credential was bypassed or exposed.
 
+2026-07-28 update: public TLS ingress and KeyCape OIDC are active. The current
+`user-engine:portal-b2f1185` deployment is healthy with the dedicated CNPG
+cluster, and the companion `identity-provisioner:dbf7cfd` deployment is
+healthy behind namespace-scoped credentials and default-deny policy. Registry
+publication, backup/restore evidence, metrics, and automated rollback remain.
+
 ## T06 - Prove role-scoped administration and failure safety
 
 ```task
 id: NK-WP-0023-T06
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "96a7cd2b-6cab-47ab-a899-44bc0f6da58c"
 ```
@@ -128,6 +142,12 @@ first-admin bootstrap, invitations, suspension/reactivation, cross-tenant
 denial, platform-admin-only actions, provider outages, replay/idempotency,
 backup restore, and reconciliation after partial failure.
 
+2026-07-28 evidence: deployed-path health, service authentication, directory
+creation, replay-safe linking, tenant user/admin group creation, and cleanup
+passed. The test also detected and corrected newline handling for mounted
+Kubernetes secrets before any identity was created. The broader negative,
+outage, suspension, restore, and browser/MFA matrix remains.
+
 ## T07 - Complete KEY-WP-0004 through the reusable portal
 
 ```task