Track and harden NK-WP-0025 residuals

WORK-RECORDS.md

@@ -9,6 +9,7 @@
 | Kind | ID | Status | Lane | Source |
 | --- | --- | --- | --- | --- |
 | workplan | adhoc-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
+| workplan | ADHOC-2026-08-14 | blocked | — | workplans/ADHOC-2026-08-14.md |
 | workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
 | workplan | NK-WP-0009 | backlog | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
 | workplan | NK-WP-0011 | backlog | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
@@ -19,6 +20,9 @@
 | workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
 | task | ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
+| task | ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
+| task | ADHOC-2026-08-14-T03 | wait | — | workplans/ADHOC-2026-08-14.md |
 | task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
 | task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
 | task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |

identity-provisioner/tests/test_provisioner.py

@@ -3,7 +3,15 @@ import sys
 import unittest
 
 sys.path.insert(0, str(pathlib.Path(__file__).parents[1]))
-from provisioner import _username, dispatch, DriftResult, LLDAPProvisioner, Result
+from provisioner import (
+    _directory_username,
+    _oidc_subject,
+    _username,
+    dispatch,
+    DriftResult,
+    LLDAPProvisioner,
+    Result,
+)
 
 
 class Fake:
@@ -19,6 +27,17 @@ class ProvisionerTests(unittest.TestCase):
     def test_username_is_stable_and_sanitized(self):
         self.assertEqual("bernd.worsch", _username("Bernd.Worsch@binky-hedgehog.com"))
 
+    def test_oidc_subject_is_canonical_ldap_dn(self):
+        self.assertEqual(
+            "uid=bernd.worsch,ou=people,dc=netkingdom,dc=local",
+            _oidc_subject("bernd.worsch"),
+        )
+
+    def test_directory_lifecycle_normalizes_canonical_ldap_dn(self):
+        subject = "uid=bernd.worsch,ou=people,dc=netkingdom,dc=local"
+        self.assertEqual("bernd.worsch", _directory_username(subject))
+        self.assertEqual("bernd.worsch", _directory_username("bernd.worsch"))
+
     def test_preferred_username_is_honored_and_validated(self):
         self.assertEqual("chosen.name", _username("other@example.test", "Chosen.Name"))
         with self.assertRaisesRegex(ValueError, "invalid"):

workplans/ADHOC-2026-08-14.md

@@ -0,0 +1,62 @@
+---
+id: ADHOC-2026-08-14
+type: workplan
+title: "Close NK-WP-0025 residuals"
+domain: infotech
+repo: net-kingdom
+status: blocked
+owner: codex
+topic_slug: netkingdom
+created: "2026-08-14"
+updated: "2026-08-14"
+state_hub_workstream_id: "f65863fd-1010-4d1e-a8ec-571b9f302d2a"
+state_hub_workstream_id: "f65863fd-1010-4d1e-a8ec-571b9f302d2a"
+---
+
+# ADHOC-2026-08-14 - NK-WP-0025 residual closeout
+
+## Reconcile Coulomb Social Case B residual records
+
+```task
+id: ADHOC-2026-08-14-T01
+status: done
+priority: medium
+state_hub_task_id: "9ee6b15b-efd0-41d1-b38e-ea0061feef69"
+```
+
+Update the owning smoke evidence and close or narrow CSOC-IN-0001 and
+CSOC-IN-0002 now that NK-WP-0025 completed the public registration, OIDC/JIT,
+repeat-login, collision, redirect, and assurance evidence.
+
+## Protect the canonical LDAP-DN subject contract
+
+```task
+id: ADHOC-2026-08-14-T02
+status: done
+priority: medium
+state_hub_task_id: "ec3a0cd4-7c65-49c4-b2a4-b45031d49213"
+```
+
+Add focused regression coverage for the canonical LDAP-DN OIDC subject and
+the reverse normalization used by directory lifecycle and password setup.
+
+## Persist the audit-core multi-tenant sender scope
+
+```task
+id: ADHOC-2026-08-14-T03
+status: wait
+priority: high
+state_hub_task_id: "fcd35bde-b458-4226-964f-b2c6d6125c03"
+```
+
+Move the live `user-engine` sender registry from its manually minted Secret to
+the authoritative OpenBao/ExternalSecret path with source-bound write-only
+scope and `tenants: ["*"]`, without reading or logging its token.
+
+2026-08-14 probe: the live Secret has the correct redacted scope, but
+`platform/workloads/audit-core/senders` does not exist. ClusterSecretStore
+`openbao-audit-core` is present and can read only that exact path. The current
+workstation OpenBao identity returns 403 and credential routing exposes no
+resolvable write grant. Completion therefore waits for a short-lived
+platform-admin OpenBao session to perform the documented wrapped migration;
+the temporary probe ExternalSecret was removed.