Close portal integration MVP and narrow identity cutover

workplans/NK-WP-0023-user-engine-portal-platform-integration.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Integrate and deploy the user-engine onboarding portal"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
@@ -138,7 +138,7 @@ errors, so future users may enter either `bernd.worsch` or the full email.
 
 ```task
 id: NK-WP-0023-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "6ce33c92-031a-4f23-8ee2-108451b394fe"
 ```
@@ -224,7 +224,7 @@ value entered recorded output. All T05 acceptance criteria are complete.
 
 ```task
 id: NK-WP-0023-T06
-status: wait
+status: done
 priority: high
 state_hub_task_id: "96a7cd2b-6cab-47ab-a899-44bc0f6da58c"
 ```
@@ -297,3 +297,17 @@ defines compatibility seams, not enterprise implementation.
 federation, SCIM, JIT, group mapping, provenance, source ownership,
 conflict/freshness rules, offboarding, failure behavior, and demand triggers
 without starting the demand-gated enterprise implementation.
+
+## Milestone closure (2026-07-30)
+
+The live Binky MVP consumes verified KeyCape claims, enforces tenant/platform
+role separation through user-engine's authorization port, correlates durable
+audit/outbox records, and keeps password and MFA interactions on
+NetKingdom-owned surfaces. Role-scoped administration, platform and unrelated
+tenant denial, AAL2 login, drift/reconciliation, replay-safe deletion, restore,
+rollback, secret rotation, and dependency failure/recovery are proven.
+
+Replacing the pre-production authorization adapter with a deployed flex-auth
+policy package, invitation mail, operated outbox replay/dead-letter delivery,
+and the broader integration failure matrix transfer explicitly to
+`NK-WP-0024`; they are not claimed as part of this completed milestone.