Close portal integration MVP and narrow identity cutover

workplans/NK-WP-0024-user-engine-portal-integration-expansion.md

@@ -0,0 +1,71 @@
+---
+id: NK-WP-0024
+type: workplan
+title: "Expand user-engine platform integrations beyond the Binky MVP"
+domain: infotech
+repo: net-kingdom
+status: backlog
+owner: codex
+topic_slug: netkingdom
+created: "2026-07-30"
+updated: "2026-07-30"
+depends_on:
+  - NK-WP-0023
+  - USER-WP-0021
+state_hub_workstream_id: "9bd05700-a839-4014-8f88-8a78f2757721"
+---
+
+# NK-WP-0024 - Portal integration expansion
+
+Track deferred integration breadth separately from the completed live MVP.
+Activate with the corresponding user-engine product-expansion tasks.
+
+## T01 - Establish flex-auth production authorization
+
+```task
+id: NK-WP-0024-T01
+status: todo
+priority: high
+state_hub_task_id: "7dff0ac6-c5eb-486c-83db-a1400f30f77d"
+```
+
+Define self, tenant-admin, and platform-admin resource/action vocabulary,
+deploy the policy package, replace user-engine's local runtime adapter with a
+fail-closed flex-auth HTTP adapter, and correlate decision IDs with audit.
+
+## T02 - Add invitation and verification mail delivery
+
+```task
+id: NK-WP-0024-T02
+status: todo
+priority: medium
+state_hub_task_id: "9d5f272b-115c-404d-8387-7f987cee65ea"
+```
+
+Deliver invitation and verification messages through approved custody and
+mail lanes. Mailbox ownership remains evidence, never authorization.
+
+## T03 - Operate durable event delivery
+
+```task
+id: NK-WP-0024-T03
+status: todo
+priority: high
+state_hub_task_id: "17d6390b-05a8-436c-879b-4e0331d85be5"
+```
+
+Connect the user-engine transactional outbox to the platform event lane with
+bounded retries, replay, dead-letter visibility, redaction, and correlation.
+
+## T04 - Run expanded integration failure matrix
+
+```task
+id: NK-WP-0024-T04
+status: todo
+priority: high
+state_hub_task_id: "4c54e8e4-19d9-4470-bb43-3d43cf27af71"
+```
+
+Prove flex-auth denial/unavailability, mail failure, identity-provider outage,
+partial provisioning recovery, invitation replay/expiry, and cross-tenant
+negative behavior through the deployed path.