fix: restore native user portal login and track tenant integration

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/evidence/2026-09-11-native-portal-repair.md

@@ -0,0 +1,39 @@
+# Native portal login and tenant-onboarding repair — 2026-09-11
+
+Owner: NK-WP-0036. Actual tenant/product admission remains RAPPS-WP-0014.
+
+The approved public `user-engine-portal` client was absent from live KeyCape.
+The bounded helper repaired only that missing registration in sso/keycape-config.
+Secret UID `2e94519d-1550-41c7-9701-2efe47fe1fd3`, resourceVersion
+`58747126` → `59999030`; unrelated configuration bytes and Secret data preserved.
+The full bootstrap generator was not run. Its source now retains the existing
+client declaration; four synthetic helper/bootstrap tests pass.
+
+KeyCape rollout succeeded with its prior image
+`sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611`
+and 25m CPU request. Read-only verification uses
+`sso-mfa/k8s/keycape/verify-user-engine-portal.py`: valid S256 authorize redirects
+to Authelia; wrong callback is refused with redirect_uri, missing PKCE with
+missing_pkce. The first probe incorrectly expected code_challenge for the latter;
+the probe expectation was corrected to the implementation's documented error.
+
+The operator then authenticated natively as platform-root and reached the tenant
+creation form (browser observation at 18:35:42 UTC). Their manual submission
+returned provisioning_unavailable, correlation
+`corr_d41f417c61713afc7ddea08f`. Tenant Engine logged POST /tenants 403 before its
+store-create call. That establishes a downstream denial, not an identity-provider
+outage. No tenant existence is claimed without native readback.
+
+The deployed portal calls Tenant Engine as user-engine. Its PDP policy had no
+such subject and also lacked the tenant.read action now required by the endpoint.
+NK-WP-0036-T03 tracks the minimal policy integration, adapter error mapping,
+immutable CI image promotion and live positive/negative verification. Human
+credentials, session cookies and the chosen administrator's private contact
+information are excluded from this record.
+
+Local validation: Flex Auth make test (including race tests), 27 policy tests and
+35 fixtures pass; actual registry-enriched create request allows policy v2.
+User Engine make test: 169 tests, 3 optional integration skips, layer check passed;
+regression proves authority 403 reaches the browser as redacted 403 without
+creating an administrator. Source fixes: flex-auth dd8dd51, user-engine 3c85e56.
+CI publication/live promotion are pending; these are not live success claims.