Complete live registration acceptance

workplans/NK-WP-0024-user-engine-portal-integration-expansion.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Expand user-engine platform integrations beyond the Binky MVP"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
-updated: "2026-08-13"
+updated: "2026-08-14"
 depends_on:
   - NK-WP-0023
   - USER-WP-0021
@@ -85,7 +85,7 @@ valid.
 
 ```task
 id: NK-WP-0024-T02
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "9d5f272b-115c-404d-8387-7f987cee65ea"
 ```
@@ -121,7 +121,7 @@ cluster event receiver and scoped delivery credential.
 
 ```task
 id: NK-WP-0024-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "4c54e8e4-19d9-4470-bb43-3d43cf27af71"
 ```
@@ -192,5 +192,18 @@ tests with 3 external skips. The corrected immutable image is
 
 T03 is complete: all nine durable source events are delivered, replay is
 idempotent at audit-core, user-engine reports zero pending events, and the
-corrected bounded-retry query is live and Ready. T04 remains open for the
-mail-producing application journey and its attended negative cases.
+corrected bounded-retry query is live and Ready.
+
+Done 2026-08-14: email-engine's disposable harness proved application-level
+verification issuance, mailbox receipt, single-use consumption, baseline
+directory provisioning, and the allow-listed password handoff. The combined
+deployed path exercised and recovered from authorization denial, verification
+network refusal, a request-schema 400, PostgreSQL rolling-start lock
+contention, and self-link authorization denial. Regression fixes are live in
+user-engine commits `14b8121`, `d4a1327`, `10ee042`, and `5e37e9c`; the final
+suite passes 133 tests with 3 external-provider skips. The successful retry
+returned 202 for start, 303 for the provider handoff, and 200 for password
+completion. Directory inspection proved the baseline users group and absence
+of the tenant-admin group. Three exact disposable directory identities were
+deprovisioned, production email-connect custody was restored, and the
+temporary harness resources were removed.

workplans/NK-WP-0025-public-self-registration-and-application-jit.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-09"
-updated: "2026-08-13"
+updated: "2026-08-14"
 depends_on:
   - NK-WP-0024
   - USER-WP-0022
@@ -77,7 +77,7 @@ attributes and are not account-link keys.
 
 ```task
 id: NK-WP-0025-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14"
 ```
@@ -146,7 +146,7 @@ request. The fresh OIDC flow remains provider-owned after password setup.
 
 ```task
 id: NK-WP-0025-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846"
 ```
@@ -174,7 +174,7 @@ Client and tenant allow-list negatives also fail before mail issuance.
 
 ```task
 id: NK-WP-0025-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
 ```
@@ -188,3 +188,18 @@ automated tests use disposable identities.
 
 Done when both user journeys work on railiance01 and all negative cases leave
 no orphaned privileged identity or duplicate application profile.
+
+2026-08-14 live evidence: Case B reached anonymous start, disposable mailbox
+verification, baseline LLDAP provisioning, allow-listed provider password
+handoff, and password completion with statuses 202, 303, and 200. The identity
+had `tenant:coulomb:users` and not `tenant:coulomb:admins`; it and the two
+partial diagnostic identities were deprovisioned. No verification handle,
+setup token, generated password, or privileged credential was printed or
+persisted. The live KeyCape configuration has
+`coulomb-social.mfaRequired=false`, while every other client was verified not
+to have that lowering override; KeyCape rolled successfully.
+
+T02 and T04 are complete. T05 remains in progress for the attended browser
+OIDC callback/JIT check for both an existing identity and a new registrant,
+repeated callback behavior, and attended AAL1/AAL2 isolation. The reserved
+`tegwick` identity was not used by automation.