Complete live registration acceptance

workplans/NK-WP-0025-public-self-registration-and-application-jit.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-09"
-updated: "2026-08-13"
+updated: "2026-08-14"
 depends_on:
   - NK-WP-0024
   - USER-WP-0022
@@ -77,7 +77,7 @@ attributes and are not account-link keys.
 
 ```task
 id: NK-WP-0025-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14"
 ```
@@ -146,7 +146,7 @@ request. The fresh OIDC flow remains provider-owned after password setup.
 
 ```task
 id: NK-WP-0025-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846"
 ```
@@ -174,7 +174,7 @@ Client and tenant allow-list negatives also fail before mail issuance.
 
 ```task
 id: NK-WP-0025-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
 ```
@@ -188,3 +188,18 @@ automated tests use disposable identities.
 
 Done when both user journeys work on railiance01 and all negative cases leave
 no orphaned privileged identity or duplicate application profile.
+
+2026-08-14 live evidence: Case B reached anonymous start, disposable mailbox
+verification, baseline LLDAP provisioning, allow-listed provider password
+handoff, and password completion with statuses 202, 303, and 200. The identity
+had `tenant:coulomb:users` and not `tenant:coulomb:admins`; it and the two
+partial diagnostic identities were deprovisioned. No verification handle,
+setup token, generated password, or privileged credential was printed or
+persisted. The live KeyCape configuration has
+`coulomb-social.mfaRequired=false`, while every other client was verified not
+to have that lowering override; KeyCape rolled successfully.
+
+T02 and T04 are complete. T05 remains in progress for the attended browser
+OIDC callback/JIT check for both an existing identity and a new registrant,
+repeated callback behavior, and attended AAL1/AAL2 isolation. The reserved
+`tegwick` identity was not used by automation.