Resume user-engine integration rollout

docs/public-registration-orchestration-contract.md

@@ -104,3 +104,21 @@ Public registration stays disabled until all of the following pass together:
 5. KeyCape fresh-login return flow and client allow-list checks;
 6. disposable-user live tests and cleanup on railiance01.
 
+## Runtime configuration
+
+The source implementation is fail closed and remains disabled unless all of
+these are configured together:
+
+- `USER_ENGINE_PUBLIC_REGISTRATION=true`;
+- `USER_ENGINE_REGISTRATION_VERIFICATION_URL` and its OpenBao-backed
+  `USER_ENGINE_REGISTRATION_VERIFICATION_TOKEN`;
+- comma-separated `USER_ENGINE_REGISTRATION_CLIENTS` and
+  `USER_ENGINE_REGISTRATION_TENANTS` allow-lists;
+- `USER_ENGINE_REGISTRATION_PASSWORD_SETUP_ORIGINS`, containing only the
+  trusted HTTPS provider origins allowed to receive the browser.
+
+After verification, user-engine completes the local user, provisions with
+the deterministic `public-registration-<registration-id>` idempotency key and
+only the `user` role, then links the returned subject under the configured
+KeyCape issuer. A setup URL outside the explicit HTTPS origin allow-list is
+rejected.