Resume user-engine integration rollout

workplans/NK-WP-0024-user-engine-portal-integration-expansion.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
-updated: "2026-08-08"
+updated: "2026-08-13"
 depends_on:
   - NK-WP-0023
   - USER-WP-0021
@@ -20,6 +20,24 @@ state_hub_workstream_id: "9bd05700-a839-4014-8f88-8a78f2757721"
 
 # NK-WP-0024 - Portal integration expansion
 
+## 2026-08-13 completion review
+
+This workplan was blocked at review time. On 2026-08-13 AUDIT-WP-0005
+finished: the PostgreSQL-backed `audit-core` workload is Ready with archive
+custody, OpenBao-backed sender/database lanes, restart/rollback evidence, and
+a live failure matrix (12 passed, 0 failed, 3 production-disruption skips).
+The workplan is active again.
+
+The audit dependency recorded above is stale operationally: AUDIT-WP-0003
+finished only after cancelling its deployment tasks. Production custody and
+the live matrix moved to the now-finished AUDIT-WP-0005.
+
+A consumer-side credential-isolation defect was found and fixed before
+activation. The previous user-engine `HTTPOutboxDeliveryAdapter` accepted one
+`USER_ENGINE_DELIVERY_TOKEN` for both receivers. audit-core and email-connect
+are separately scoped receivers and must not share a bearer credential; the
+adapter now accepts distinct event and mail tokens.
+
 Track deferred integration breadth separately from the completed live MVP.
 Activate with the corresponding user-engine product-expansion tasks.
 
@@ -36,7 +54,7 @@ gate; provider implementation status stays authoritative in the owning repos.
 
 ```task
 id: NK-WP-0024-T01
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "7dff0ac6-c5eb-486c-83db-a1400f30f77d"
 ```
@@ -61,7 +79,7 @@ runtime switch remains coupled to the event/mail activation gate below.
 
 ```task
 id: NK-WP-0024-T02
-status: progress
+status: wait
 priority: medium
 state_hub_task_id: "9d5f272b-115c-404d-8387-7f987cee65ea"
 ```
@@ -79,7 +97,7 @@ entry; production is deliberately not pointed at a fabricated endpoint.
 
 ```task
 id: NK-WP-0024-T03
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "17d6390b-05a8-436c-879b-4e0331d85be5"
 ```
@@ -97,7 +115,7 @@ cluster event receiver and scoped delivery credential.
 
 ```task
 id: NK-WP-0024-T04
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "4c54e8e4-19d9-4470-bb43-3d43cf27af71"
 ```
@@ -122,3 +140,19 @@ suppression, evidence ceilings, redaction) are in
 `email-connect/docs/EMAIL-WP-0004-T04-failure-evidence.md`. user-engine must
 mount only `EMAIL_CONNECT_INGEST_TOKEN` (not SMTP). Provider acceptance and
 mailbox challenges are not authorization.
+
+2026-08-13 review: reopening gates are (1) split user-engine's event and mail
+bearer configuration, (2) finish and deploy AUDIT-WP-0005 with its OpenBao
+dynamic database and sender lanes, (3) mount both independently scoped sender
+credentials, roll out the current user-engine image, and (4) run the combined
+deployed failure matrix. Until then, marking any of T01-T04 done would claim a
+runtime cutover that has not occurred.
+
+2026-08-13 resumed: user-engine now has distinct `USER_ENGINE_EVENT_TOKEN`
+and `USER_ENGINE_MAIL_TOKEN` inputs; adapter tests assert that audit-core and
+email-connect receive different Authorization headers and that mail delivery
+fails closed without its token. The full source suite passes 132 tests with 3
+external-provider skips. NetKingdom's runtime manifest now declares both
+cluster-local endpoints, separate Secret keys, and audit-core egress. The
+remaining gate is custody delivery of those two scoped values, image publish,
+rollout, and the combined live matrix.