coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Resume user-engine integration rollout
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-08-13 14:56:53 +02:00
parent 20d4d8af04
commit 96266b9371
6 changed files with 115 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

36
workplans/NK-WP-0025-public-self-registration-and-application-jit.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: netkingdom
created: "2026-08-09"
updated: "2026-08-09"
updated: "2026-08-13"
depends_on:
- NK-WP-0024
- USER-WP-0022
@ -19,6 +19,24 @@ state_hub_workstream_id: "1638183b-e2cb-4da2-92b8-d39592d62e86"
# NK-WP-0025 - public registration and application JIT provisioning
## 2026-08-13 completion review
This workplan was blocked at review time. Source-side registration,
provider recovery, application JIT, registration entry points, and client MFA
selection now exist, but the live user-engine still has
`USER_ENGINE_PUBLIC_REGISTRATION=false` and no verification or delivery
credentials. Case B and the negative matrix have therefore not run through
the deployed path.
The durable audit receiver is now deployed and the user-engine event/mail
credential split is implemented and tested. The remaining upstream gate in
NK-WP-0024 is custody delivery plus activation of the fail-closed runtime.
Then enable registration with the email-connect
verification endpoint, the `coulomb-social` client/tenant allow-lists, and the
identity-provisioner password-setup origin. Final closure requires disposable
live users plus an attended MFA/isolation check; `tegwick` remains reserved
for the attended positive acceptance test.
Provide two safe entry paths for ordinary users of NetKingdom-enabled
applications, beginning with coulomb.social:
@ -59,7 +77,7 @@ attributes and are not account-link keys.
```task
id: NK-WP-0025-T02
status: progress
status: wait
priority: high
state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14"
```
@ -88,11 +106,19 @@ client/tenant/username binding checks and deliberately stops before user or
LLDAP creation. The remaining slice is resumable completion, baseline
provisioning, provider-subject linking, and password-setup handoff.
The source happy path now completes those transitions: one user-engine user,
one idempotent provisioning request with only the baseline `user` role, a
KeyCape issuer/subject link, and an allow-listed HTTPS provider password-setup
redirect. The full user-engine suite passes 126 tests with 3
environment-dependent skips. Remaining before T02 completion: implement and
deploy the verification issuer/mail receiver, add automated recovery for a
provider failure after local completion, and run disposable live conformance.
## T03 - Integrate registration entry points and return flow
```task
id: NK-WP-0025-T03
status: progress
status: wait
priority: high
state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb"
```
@ -111,7 +137,7 @@ redirects or client confusion.
```task
id: NK-WP-0025-T04
status: progress
status: wait
priority: high
state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846"
```
@ -133,7 +159,7 @@ Other clients retain provider-driven mandatory MFA. Live rollout remains.
```task
id: NK-WP-0025-T05
status: todo
status: wait
priority: high
state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
```