Resume user-engine integration rollout

.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — net-kingdom
 
 **Domain:** infotech  
-**Last synced:** 2026-08-12 11:25 UTC  
+**Last synced:** 2026-08-13 12:48 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -11,19 +11,19 @@
 Progress: 1/5 done  |  workplan_id: `1638183b-e2cb-4da2-92b8-d39592d62e86`
 
 **Open tasks:**
-- ► T02 - Provide secure LLDAP self-registration orchestration  `bc220e2b`
+- ! T02 - Provide secure LLDAP self-registration orchestration  `bc220e2b`
-- ► T03 - Integrate registration entry points and return flow  `3ec4a9a0`
+- ! T03 - Integrate registration entry points and return flow  `3ec4a9a0`
-- ► T04 - Apply optional MFA policy safely  `cf2e4d05`
+- ! T04 - Apply optional MFA policy safely  `cf2e4d05`
-- · T05 - Prove both cases end to end  `5d13f9f6`
+- ! T05 - Prove both cases end to end  `5d13f9f6`
 
 ### Expand user-engine platform integrations beyond the Binky MVP
 Progress: 0/4 done  |  workplan_id: `9bd05700-a839-4014-8f88-8a78f2757721`
 
 **Open tasks:**
-- ► T01 - Establish flex-auth production authorization  `7dff0ac6`
+- ! T01 - Establish flex-auth production authorization  `7dff0ac6`
-- ► T02 - Add invitation and verification mail delivery  `9d5f272b`
+- ! T02 - Add invitation and verification mail delivery  `9d5f272b`
-- ► T03 - Operate durable event delivery  `17d6390b`
+- ! T03 - Operate durable event delivery  `17d6390b`
-- ► T04 - Run expanded integration failure matrix  `4c54e8e4`
+- ! T04 - Run expanded integration failure matrix  `4c54e8e4`
 
 ### Cut over NetKingdom identity to railiance01 and retire CoulombCore
 Progress: 7/8 done  |  workplan_id: `3dadddeb-4cec-48e2-9c2c-788b26dd6e93`
@@ -32,10 +32,6 @@ Progress: 7/8 done  |  workplan_id: `3dadddeb-4cec-48e2-9c2c-788b26dd6e93`
 - ! T08 - Final deletion and closure  `9f209f15`
   *(wait: Rollback retention gate remains in force through 2026-08-29; then verify restore/restart drill evidence and obtain separate explicit approval before deletion or closure.)*
 
-## Inbox Hygiene
-
-**Missing thread_id:** 2 unread message(s) lack supersession chains.
-
 ---
 ## MCP Orientation (when available)
 

WORK-RECORDS.md

@@ -64,9 +64,9 @@
 | task | NK-WP-0024-T03 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
 | task | NK-WP-0024-T04 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
 | task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
-| task | NK-WP-0025-T02 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T02 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
-| task | NK-WP-0025-T03 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T03 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
-| task | NK-WP-0025-T04 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T04 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
-| task | NK-WP-0025-T05 | todo | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
+| task | NK-WP-0025-T05 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |

docs/public-registration-orchestration-contract.md

@@ -104,3 +104,21 @@ Public registration stays disabled until all of the following pass together:
 5. KeyCape fresh-login return flow and client allow-list checks;
 6. disposable-user live tests and cleanup on railiance01.
 
+## Runtime configuration
+
+The source implementation is fail closed and remains disabled unless all of
+these are configured together:
+
+- `USER_ENGINE_PUBLIC_REGISTRATION=true`;
+- `USER_ENGINE_REGISTRATION_VERIFICATION_URL` and its OpenBao-backed
+  `USER_ENGINE_REGISTRATION_VERIFICATION_TOKEN`;
+- comma-separated `USER_ENGINE_REGISTRATION_CLIENTS` and
+  `USER_ENGINE_REGISTRATION_TENANTS` allow-lists;
+- `USER_ENGINE_REGISTRATION_PASSWORD_SETUP_ORIGINS`, containing only the
+  trusted HTTPS provider origins allowed to receive the browser.
+
+After verification, user-engine completes the local user, provisions with
+the deterministic `public-registration-<registration-id>` idempotency key and
+only the `user` role, then links the returned subject under the configured
+KeyCape issuer. A setup URL outside the explicit HTTPS origin allow-list is
+rejected.

sso-mfa/k8s/user-engine/runtime.yaml

@@ -62,6 +62,14 @@ spec:
             - {name: USER_ENGINE_OIDC_REDIRECT_URI, value: "https://users.92-205-62-239.nip.io/oidc/callback"}
             - {name: USER_ENGINE_OIDC_BACKEND_URL, value: "http://keycape.sso.svc.cluster.local:8080"}
             - {name: USER_ENGINE_FLEX_AUTH_URL, value: "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080"}
+            - {name: USER_ENGINE_EVENT_URL, value: "http://audit-core.audit-core.svc.cluster.local:8080/v1/events"}
+            - {name: USER_ENGINE_MAIL_URL, value: "http://email-connect.email-connect.svc.cluster.local:8080/v1/send"}
+            - name: USER_ENGINE_EVENT_TOKEN
+              valueFrom:
+                secretKeyRef: {name: user-engine-delivery, key: event-token}
+            - name: USER_ENGINE_MAIL_TOKEN
+              valueFrom:
+                secretKeyRef: {name: user-engine-delivery, key: mail-token}
             - {name: USER_ENGINE_PUBLIC_REGISTRATION, value: "false"}
             - {name: USER_ENGINE_REGISTRATION_RATE_LIMIT, value: "10"}
             - {name: USER_ENGINE_REGISTRATION_RATE_WINDOW_SECONDS, value: "60"}
@@ -151,6 +159,12 @@ spec:
           podSelector:
             matchLabels: {app.kubernetes.io/name: email-connect}
       ports: [{protocol: TCP, port: 8080}]
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: audit-core}
+          podSelector:
+            matchLabels: {app.kubernetes.io/name: audit-core}
+      ports: [{protocol: TCP, port: 8080}]
     - to:
         - namespaceSelector:
             matchLabels: {kubernetes.io/metadata.name: kube-system}

workplans/NK-WP-0024-user-engine-portal-integration-expansion.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
-updated: "2026-08-08"
+updated: "2026-08-13"
 depends_on:
   - NK-WP-0023
   - USER-WP-0021
@@ -20,6 +20,24 @@ state_hub_workstream_id: "9bd05700-a839-4014-8f88-8a78f2757721"
 
 # NK-WP-0024 - Portal integration expansion
 
+## 2026-08-13 completion review
+
+This workplan was blocked at review time. On 2026-08-13 AUDIT-WP-0005
+finished: the PostgreSQL-backed `audit-core` workload is Ready with archive
+custody, OpenBao-backed sender/database lanes, restart/rollback evidence, and
+a live failure matrix (12 passed, 0 failed, 3 production-disruption skips).
+The workplan is active again.
+
+The audit dependency recorded above is stale operationally: AUDIT-WP-0003
+finished only after cancelling its deployment tasks. Production custody and
+the live matrix moved to the now-finished AUDIT-WP-0005.
+
+A consumer-side credential-isolation defect was found and fixed before
+activation. The previous user-engine `HTTPOutboxDeliveryAdapter` accepted one
+`USER_ENGINE_DELIVERY_TOKEN` for both receivers. audit-core and email-connect
+are separately scoped receivers and must not share a bearer credential; the
+adapter now accepts distinct event and mail tokens.
+
 Track deferred integration breadth separately from the completed live MVP.
 Activate with the corresponding user-engine product-expansion tasks.
 
@@ -36,7 +54,7 @@ gate; provider implementation status stays authoritative in the owning repos.
 
 ```task
 id: NK-WP-0024-T01
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "7dff0ac6-c5eb-486c-83db-a1400f30f77d"
 ```
@@ -61,7 +79,7 @@ runtime switch remains coupled to the event/mail activation gate below.
 
 ```task
 id: NK-WP-0024-T02
-status: progress
+status: wait
 priority: medium
 state_hub_task_id: "9d5f272b-115c-404d-8387-7f987cee65ea"
 ```
@@ -79,7 +97,7 @@ entry; production is deliberately not pointed at a fabricated endpoint.
 
 ```task
 id: NK-WP-0024-T03
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "17d6390b-05a8-436c-879b-4e0331d85be5"
 ```
@@ -97,7 +115,7 @@ cluster event receiver and scoped delivery credential.
 
 ```task
 id: NK-WP-0024-T04
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "4c54e8e4-19d9-4470-bb43-3d43cf27af71"
 ```
@@ -122,3 +140,19 @@ suppression, evidence ceilings, redaction) are in
 `email-connect/docs/EMAIL-WP-0004-T04-failure-evidence.md`. user-engine must
 mount only `EMAIL_CONNECT_INGEST_TOKEN` (not SMTP). Provider acceptance and
 mailbox challenges are not authorization.
+
+2026-08-13 review: reopening gates are (1) split user-engine's event and mail
+bearer configuration, (2) finish and deploy AUDIT-WP-0005 with its OpenBao
+dynamic database and sender lanes, (3) mount both independently scoped sender
+credentials, roll out the current user-engine image, and (4) run the combined
+deployed failure matrix. Until then, marking any of T01-T04 done would claim a
+runtime cutover that has not occurred.
+
+2026-08-13 resumed: user-engine now has distinct `USER_ENGINE_EVENT_TOKEN`
+and `USER_ENGINE_MAIL_TOKEN` inputs; adapter tests assert that audit-core and
+email-connect receive different Authorization headers and that mail delivery
+fails closed without its token. The full source suite passes 132 tests with 3
+external-provider skips. NetKingdom's runtime manifest now declares both
+cluster-local endpoints, separate Secret keys, and audit-core egress. The
+remaining gate is custody delivery of those two scoped values, image publish,
+rollout, and the combined live matrix.

workplans/NK-WP-0025-public-self-registration-and-application-jit.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-09"
-updated: "2026-08-09"
+updated: "2026-08-13"
 depends_on:
   - NK-WP-0024
   - USER-WP-0022
@@ -19,6 +19,24 @@ state_hub_workstream_id: "1638183b-e2cb-4da2-92b8-d39592d62e86"
 
 # NK-WP-0025 - public registration and application JIT provisioning
 
+## 2026-08-13 completion review
+
+This workplan was blocked at review time. Source-side registration,
+provider recovery, application JIT, registration entry points, and client MFA
+selection now exist, but the live user-engine still has
+`USER_ENGINE_PUBLIC_REGISTRATION=false` and no verification or delivery
+credentials. Case B and the negative matrix have therefore not run through
+the deployed path.
+
+The durable audit receiver is now deployed and the user-engine event/mail
+credential split is implemented and tested. The remaining upstream gate in
+NK-WP-0024 is custody delivery plus activation of the fail-closed runtime.
+Then enable registration with the email-connect
+verification endpoint, the `coulomb-social` client/tenant allow-lists, and the
+identity-provisioner password-setup origin. Final closure requires disposable
+live users plus an attended MFA/isolation check; `tegwick` remains reserved
+for the attended positive acceptance test.
+
 Provide two safe entry paths for ordinary users of NetKingdom-enabled
 applications, beginning with coulomb.social:
 
@@ -59,7 +77,7 @@ attributes and are not account-link keys.
 
 ```task
 id: NK-WP-0025-T02
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14"
 ```
@@ -88,11 +106,19 @@ client/tenant/username binding checks and deliberately stops before user or
 LLDAP creation. The remaining slice is resumable completion, baseline
 provisioning, provider-subject linking, and password-setup handoff.
 
+The source happy path now completes those transitions: one user-engine user,
+one idempotent provisioning request with only the baseline `user` role, a
+KeyCape issuer/subject link, and an allow-listed HTTPS provider password-setup
+redirect. The full user-engine suite passes 126 tests with 3
+environment-dependent skips. Remaining before T02 completion: implement and
+deploy the verification issuer/mail receiver, add automated recovery for a
+provider failure after local completion, and run disposable live conformance.
+
 ## T03 - Integrate registration entry points and return flow
 
 ```task
 id: NK-WP-0025-T03
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb"
 ```
@@ -111,7 +137,7 @@ redirects or client confusion.
 
 ```task
 id: NK-WP-0025-T04
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846"
 ```
@@ -133,7 +159,7 @@ Other clients retain provider-driven mandatory MFA. Live rollout remains.
 
 ```task
 id: NK-WP-0025-T05
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
 ```