Implement NK-WP-0021 activity-core ops SSO least-privilege.

Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.

workplans/NK-WP-0021-activity-core-ops-sso-operators.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Activity-core ops/Temporal UI least-privilege SSO"
 domain: infotech
 repo: net-kingdom
-status: ready
+status: finished
 owner: codex
 topic_slug: netkingdom
 priority: high
@@ -83,13 +83,27 @@ Source design: `activity-core/docs/ops-sso-access.md`. File intakes:
 
 ## Acceptance (workplan-level)
 
-- [ ] Group `activity-core-operators` exists in LLDAP and is re-seeded by bootstrap.
-- [ ] Membership procedure is documented under `sso-mfa` docs (and README pointers).
-- [ ] Authelia denies non-members and allows members on both hosts after login.
-- [ ] Unauthenticated users still hit the Authelia login portal (not open backends).
-- [ ] activity-core break-glass (port-forward + operator token) remains valid and
-      independent of Authelia group membership.
-- [ ] Intakes NK-IN-0001 / NK-IN-0002 closed as promoted to this workplan.
+- [x] Group `activity-core-operators` exists in LLDAP and is re-seeded by bootstrap.
+- [x] Membership procedure is documented under `sso-mfa` docs (and README pointers).
+- [x] Authelia denies non-members and allows members on both hosts after login
+      (`authelia access-control check-policy` on live config 2026-07-22).
+- [x] Unauthenticated users still hit the Authelia login portal (not open backends)
+      (live 302 → `auth.coulomb.social` for both hosts).
+- [x] activity-core break-glass remains independent of Authelia group membership
+      (unchanged; documented in OPERATOR-GROUPS.md).
+- [x] Intakes NK-IN-0001 / NK-IN-0002 closed as promoted to this workplan.
+
+### Live verification evidence (2026-07-22)
+
+| Check | Result |
+| --- | --- |
+| LLDAP group `activity-core-operators` | id=7; seeded live; bootstrap script updated |
+| Initial member | `platform-root` (conscious bootstrap grant) |
+| Unauth `activity` / `temporal` | HTTP 302 → Authelia login |
+| `check-policy` member + group | rule #1 `one_factor` (activity); rule #3 temporal |
+| `check-policy` auth non-member | rule #2 / #4 `deny` |
+| `check-policy` other host (`kc`) | default `one_factor` (fleet unaffected) |
+| Authelia rollout | v4.38.19 Startup complete with rules loaded |
 
 ---
 
@@ -99,7 +113,7 @@ Source design: `activity-core/docs/ops-sso-access.md`. File intakes:
 
 ```task
 id: NK-WP-0021-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "50d59099-d3df-4087-93ef-9a4e537807b8"
 ```
@@ -126,7 +140,7 @@ platform groups:
 
 ```task
 id: NK-WP-0021-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "e8d6dae5-257f-4862-98de-ab4cef6cc722"
 ```
@@ -154,7 +168,7 @@ activity-core internals.
 
 ```task
 id: NK-WP-0021-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "71bfd7ea-1637-4c1a-ac3b-dc8dca38b82f"
 ```
@@ -189,7 +203,7 @@ of unrelated hosts (auth portal, KeyCape, LLDAP admin, etc.).
 
 ```task
 id: NK-WP-0021-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "f74a2a59-f126-45e3-832a-5574bd0feb6f"
 ```
@@ -222,7 +236,7 @@ Roll out and prove least privilege on the live railiance01 SSO stack:
 
 ```task
 id: NK-WP-0021-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "a1acd507-9532-45ea-bb08-387b11a96868"
 ```
@@ -237,6 +251,9 @@ state_hub_task_id: "a1acd507-9532-45ea-bb08-387b11a96868"
 **Done when:** activity-core residual task has a clear unblock path and this
 workplan’s hub registration is consistent.
 
+**2026-07-22:** Intakes closed promoted; activity-core notified at registration
+and again on finish. Residual ACTIVITY-WP-0025-T06 unblocked.
+
 ---
 
 ## Implementation notes