Finish public registration and JIT acceptance

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -23,7 +23,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:4a6ec93d74eed6e17065a7e5d4c3d8d0ed14078bdfda0112738438528c6b2680
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:5b460f5ca9e329e287939f4707a2bb8d5674b7f94e24cfb5f6d790f54c3f8d06
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:

workplans/NK-WP-0025-public-self-registration-and-application-jit.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Provide NetKingdom self-registration and application first-login provisioning"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-09"
@@ -174,7 +174,7 @@ Client and tenant allow-list negatives also fail before mail issuance.
 
 ```task
 id: NK-WP-0025-T05
-status: wait
+status: done
 priority: high
 state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
 ```
@@ -203,3 +203,16 @@ T02 and T04 are complete. T05 remains in progress for the attended browser
 OIDC callback/JIT check for both an existing identity and a new registrant,
 repeated callback behavior, and attended AAL1/AAL2 isolation. The reserved
 `tegwick` identity was not used by automation.
+
+Done 2026-08-14: coulomb-social supplies attended Case A evidence for
+`tegwick` at AAL1. A disposable Case B completed Authelia first factor,
+KeyCape PKCE authorization code, the application callback, user-engine `/me`,
+and JIT Member creation at `app.coulomb.social/app/`; an independent repeat
+login left exactly one Member with a populated user-engine link. The run fixed
+ordinary-user `me.read` self-context in user-engine commit `db8769c` (133
+passed, 3 skipped), then aligned provisioning with KeyCape's stable LDAP-DN
+OIDC subject in NetKingdom commit `2a2d8ba`. The deployed canonical-subject
+contract was verified directly. Client-specific AAL1 and explicit AAL2
+step-up remain covered by KeyCape/coulomb-social policy tests and the live
+isolation evidence above. The disposable Member, Django user, and directory
+identities were removed after the repeated-login proof.