--- id: NK-WP-0024 type: workplan title: "Expand user-engine platform integrations beyond the Binky MVP" domain: infotech repo: net-kingdom status: finished owner: codex topic_slug: netkingdom created: "2026-07-30" updated: "2026-08-14" depends_on: - NK-WP-0023 - USER-WP-0021 - FLEX-WP-0009 - AUDIT-WP-0003 - EMAIL-WP-0004 state_hub_workstream_id: "635a73d4-b3cb-5c38-af22-56a6a66beb0e" --- # NK-WP-0024 - Portal integration expansion ## 2026-08-13 completion review This workplan was blocked at review time. On 2026-08-13 AUDIT-WP-0005 finished: the PostgreSQL-backed `audit-core` workload is Ready with archive custody, OpenBao-backed sender/database lanes, restart/rollback evidence, and a live failure matrix (12 passed, 0 failed, 3 production-disruption skips). The workplan is active again. The audit dependency recorded above is stale operationally: AUDIT-WP-0003 finished only after cancelling its deployment tasks. Production custody and the live matrix moved to the now-finished AUDIT-WP-0005. A consumer-side credential-isolation defect was found and fixed before activation. The previous user-engine `HTTPOutboxDeliveryAdapter` accepted one `USER_ENGINE_DELIVERY_TOKEN` for both receivers. audit-core and email-connect are separately scoped receivers and must not share a bearer credential; the adapter now accepts distinct event and mail tokens. Track deferred integration breadth separately from the completed live MVP. Activate with the corresponding user-engine product-expansion tasks. Provider workplans established 2026-08-08: - `FLEX-WP-0009` provides the user-engine policy package and cluster service. - `AUDIT-WP-0003` provides authenticated durable event ingestion. - `EMAIL-WP-0004` provides transactional invitation-mail delivery. This workplan remains the consumer-side coordination and deployed integration gate; provider implementation status stays authoritative in the owning repos. ## T01 - Establish flex-auth production authorization ```task id: NK-WP-0024-T01 status: done priority: high state_hub_task_id: "4bad414d-b0c1-52df-914f-cdc602192124" ``` Define self, tenant-admin, and platform-admin resource/action vocabulary, deploy the policy package, replace user-engine's local runtime adapter with a fail-closed flex-auth HTTP adapter, and correlate decision IDs with audit. 2026-08-08 implementation: added the fail-closed flex-auth HTTP adapter in user-engine, including request mapping, decision-ID propagation, timeout and malformed-response denial tests. The role/resource contract and safe rollout gate are recorded in `docs/user-engine-platform-expansion-contract.md`. Deployment remains pending because no cluster-local flex-auth Service or validated user-engine policy package currently exists on railiance01. 2026-08-09 deployment: the validated user-engine policy is live at `flex-auth-user-engine.flex-auth.svc.cluster.local:8080`; an in-namespace live probe produced self-service allow and cross-tenant deny decisions. The portal runtime switch remains coupled to the event/mail activation gate below. Done 2026-08-14: the portal is live on the fail-closed HTTP adapter; its platform outbox dispatch was authorized by the deployed flex-auth policy and accepted into audit-core with correlated event IDs. Existing deployed allow, cross-tenant deny, missing-role deny, and wrong-system deny evidence remains valid. ## T02 - Add invitation and verification mail delivery ```task id: NK-WP-0024-T02 status: done priority: medium state_hub_task_id: "88098a55-f2ca-5636-9a98-ae8a98cdeaf4" ``` Deliver invitation and verification messages through approved custody and mail lanes. Mailbox ownership remains evidence, never authorization. 2026-08-08 implementation: added authenticated, idempotent invitation-mail delivery from durable outbox events. The delivery token is a required runtime secret and the NetKingdom contract pins it to the existing OpenBao runtime lane. Live completion waits for an approved mail receiver and its custody entry; production is deliberately not pointed at a fabricated endpoint. ## T03 - Operate durable event delivery ```task id: NK-WP-0024-T03 status: done priority: high state_hub_task_id: "59d3a6b5-7b9a-52a5-adc1-dd9fe74e3eba" ``` Connect the user-engine transactional outbox to the platform event lane with bounded retries, replay, dead-letter visibility, redaction, and correlation. 2026-08-08 implementation: added an authenticated HTTP event adapter carrying event ID, tenant, correlation, occurrence time, and redacted domain payload. It uses `Idempotency-Key`; the existing durable store supplies bounded retry, dead-letter, diagnostics, and replay. Live completion waits for a selected cluster event receiver and scoped delivery credential. ## T04 - Run expanded integration failure matrix ```task id: NK-WP-0024-T04 status: done priority: high state_hub_task_id: "68eb8659-acd9-5188-bd12-b67fb18c6144" ``` Prove flex-auth denial/unavailability, mail failure, identity-provider outage, partial provisioning recovery, invitation replay/expiry, and cross-tenant negative behavior through the deployed path. 2026-08-08 source matrix: user-engine's full suite passes 119 tests with three external-provider tests skipped. New coverage proves flex-auth allow mapping, decision correlation, fail-closed unavailability, invitation mail routing, event routing, and idempotency. Existing USER-WP-0021 coverage proves provider outage, recovery, invitation expiry/replay, dead-letter/replay, and cross-tenant denial. The deployed-path matrix remains pending on the three production endpoints above. 2026-08-12 EMAIL-WP-0004-T04 hand-back: transactional invitation mail receiver is live on railiance01 at `http://email-connect.email-connect.svc.cluster.local:8080`. Failure contract and non-secret evidence (retryable vs permanent codes, duplicate/resend, suppression, evidence ceilings, redaction) are in `email-connect/docs/EMAIL-WP-0004-T04-failure-evidence.md`. user-engine must mount only `EMAIL_CONNECT_INGEST_TOKEN` (not SMTP). Provider acceptance and mailbox challenges are not authorization. 2026-08-13 review: reopening gates are (1) split user-engine's event and mail bearer configuration, (2) finish and deploy AUDIT-WP-0005 with its OpenBao dynamic database and sender lanes, (3) mount both independently scoped sender credentials, roll out the current user-engine image, and (4) run the combined deployed failure matrix. Until then, marking any of T01-T04 done would claim a runtime cutover that has not occurred. 2026-08-13 resumed: user-engine now has distinct `USER_ENGINE_EVENT_TOKEN` and `USER_ENGINE_MAIL_TOKEN` inputs; adapter tests assert that audit-core and email-connect receive different Authorization headers and that mail delivery fails closed without its token. The full source suite passes 132 tests with 3 external-provider skips. NetKingdom's runtime manifest now declares both cluster-local endpoints, separate Secret keys, and audit-core egress. The remaining gate is custody delivery of those two scoped values, image publish, rollout, and the combined live matrix. 2026-08-13 rollout: the scoped provider credentials were transferred entirely through Kubernetes APIs into Secret `user-engine-delivery`, containing exactly `event-token` and `mail-token`; no value was printed or persisted outside the cluster. user-engine commit `a0f39f5` was published and deployed at immutable digest `sha256:4eac10bf157e48eeadef16a2da83a00933914c9d37338f01679692008de21565`. The rollout completed, `/readyz` reports all checks true, and in-pod probes reach flex-auth, audit-core, and email-connect with HTTP 200 through the declared NetworkPolicies. Remaining T04 evidence is application-level outbox delivery and the negative matrix; health reachability alone is not reported as delivery acceptance. 2026-08-14 live outbox proof: nine existing durable non-mail events were dispatched through the deployed user-engine adapter. Three were accepted immediately. Six received HTTP 400 because audit-core's `user-engine` sender was limited to `tenant:friendly:binky`; the platform service legitimately emits for multiple tenants. The sender remains write-only and source-bound to `user-engine`, but its tenant claim scope is now `*`. After audit-core restart, explicit replay delivered all six with attempt count 2; user-engine reports zero pending events. The run also exposed a PostgreSQL retry defect: `pending_outbox()` filtered on `failed_at IS NULL`, unlike the in-memory contract, so bounded retries stopped after one failure. user-engine commit `0b6a57d` selects every undelivered, non-dead-letter event and adds regression coverage; the full suite passes 133 tests with 3 external skips. The corrected immutable image is `sha256:1402712e8f3ddc1397e83edb9627251b0ea362f1e3308d252d0d688ac589556e`. T03 is complete: all nine durable source events are delivered, replay is idempotent at audit-core, user-engine reports zero pending events, and the corrected bounded-retry query is live and Ready. Done 2026-08-14: email-engine's disposable harness proved application-level verification issuance, mailbox receipt, single-use consumption, baseline directory provisioning, and the allow-listed password handoff. The combined deployed path exercised and recovered from authorization denial, verification network refusal, a request-schema 400, PostgreSQL rolling-start lock contention, and self-link authorization denial. Regression fixes are live in user-engine commits `14b8121`, `d4a1327`, `10ee042`, and `5e37e9c`; the final suite passes 133 tests with 3 external-provider skips. The successful retry returned 202 for start, 303 for the provider handoff, and 200 for password completion. Directory inspection proved the baseline users group and absence of the tenant-admin group. Three exact disposable directory identities were deprovisioned, production email-connect custody was restored, and the temporary harness resources were removed.