net-kingdom/workplans/NK-WP-0050-playwright-consumer-registration.md

---
id: NK-WP-0050
type: workplan
title: "Register Playwright human and agent consumers through governed identity delivery"
domain: infotech
repo: net-kingdom
status: blocked
flavor: implementation
owner: codex
topic_slug: netkingdom
created: "2026-10-13"
updated: "2026-10-28"
depends_on: []
related: [CUST-WP-0080, RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004]
state_hub_workstream_id: "06ba98d5-609e-5aaa-9bf7-4c4f4460e377"
---

Accept NetKingdom's concrete implementation request
`c6b4dfb0-44d5-4f12-8854-2c38ab6dc454` (original
`94a0096c-f34c-463c-b336-b13cf629b968`). This is the missing registration-owner
implementation, not another cross-owner coordination plan. Coordination remains
CUST-WP-0080-T05; Platform and provider retain consumer/service acceptance.
Initial eligibility of all identified platform humans and coding agents is
already decided. Do not request another membership approval or reuse a shared
admin identity, kubeconfig, SSH identity or existing OpenBao credential.

> **Blocked 2026-10-28** (founder triage): T02 waits on Platform custody/delivery and the real
> agent records, T03 on CUST-WP-0080-T05 acceptance. No NetKingdom-side step remains open.
> Return to `active` when Platform custody is in place.

## Prepare exact registrations and preservation checks

```task
id: NK-WP-0050-T01
status: done
priority: high
state_hub_task_id: "64893d94-9717-5812-b8e3-7cabe095fcdc"
```

`docs/playwright-registration.md` owns the bounded registration contract.
`sso-mfa/k8s/keycape/playwright-registration.py` constructs the exact public
PKCE record and distinct per-agent confidential registrations from existing
identity references, with dedicated audience/scope and 15-minute agent lifetime.
It reuses the existing byte-preserving registry adapter, refuses drift/shared
references/unreviewed audience registrations and bounds the existing human
issuer lifetime without modifying it. CLI emits only source proposals; no
credential access, live mutation or fabricated SecurityCaseType acceptance.

Verified: nine new compiler/merge tests and 64 existing registration tests pass.
The broader 159-test directory run passed 157 and failed two unchanged short-window
OpenBao input tests; all seven tests in that module passed unchanged on rerun.
Native KeyCape config/startup suites and the generated-registration token/JWKS
fixture pass against committed issuer source 1344fc80e56315c5c99f58993f9ee02ce79e8a76.
Public output exactly matches Platform's candidate. Synthetic identity references
and local fixtures are not issuer-owner or real consumer acceptance.

## Deliver custody integration and guarded registration activation

```task
id: NK-WP-0050-T02
status: progress
priority: high
depends_on: [NK-WP-0050-T01]
state_hub_task_id: "a9dadd07-f136-5dc7-9229-7a9dbb941f0d"
```

Resolve the exact real agent records and Platform custody/delivery source task;
add protected registration/config/Deployment integration using existing owner
operations, exact source/object/revision bindings, pinned native check-config,
created-only provenance, readback and guarded rollback. Prepare the concrete
action before any needed privileged approval. Source work can proceed while
owner acceptance is collected; custody and live grants must not be invented.
Neither compiler output nor another client's acceptance authorizes live apply.

2026-10-13: private activation patch preparation implemented in
`playwright-activation.py`. Original/candidate registry and Deployment state bind
an exact proposal digest. Ordered stop/configure/resume avoids a registry/env
startup race in the single-Recreate issuer. Native verifier digest checks, fresh
object UID/resource-version/data/spec conditions, complete pod-quiescence checks,
readback and exact original-state rollback retain pre-existing registrations and
bindings. No mutation occurs from this module; the protected executor owns fresh
reads, admitted custody, actual approval and live acceptance. Source tests cover
partial recovery and independent RFC 6902 patch application; native KeyCape
check-config accepts both synthetic configurations. Real identity/custody owner
returns, executor/recovery-state integration, exact current image verification
and the supervised maintenance action remain open.

Follow-up review reproduced two collision gaps: implicit client-ID audience and
different env names referencing the same proposed agent Secret/key. Both are now
refused; two new regressions failed before repair and pass afterward. This does
not establish isolation outside the observed registry/issuer environment.

## Verify issuer and real consumer acceptance

```task
id: NK-WP-0050-T03
status: wait
priority: high
depends_on: [NK-WP-0050-T02, RPF-WP-0056-T03]
blocking_reason: "Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05."
state_hub_task_id: "5a3aaf57-de5c-5a03-bc99-9bcf2fc5d95e"
```

Retain real human/agent issuance and identity/tenant/audience/scope/expiry proof,
native negative cases, preserved existing login, renewal, removal and active
connection termination. Hand the exact receipts to RPF-WP-0056-T03 and provider
RAPP-PLAYWRIGHT-WP-0004-T01/T03. Do not introduce a reciprocal prerequisite on
Platform activation: T02 owns issuer preparation/activation, T03 consumes final
Platform end-to-end acceptance. Close only after the registration owner's
requirements are proven; hand any residuals to live work records first.