user-engine/docs/final-assessment.md

# Implementation Assessment

Date: 2026-08-19
Related: `../SCOPE.md`, `../INTENT.md`, OpenAPI `0.3.0`

Workplans `USER-WP-0001` through `USER-WP-0023` are finished. There is no
active workplan. This file replaces the early-MVP assessment that still
described an in-memory, in-process core with no UI or platform adapters.

## Implemented

- Headless domain for users, accounts, identity links, applications,
  catalogs, profiles, projections, audit records, and outbox events.
- Tenant context enforcement, memberships, tenant profile precedence,
  redacted diagnostics, and cross-tenant denial.
- Multi-application catalog ownership, namespace collision protection,
  semantic version checks, sensitivity downgrade prevention, app-filtered
  projections, and claims-enrichment projection caching.
- Canon interface card, entity/relationship mappings, and explicit gap
  records (`USER-WP-0007`).
- Hats, realms, services, assets, access profiles, and active access
  context as user-domain facts.
- Invitations, prepared accounts, entitlement claims, and user-engine-owned
  onboarding journeys.
- Public registration orchestration (start, verify, resume, cancel,
  provider password-setup handoff) behind
  `USER_ENGINE_PUBLIC_REGISTRATION`, fail-closed when credentials are
  absent.
- Optional CSRF-protected portal over the same APIs: `/me`, `/onboarding`,
  `/admin/{tenant}`, `/platform`, `/register`.
- Durable PostgreSQL store with migrations, plus in-memory fixtures for
  standalone conformance.
- HTTP adapters for flex-auth (rotating caller token, live A2 on
  `flex-auth-user-engine`), tenant-engine lifecycle, identity-provisioner,
  registration verification, and split event/mail outbox delivery.
- OpenAPI portal contract `0.3.0` (`TenantRecord`, update/retire/reactivate).
- Scenario and security matrices. Full suite: 150 tests, three
  provider-gated skips.

Production image evidence includes
`sha256:c501aeb2…` (caller token) on Railiance. flex-auth-user-engine
enforce probe 2026-08-19: `200` with the projected token, `401` without,
`403` when representing `tenant-engine`.

## Boundary Verification

user-engine still does not issue tokens, verify MFA, store credentials, or
act as the policy decision point. It does not own tenant identifiers,
grouping reclassification, capability-role grants, runtime secrets,
platform audit storage, or transactional SMTP.

It consumes verified IAM Profile v0.3 claims, asks flex-auth, calls
tenant-engine and identity-provisioner, and emits redacted audit/outbox
records. The in-repo portal is an optional surface, not a UI product;
password and MFA screens stay on the identity provider.

## Accepted Deviations

- Package version remains `0.1.0`. Schema and service contracts may still
  evolve before `1.0.0`, with migrations and scenario updates.
- Access-review, policy, control, and exception are references or gaps,
  not owned records (see `docs/canon-interface-card.yaml`).
- Application first-login profiles, unlink, and action step-up stay with
  consuming apps and KeyCape (`USER-WP-0022` T03/T04 cancelled).
- `/metrics` is a bounded local snapshot (`user_engine_ready` plus record
  counts), not platform telemetry.
- The user-engine boundary contract is accepted in net-kingdom and marked
  `publish` in policy-nexus, but it is not yet on
  `policy.coulomb.social`.

## Residuals

Operator-owned, not remaining product code:

- Public registration and outbox mail stay fail-closed until governed
  OpenBao verification/delivery tokens and the transactional SMTP lane
  are installed. No placeholder credential.
- Live tenant-lifecycle probe from a user-engine pod (GET / PATCH /
  retire / reactivate on a disposable tenant) is still owed. Contract
  tests cannot see a digest pin rollback.
- `policy.enabled` and tenant-engine caller `enforce` belong to flex-auth
  / tenant-engine.
- Pod `fsGroup: 10001` is required so uid 10001 can read the projected
  flex-auth caller token; persisted in rapp-user-engine
  `manifests/runtime.yaml` `e599b4f`.

Demand-triggered, not started here:

- Inbound federation, SCIM, or directory sync — new workplan only if a
  tenant requires it; published path is IAM Profile v0.3 Keycloak
  expanded mode.
- First-class access-review/governance records.
- A dedicated agent consumption product (projections already exist).
- Extracting a generic profile engine.

## Follow-Up Work

The previous follow-ups are done: durable PostgreSQL, HTTP transport,
flex-auth, outbox drain, and a live Railiance deploy. Remaining work is
the residuals above, plus ordinary release hygiene (SBOM, static/security
scans) when the next image is published.