Add public registration browser journey

workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-09"
-updated: "2026-08-09"
+updated: "2026-08-10"
 depends_on:
   - USER-WP-0021
   - NK-WP-0025
@@ -26,7 +26,7 @@ identity creation to NetKingdom.
 
 ```task
 id: USER-WP-0022-T01
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "43dd49b7-6dbc-4117-a401-6d9f6e59aa26"
 ```
@@ -65,11 +65,21 @@ KeyCape issuer, and redirect only to an allow-listed HTTPS provider password
 setup origin. Full suite now passes 126 tests with 3 skips. Automated recovery
 after local completion/provider failure remains open before production enablement.
 
+2026-08-10 browser increment: `/register` now provides the accessible public
+account form and the home page links to it only when registration is configured.
+Anonymous mutations use a short-lived Secure/HttpOnly/SameSite double-submit
+CSRF cookie. Verification links land on an explicit one-time confirmation page,
+successful provisioning presents the allow-listed provider password handoff,
+and provider outages render a retry form backed by the separate resume handle.
+Responses remain non-enumerating. The full suite passes 128 tests with three
+environment-dependent skips. Cancellation, ingress rate limiting, and the
+credential-gated production enablement remain.
+
 ## T02 - Orchestrate provider identity creation
 
 ```task
 id: USER-WP-0022-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "74239ce4-5c1e-46cf-8abf-3cbec3f3f989"
 ```
@@ -97,6 +107,13 @@ digest, retries with the same registration idempotency key and local user,
 and invalidates the handle after provider linking. Replay is denied. The full
 suite passes 127 tests with 3 environment-dependent skips.
 
+2026-08-10 completion: identity-provisioner now validates and honors the
+canonical preferred username instead of silently deriving it from the mailbox.
+The corrected image is live at immutable digest
+`sha256:4a6ec93d74eed6e17065a7e5d4c3d8d0ed14078bdfda0112738438528c6b2680`.
+Together with the deterministic retry path, this completes the provider
+orchestration boundary without exposing provider credentials or passwords.
+
 ## T03 - Create application profiles on first login
 
 ```task
@@ -143,7 +160,7 @@ step-up. user-engine must not become the token assurance authority.
 
 ```task
 id: USER-WP-0022-T05
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "0a5a5f3a-0d47-4d5d-bda5-e2c7c737fee6"
 ```