Implement role-based account journeys with database and browser acceptance suites

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/user_engine/ports.py

@@ -175,6 +175,12 @@ class IdentityProvisioningPort(Protocol):
     def provision(self, request: ProvisioningRequest) -> ProvisioningResult:
         """Create or resume an external login identity."""
 
+    def tenant_access(
+        self, *, external_subject: str, tenant: str, roles: tuple[str, ...],
+        enabled: bool, idempotency_key: str, correlation_id: str,
+    ) -> ProvisioningResult:
+        """Change only this tenant's directory groups, preserving identity and other tenants."""
+
     def suspend(
         self, *, external_subject: str, idempotency_key: str, correlation_id: str
     ) -> ProvisioningResult:
@@ -422,6 +428,12 @@ class UserEngineStore(Protocol):
     def append_outbox(self, event: OutboxEvent) -> None:
         """Append an outbox event."""
 
+    def tenant_lifecycle_guard(self, tenant: str):
+        """Serialize a tenant's lifecycle/role changes across provider and local writes."""
+
+    def outbox_history(self) -> tuple[OutboxEvent, ...]:
+        """Return delivery records including failed and completed attempts."""
+
     def pending_outbox(self) -> tuple[OutboxEvent, ...]:
         """Return pending outbox events in write order."""