Implement role-based account journeys with database and browser acceptance suites

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

workplans/USER-WP-0027-account-journey-clarity.md

@@ -104,3 +104,8 @@ platform operator, expired and wrong-tenant identities. Include invitation/mail,
 actual OTP, shared sign-out, keyboard/mobile, form preservation, and authoritative
 application access (USER-WP-0026-T03). Preserve VERGABE-WP-0019 real-user acceptance.
 Record live evidence and hand off any residuals as live work before closing.
+
+
+Implementation is split into USER-WP-0028 (user), USER-WP-0029 (tenant admin),
+USER-WP-0030 (platform admin), and USER-WP-0031 (automated acceptance). These
+are live workplans, not residuals parked only in the journey document.

workplans/USER-WP-0028-user-journey-acceptance.md

@@ -0,0 +1,51 @@
+---
+id: USER-WP-0028
+type: workplan
+title: "User account journeys and recovery"
+domain: communication
+repo: user-engine
+status: active
+owner: codex
+topic_slug: communication
+created: "2026-09-13"
+updated: "2026-09-13"
+---
+
+Implements docs/account-journeys.md under USER-WP-0027. A passing local
+suite is not evidence that an external provider flow works live.
+
+## Complete self-service feedback and safe retries
+
+```task
+id: USER-WP-0028-T01
+status: done
+priority: high
+```
+
+U01–U04/U10–U13: preserve safe profile input on validation failure; confirm saves, expose actual login name at password handoff, keep invitation/expired/session recovery reachable. Cover success, denial, provider interruption and retry.
+
+## Connect authoritative application access
+
+```task
+id: USER-WP-0028-T02
+status: todo
+priority: high
+```
+
+U09 and T05: integrate a supported catalogue/admission source and scoped grants/revocation. Do not present static links or membership as effective authorization. Continues USER-WP-0026-T03; establish provider contract before deployment.
+
+## Complete optional OTP onboarding with provider evidence
+
+```task
+id: USER-WP-0028-T03
+status: wait
+priority: high
+```
+
+U05–U08: depends on KEY-WP-0035 and NK-WP-0033 credential custody. Verify enrollment/cancel/replace/lost-factor recovery and old-AAL1-session behavior before enabling live handoff. No stub acceptance.
+
+
+Validation: 210 database-enabled regression tests passed with no skips,
+including independent-connection last-admin protection and nested bootstrap
+rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
+access integration remain explicitly open; no complete-journey claim is inferred.

workplans/USER-WP-0029-tenant-admin-journeys.md

@@ -0,0 +1,51 @@
+---
+id: USER-WP-0029
+type: workplan
+title: "Tenant administrator journeys and lifecycle isolation"
+domain: communication
+repo: user-engine
+status: active
+owner: codex
+topic_slug: communication
+created: "2026-09-13"
+updated: "2026-09-13"
+---
+
+Implements docs/account-journeys.md under USER-WP-0027. A passing local
+suite is not evidence that an external provider flow works live.
+
+## Authorize target before provider calls
+
+```task
+id: USER-WP-0029-T01
+status: done
+priority: high
+```
+
+T01/T03/T04/T06: reject non-admin and wrong-tenant user IDs before provisioning/recovery/lifecycle calls; bind invitation operations to route tenant; protect shared identities from global tenant-scoped mutation.
+
+## Confirm lifecycle changes and protect admin succession
+
+```task
+id: USER-WP-0029-T02
+status: done
+priority: high
+```
+
+T06/T08: preview target/scope/action, CSRF-bound confirmation, reject stale state and last-admin removal, provide cancel and recovery. Keep domain/API guards as well as UI checks. Document concurrency/external propagation limits.
+
+## Explain onboarding and delivery state
+
+```task
+id: USER-WP-0029-T03
+status: done
+priority: high
+```
+
+T02/T03/T04/T07: show actual directory login separately from display name, account state, provider uncertainty, invitation delivery status and appropriate next steps; prevent duplicate rows from workload memberships.
+
+
+Validation: 210 database-enabled regression tests passed with no skips,
+including independent-connection last-admin protection and nested bootstrap
+rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
+access integration remain explicitly open; no complete-journey claim is inferred.

workplans/USER-WP-0030-platform-admin-journeys.md

@@ -0,0 +1,51 @@
+---
+id: USER-WP-0030
+type: workplan
+title: "Platform administration and operational recovery"
+domain: communication
+repo: user-engine
+status: active
+owner: codex
+topic_slug: communication
+created: "2026-09-13"
+updated: "2026-09-13"
+---
+
+Implements docs/account-journeys.md under USER-WP-0027. A passing local
+suite is not evidence that an external provider flow works live.
+
+## Expose scoped audit and delivery recovery
+
+```task
+id: USER-WP-0030-T01
+status: done
+priority: high
+```
+
+P01/P03/P05/P08/T08: authorized browser views of safe audit metadata and delivery state, reference filtering, CSRF replay with readback, no raw payload/credential/error dumps.
+
+## Make tenant lifecycle and bootstrap recoverable
+
+```task
+id: USER-WP-0030-T02
+status: done
+priority: high
+```
+
+P02/P04/P07: preserve first-admin setup on retry without duplication, explicit tenant lifecycle confirmation, stale-version recovery and validation; verify cross-role isolation.
+
+## Integrate provider policy and credential operations
+
+```task
+id: USER-WP-0030-T03
+status: wait
+priority: high
+```
+
+P04–P06: owner-approved factor credential delivery/renewal and provider recovery/policy control. Depends on KEY-WP-0035/NK-WP-0033; no secret vending through portal or chat.
+
+
+Validation: 210 database-enabled regression tests passed with no skips,
+including independent-connection last-admin protection and nested bootstrap
+rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
+access integration remain explicitly open; no complete-journey claim is inferred.

workplans/USER-WP-0031-automated-journey-suites.md

@@ -0,0 +1,51 @@
+---
+id: USER-WP-0031
+type: workplan
+title: "Automated user and administrator journey suites"
+domain: communication
+repo: user-engine
+status: active
+owner: codex
+topic_slug: communication
+created: "2026-09-13"
+updated: "2026-09-13"
+---
+
+Implements docs/account-journeys.md under USER-WP-0027. A passing local
+suite is not evidence that an external provider flow works live.
+
+## Add repeatable suites for each role
+
+```task
+id: USER-WP-0031-T01
+status: done
+priority: high
+```
+
+Run synthetic identities through actual WSGI routes and domain stores, with controlled provider failure/retry fixtures. Assert success, denial, unchanged state on failure, recovery and tenant isolation. Add make test-journeys and CI execution.
+
+## Maintain machine-readable coverage for all 29 journeys
+
+```task
+id: USER-WP-0031-T02
+status: done
+priority: high
+```
+
+Map every journey to real tests and explicit external acceptance blockers. Report missing live acceptance as incomplete, never a passing placeholder. Keep matrix/workplans synchronized.
+
+## Publish and verify implemented journeys
+
+```task
+id: USER-WP-0031-T03
+status: progress
+priority: high
+```
+
+Run full unit/conformance suites and live read-only smoke, deploy digest-pinned reviewed source with CAS and rollback evidence. Retain provider-dependent journeys as live tasks until external acceptance passes.
+
+
+Validation: 210 database-enabled regression tests passed with no skips,
+including independent-connection last-admin protection and nested bootstrap
+rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
+access integration remain explicitly open; no complete-journey claim is inferred.