Record live provisioning conformance

workplans/USER-WP-0020-self-service-and-user-administration-portal.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-27"
-updated: "2026-07-27"
+updated: "2026-07-28"
 depends_on:
   - USER-WP-0014
   - USER-WP-0015
@@ -66,6 +66,13 @@ KeyCape claims and require flex-auth decisions for protected writes. Add
 idempotency keys, optimistic concurrency, pagination, structured errors,
 OpenAPI, health/readiness, redacted audit, and transactional outbox behavior.
 
+2026-07-28 implementation evidence: the deployed versioned API can create a
+tenant-scoped user and membership, establishes the lifecycle account in the
+requested tenant even for authorized cross-tenant platform operations, and
+invokes a provider-neutral provisioning port with roles, correlation, and a
+required idempotency key. Remaining API breadth and OpenAPI/outbox work keep
+this task in progress.
+
 ## T03 - Implement self-service login and registration UX
 
 ```task
@@ -118,7 +125,7 @@ never become authoritative.
 
 ```task
 id: USER-WP-0020-T06
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "39dc383c-7213-495d-8e12-58e614706afe"
 ```
@@ -129,6 +136,12 @@ invitations, cross-tenant access, role escalation, CSRF, session expiry,
 provider outage, partial provisioning compensation, audit redaction, WCAG
 keyboard/screen-reader behavior, and mobile/desktop layouts.
 
+2026-07-28 evidence: all 101 unit tests pass (three integration skips), mounted
+secret normalization has regression coverage, and a disposable live identity
+proved first create, replay/resume, tenant group projection, and cleanup through
+the restricted deployment path. The complete browser, authorization, failure,
+accessibility, and restore matrix remains.
+
 ## T07 - Binky production acceptance
 
 ```task