Close portal MVP and preserve expansion backlog

workplans/USER-WP-0021-portal-product-expansion.md

@@ -0,0 +1,85 @@
+---
+id: USER-WP-0021
+type: workplan
+title: "Expand user-engine portal beyond the proven Binky MVP"
+domain: communication
+repo: user-engine
+status: backlog
+owner: codex
+topic_slug: netkingdom
+created: "2026-07-30"
+updated: "2026-07-30"
+depends_on:
+  - USER-WP-0020
+state_hub_workstream_id: "ba217f48-5fa5-4178-9c79-73aa225f3f2e"
+---
+
+# USER-WP-0021 - Portal product expansion
+
+Preserve deliberately deferred product breadth from `USER-WP-0020` without
+holding the proven production MVP open. Activate according to tenant demand.
+
+## T01 - Complete invitation and platform recovery APIs
+
+```task
+id: USER-WP-0021-T01
+status: todo
+priority: high
+state_hub_task_id: "342299b8-d9a3-408d-bf0d-914496714d5f"
+```
+
+Add invitation claim/resend/expiry, platform tenant management and recovery
+routes, optimistic concurrency, complete OpenAPI schemas, and durable outbox
+delivery/replay/dead-letter operations.
+
+## T02 - Expand self-service onboarding UX
+
+```task
+id: USER-WP-0021-T02
+status: todo
+priority: medium
+state_hub_task_id: "dc548cfb-db7c-4cbd-864f-2effeebc3dbd"
+```
+
+Add invitation acceptance, email-verification status, consent/profile,
+tenant-selection, and fully resumable onboarding screens while keeping
+password and MFA material on provider-owned surfaces.
+
+## T03 - Expand administration UX
+
+```task
+id: USER-WP-0021-T03
+status: todo
+priority: high
+state_hub_task_id: "3e0b41ee-6159-46a4-a9fe-c5b6d714cc2a"
+```
+
+Add platform tenant creation, first-admin bootstrap, invitation/recovery
+management, account removal, and redacted lifecycle-gap diagnostics.
+
+## T04 - Complete broad security and accessibility conformance
+
+```task
+id: USER-WP-0021-T04
+status: todo
+priority: high
+state_hub_task_id: "fb59245e-6989-4bd9-b72a-68e53ea9f0af"
+```
+
+Automate duplicate/expired/replayed invitation, session expiry, provider
+outage, partial failure, audit-redaction, keyboard/screen-reader, and
+mobile/desktop conformance. Preserve existing cross-tenant and escalation
+denial gates.
+
+## T05 - Trigger enterprise federation planning only on demand
+
+```task
+id: USER-WP-0021-T05
+status: wait
+priority: low
+state_hub_task_id: "05046780-9625-47c2-8caf-f57e9239c603"
+```
+
+When a tenant requires SAML/OIDC federation, SCIM, directory synchronization,
+just-in-time provisioning, or customer-owned lifecycle, create a dedicated
+cross-repository plan against the provider-neutral contracts.