Expand portal onboarding and administration

workplans/USER-WP-0021-portal-product-expansion.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Expand user-engine portal beyond the proven Binky MVP"
 domain: communication
 repo: user-engine
-status: backlog
+status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
-updated: "2026-07-30"
+updated: "2026-08-08"
 depends_on:
   - USER-WP-0020
 state_hub_workstream_id: "ba217f48-5fa5-4178-9c79-73aa225f3f2e"
@@ -23,7 +23,7 @@ holding the proven production MVP open. Activate according to tenant demand.
 
 ```task
 id: USER-WP-0021-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "342299b8-d9a3-408d-bf0d-914496714d5f"
 ```
@@ -32,11 +32,25 @@ Add invitation claim/resend/expiry, platform tenant management and recovery
 routes, optimistic concurrency, complete OpenAPI schemas, and durable outbox
 delivery/replay/dead-letter operations.
 
+2026-08-08 increment: durable invitations now carry expiry and an optimistic
+version. The API supports tenant create/list, version-gated resend/expire, and
+authenticated claim with terminal-state and stale-version rejection. Outbox
+state now covers attempts, bounded failures, delivery, replay, and dead-letter
+through the store abstraction. OpenAPI 0.2 documents invitation and removal
+operations. Platform recovery breadth and an outbox operator transport remain.
+
+2026-08-08 follow-up: a provider-neutral `TenantManagementPort` now supports
+platform-operator tenant creation with optional first-admin preparation. A
+redacted recovery route recreates or reconciles provider identity state and
+reactivates tenant lifecycle, while authenticated operator routes dispatch and
+replay durable outbox events. Ordinary tenant users are denied these routes.
+Broader tenant update/retirement operations remain.
+
 ## T02 - Expand self-service onboarding UX
 
 ```task
 id: USER-WP-0021-T02
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "dc548cfb-db7c-4cbd-864f-2effeebc3dbd"
 ```
@@ -45,11 +59,34 @@ Add invitation acceptance, email-verification status, consent/profile,
 tenant-selection, and fully resumable onboarding screens while keeping
 password and MFA material on provider-owned surfaces.
 
+2026-08-08 increment: invitation claim is now a first-class authenticated API
+operation and preserves the provider-owned credential boundary. Dedicated
+browser screens for the fully resumable journey remain.
+
+2026-08-08 browser increment: authenticated users can review and accept an
+invitation through a CSRF-protected flow, then land on a responsive onboarding
+status screen showing provider verification, tenant memberships, and journey
+state. Acceptance binds the verified OIDC email to the invitation address.
+Consent/profile editing and tenant switching remain.
+
+2026-08-08 completion increment: self-service profile completion and versioned
+consent are now durable, audited, and emitted through the outbox; verified
+email remains immutable. Membership-scoped tenant selection is available for
+onboarding views, and a PKCE reauthentication handoff carries a tenant hint so
+the identity provider—not browser state—changes authoritative tenant context.
+Interactive completion of subsystem-owned journey steps remains.
+
+2026-08-08 completion: users can complete active user-engine-owned onboarding
+steps through API or CSRF-protected browser controls. Journey ownership is
+checked before mutation. Password, MFA, and other subsystem-owned steps expose
+handoff status only and cannot be completed from user-engine; their callbacks
+resume the durable journey. This completes the self-service onboarding scope.
+
 ## T03 - Expand administration UX
 
 ```task
 id: USER-WP-0021-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "3e0b41ee-6159-46a4-a9fe-c5b6d714cc2a"
 ```
@@ -57,11 +94,38 @@ state_hub_task_id: "3e0b41ee-6159-46a4-a9fe-c5b6d714cc2a"
 Add platform tenant creation, first-admin bootstrap, invitation/recovery
 management, account removal, and redacted lifecycle-gap diagnostics.
 
+2026-08-08 increment: account removal now uses the provider-neutral
+deprovisioning port and disables the tenant lifecycle record. Platform
+creation/bootstrap and recovery UI remain.
+
+2026-08-08 follow-up: platform APIs now create tenants through the tenant
+authority, prepare the first administrator, and perform redacted identity
+recovery. Browser administration screens for these operations remain.
+
+2026-08-08 browser increment: tenant administrators can create, inspect,
+resend, and expire invitations with versioned CSRF-protected forms, and remove
+accounts through the provider-neutral deprovisioning boundary.
+
+2026-08-08 platform-browser increment: platform operators have a responsive,
+CSRF-protected tenant-creation screen with optional first-admin preparation
+and a direct handoff to tenant administration. Redacted recovery and
+lifecycle-gap browser diagnostics remain.
+
+2026-08-08 recovery-browser increment: platform operators can inspect redacted
+lifecycle-gap categories and invoke CSRF-protected identity recovery from the
+tenant member view. Recovery recreates a missing provider link or reconciles
+an existing identity, then restores the tenant lifecycle record without
+showing credentials, factor evidence, or provider error bodies.
+
+2026-08-08 completion: tenant and platform browser surfaces now cover every
+listed administration operation while retaining tenant boundaries, CSRF,
+provider-neutral lifecycle ports, and redacted diagnostics.
+
 ## T04 - Complete broad security and accessibility conformance
 
 ```task
 id: USER-WP-0021-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "fb59245e-6989-4bd9-b72a-68e53ea9f0af"
 ```
@@ -71,6 +135,32 @@ outage, partial failure, audit-redaction, keyboard/screen-reader, and
 mobile/desktop conformance. Preserve existing cross-tenant and escalation
 denial gates.
 
+2026-08-08 increment: conformance covers invitation conflicts, resend/expiry,
+outbox provider failure, replay, dead-letter, successful recovery, and
+provider-neutral account removal. Browser accessibility breadth remains.
+
+2026-08-08 follow-up: conformance now also proves ordinary-user denial of the
+platform surface and the positive platform tenant/bootstrap, recovery, and
+outbox delivery workflow.
+
+2026-08-08 browser increment: conformance proves CSRF enforcement, invitation
+email binding, successful browser claim and onboarding redirect, responsive
+viewport metadata, focus-visible controls, semantic landmarks, and invitation
+and removal administration controls.
+
+2026-08-08 self-service/recovery increment: conformance additionally covers
+durable consent/profile completion, immutable verified email, tenant-hinted
+OIDC reauthentication, platform recovery controls, and redacted lifecycle-gap
+presentation.
+
+2026-08-08 completion: the automated matrix covers duplicate, explicitly
+expired, revoked, and replayed invitations; stale versions; expired sessions;
+provider outage and unchanged lifecycle state; bounded error/audit surfaces;
+cross-tenant and platform denial; semantic headings/landmarks; visible keyboard
+focus; responsive viewport/mobile tables; provider handoff denial; and
+desktop/browser positive flows. The full suite passes 115 tests with three
+provider integration tests skipped when their external service is absent.
+
 ## T05 - Trigger enterprise federation planning only on demand
 
 ```task