Expose provider-neutral identity reconciliation

src/user_engine/ports.py

@@ -66,6 +66,15 @@ class ProvisioningResult:
     password_setup_url: str | None = None
 
 
+@dataclass(frozen=True)
+class IdentityDriftResult:
+    provider: str
+    external_subject: str
+    status: str
+    drift: tuple[str, ...] = ()
+    changed: tuple[str, ...] = ()
+
+
 class IdentityProvisioningPort(Protocol):
     """Lifecycle seam owned by NetKingdom adapters, not the user domain."""
 
@@ -87,6 +96,24 @@ class IdentityProvisioningPort(Protocol):
     ) -> ProvisioningResult:
         """Remove or tombstone an identity according to provider policy."""
 
+    def drift(
+        self,
+        request: ProvisioningRequest,
+        *,
+        external_subject: str,
+        desired_status: str = "active",
+    ) -> IdentityDriftResult:
+        """Inspect provider state without changing it or exposing credentials."""
+
+    def reconcile(
+        self,
+        request: ProvisioningRequest,
+        *,
+        external_subject: str,
+        desired_status: str = "active",
+    ) -> IdentityDriftResult:
+        """Converge managed provider state toward the requested lifecycle."""
+
 
 class UserEngineStore(Protocol):
     """Durable persistence boundary for user-engine service behavior.