Refresh final-assessment to the finished USER-WP-0001–0023 surface

Replace the in-memory/no-UI MVP note with what is actually shipped:
portal, PostgreSQL, live flex-auth A2, and the remaining operator
residuals.

docs/final-assessment.md

@@ -1,37 +1,101 @@
 # Implementation Assessment
 
+Date: 2026-08-19
+Related: `../SCOPE.md`, `../INTENT.md`, OpenAPI `0.3.0`
+
+Workplans `USER-WP-0001` through `USER-WP-0023` are finished. There is no
+active workplan. This file replaces the early-MVP assessment that still
+described an in-memory, in-process core with no UI or platform adapters.
+
 ## Implemented
 
-- Headless service API for users, accounts, identity links, applications,
+- Headless domain for users, accounts, identity links, applications,
   catalogs, profiles, projections, audit records, and outbox events.
-- Tenant context enforcement, tenant account state, memberships, tenant
-  profile precedence, tenant diagnostics, and cross-tenant denial.
+- Tenant context enforcement, memberships, tenant profile precedence,
+  redacted diagnostics, and cross-tenant denial.
 - Multi-application catalog ownership, namespace collision protection,
   semantic version checks, sensitivity downgrade prevention, app-filtered
   projections, and claims-enrichment projection caching.
-- Scenario fixtures and conformance-style tests for positive and negative
-  standalone, tenant, multi-app, redaction, audit, event, and cache paths.
+- Canon interface card, entity/relationship mappings, and explicit gap
+  records (`USER-WP-0007`).
+- Hats, realms, services, assets, access profiles, and active access
+  context as user-domain facts.
+- Invitations, prepared accounts, entitlement claims, and user-engine-owned
+  onboarding journeys.
+- Public registration orchestration (start, verify, resume, cancel,
+  provider password-setup handoff) behind
+  `USER_ENGINE_PUBLIC_REGISTRATION`, fail-closed when credentials are
+  absent.
+- Optional CSRF-protected portal over the same APIs: `/me`, `/onboarding`,
+  `/admin/{tenant}`, `/platform`, `/register`.
+- Durable PostgreSQL store with migrations, plus in-memory fixtures for
+  standalone conformance.
+- HTTP adapters for flex-auth (rotating caller token, live A2 on
+  `flex-auth-user-engine`), tenant-engine lifecycle, identity-provisioner,
+  registration verification, and split event/mail outbox delivery.
+- OpenAPI portal contract `0.3.0` (`TenantRecord`, update/retire/reactivate).
+- Scenario and security matrices. Full suite: 150 tests, three
+  provider-gated skips.
+
+Production image evidence includes
+`sha256:c501aeb2…` (caller token) on Railiance. flex-auth-user-engine
+enforce probe 2026-08-19: `200` with the projected token, `401` without,
+`403` when representing `tenant-engine`.
 
 ## Boundary Verification
 
-User-engine does not issue tokens, verify MFA, store credentials, act as the
-policy decision point, own deployment, or provide a UI. It consumes verified
-claims through an identity adapter, asks authorization through a port, emits
-audit/outbox records, and exposes backend contracts for future UIs.
+user-engine still does not issue tokens, verify MFA, store credentials, or
+act as the policy decision point. It does not own tenant identifiers,
+grouping reclassification, capability-role grants, runtime secrets,
+platform audit storage, or transactional SMTP.
+
+It consumes verified IAM Profile v0.3 claims, asks flex-auth, calls
+tenant-engine and identity-provisioner, and emits redacted audit/outbox
+records. The in-repo portal is an optional surface, not a UI product;
+password and MFA screens stay on the identity provider.
 
 ## Accepted Deviations
 
-- The first persistence adapter is in-memory. It carries schema and migration
-  semantics but is not durable.
-- The first API surface is in-process Python. HTTP/RPC transport adapters are
-  still future work.
-- Metrics and cache diagnostics are local snapshots, not platform telemetry.
+- Package version remains `0.1.0`. Schema and service contracts may still
+  evolve before `1.0.0`, with migrations and scenario updates.
+- Access-review, policy, control, and exception are references or gaps,
+  not owned records (see `docs/canon-interface-card.yaml`).
+- Application first-login profiles, unlink, and action step-up stay with
+  consuming apps and KeyCape (`USER-WP-0022` T03/T04 cancelled).
+- `/metrics` is a bounded local snapshot (`user_engine_ready` plus record
+  counts), not platform telemetry.
+- The user-engine boundary contract is accepted in net-kingdom and marked
+  `publish` in policy-nexus, but it is not yet on
+  `policy.coulomb.social`.
+
+## Residuals
+
+Operator-owned, not remaining product code:
+
+- Public registration and outbox mail stay fail-closed until governed
+  OpenBao verification/delivery tokens and the transactional SMTP lane
+  are installed. No placeholder credential.
+- Live tenant-lifecycle probe from a user-engine pod (GET / PATCH /
+  retire / reactivate on a disposable tenant) is still owed. Contract
+  tests cannot see a digest pin rollback.
+- `policy.enabled` and tenant-engine caller `enforce` belong to flex-auth
+  / tenant-engine.
+- Pod `fsGroup: 10001` is required so uid 10001 can read the projected
+  flex-auth caller token; persisted in rapp-user-engine
+  `manifests/runtime.yaml` `e599b4f`.
+
+Demand-triggered, not started here:
+
+- Inbound federation, SCIM, or directory sync — new workplan only if a
+  tenant requires it; published path is IAM Profile v0.3 Keycloak
+  expanded mode.
+- First-class access-review/governance records.
+- A dedicated agent consumption product (projections already exist).
+- Extracting a generic profile engine.
 
 ## Follow-Up Work
 
-- Add a durable database adapter and migration tests.
-- Add transport adapters with request/response contract tests.
-- Add platform authorization, audit sink, secret provider, and outbox drain
-  adapters.
-- Add release automation for SBOM, package build, static checks, and
-  deployment handoff.
+The previous follow-ups are done: durable PostgreSQL, HTTP transport,
+flex-auth, outbox drain, and a live Railiance deploy. Remaining work is
+the residuals above, plus ordinary release hygiene (SBOM, static/security
+scans) when the next image is published.