Finish USER-WP-0022; leave public registration fail-closed

In-repo journey, recovery, and security matrix are complete (150 tests).
T03/T04 stay cancelled at coulomb-social and KeyCape. Production enablement
remains an operator flag plus governed verification and SMTP credentials.

docs/configuration.md

@@ -56,3 +56,17 @@ The adapter calls `POST /v1/tenants` with correlation and idempotency headers.
 The token is never returned in errors, audit records, outbox events, or browser
 responses. When the settings are absent, ordinary portal behavior remains
 available and platform tenant creation fails closed as unavailable.
+
+Public registration is off unless `USER_ENGINE_PUBLIC_REGISTRATION=true`.
+Enabling it also requires the verification adapter and allow-lists:
+
+- `USER_ENGINE_REGISTRATION_VERIFICATION_URL`
+- `USER_ENGINE_REGISTRATION_VERIFICATION_TOKEN`
+- `USER_ENGINE_REGISTRATION_CLIENTS`
+- `USER_ENGINE_REGISTRATION_TENANTS`
+- `USER_ENGINE_REGISTRATION_PASSWORD_SETUP_ORIGINS`
+- `USER_ENGINE_MAIL_URL` and `USER_ENGINE_MAIL_TOKEN` when verification
+  mail is delivered through the outbox
+
+The service fails closed when those settings are absent. Do not add a
+placeholder or reused credential to turn the flag on.

workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Public registration and JIT application profiles"
 domain: communication
 repo: user-engine
-status: blocked
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-09"
-updated: "2026-08-16"
+updated: "2026-08-19"
 depends_on:
   - USER-WP-0021
   - NK-WP-0025
@@ -26,7 +26,7 @@ identity creation to NetKingdom.
 
 ```task
 id: USER-WP-0022-T01
-status: wait
+status: done
 priority: high
 state_hub_task_id: "43dd49b7-6dbc-4117-a401-6d9f6e59aa26"
 ```
@@ -121,8 +121,16 @@ What remains is not user-engine code. Public registration stays disabled until
 the OpenBao verification and delivery tokens plus the transactional SMTP lane
 are delivered through governed channels. The service already fails closed when
 they are absent, and no placeholder or reused credential will be added to
-unblock it. This task stays in `wait` because the remaining gate is a
-credential-custody handoff, not an outstanding change here.
+unblock it.
+
+2026-08-19 close: this task's user-engine scope is complete. The flow can be
+enabled per deployment without enumerating email or username; that is a
+runtime flag and governed credential install, not remaining code. NK-WP-0025
+is finished and already recorded live Case B against a scoped verification
+token (anonymous start, mailbox verify, baseline provision, allow-listed
+password handoff). USER-WP-0021 is finished. Keeping T01 in `wait` would
+hold this workplan open on operator custody that is documented as residual
+below.
 
 ## T02 - Orchestrate provider identity creation
 
@@ -209,7 +217,7 @@ step-up. user-engine must not become the token assurance authority.
 
 ```task
 id: USER-WP-0022-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "0a5a5f3a-0d47-4d5d-bda5-e2c7c737fee6"
 ```
@@ -247,6 +255,24 @@ The latest tested image is published at
 the matching email-connect image is
 `forgejo.coulomb.social/coulomb/email-connect@sha256:bc7a01b4ab9acd2f12f3150c84e4b6590744c035bc15689c93584d8da06bd730`.
 The cluster already applies a Traefik-wide rate limit, and the runtime manifest
-now explicitly configures the stricter application registration limit. Public
-registration remains disabled pending its OpenBao verification/delivery tokens
-and transactional SMTP configuration.
+now explicitly configures the stricter application registration limit.
+
+2026-08-19 close: the in-repo matrix is complete. The full suite passes 150
+tests with three provider-gated skips. Application JIT replay, step-up
+downgrade, and unlink stay cancelled here (T03 / T04 → CSOC-WP-0003 and
+KEY-WP-0008). Deployed consumer conformance was accepted on NK-WP-0025-T05
+(Case B disposable path plus attended Case A). Public registration remains
+fail-closed until an operator sets `USER_ENGINE_PUBLIC_REGISTRATION=true`
+with governed verification, mail, and SMTP lanes — the same residual as
+USER-WP-0021 outbox activation, not outstanding user-engine code.
+
+## Residuals after close (2026-08-19)
+
+- Production enablement: `USER_ENGINE_PUBLIC_REGISTRATION=true` plus
+  OpenBao verification/delivery tokens and the transactional SMTP lane
+  (`warden route find` → `email-connect-transactional`). No placeholder
+  credential.
+- Application first-login profile, step-up, and unlink remain in
+  coulomb-social / KeyCape.
+- The USER-WP-0021 live tenant-lifecycle probe is still owed and is not
+  this workplan.