Add public registration cancellation

workplans/USER-WP-0021-portal-product-expansion.md

@@ -4,13 +4,14 @@ type: workplan
 title: "Expand user-engine portal beyond the proven Binky MVP"
 domain: communication
 repo: user-engine
-status: active
+status: blocked
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
 updated: "2026-08-10"
 depends_on:
   - USER-WP-0020
+  - TEN-WP-0005
 state_hub_workstream_id: "ba217f48-5fa5-4178-9c79-73aa225f3f2e"
 ---
 
@@ -23,7 +24,7 @@ holding the proven production MVP open. Activate according to tenant demand.
 
 ```task
 id: USER-WP-0021-T01
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "342299b8-d9a3-408d-bf0d-914496714d5f"
 ```
@@ -205,3 +206,9 @@ supports tenant creation plus role/plan operations, but exposes no tenant
 metadata-update or retirement operation. Portal update/retirement routes must
 remain out until that authority owns the corresponding lifecycle contract;
 user-engine will not simulate authoritative tenant state locally.
+
+TEN-WP-0005 is now registered and ready in tenant-engine for the authoritative
+metadata update, retirement, and reactivation contract. This task is waiting
+on that workplan and on the OpenBao-backed event/mail delivery credentials.
+The non-secret flex-auth runtime URL is live and verified, removing that item
+from the rollout gate.

workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Public registration and JIT application profiles"
 domain: communication
 repo: user-engine
-status: active
+status: blocked
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-09"
@@ -94,6 +94,14 @@ redacted rejection without provider or account detail. The full suite passes
 130 tests with three environment-dependent skips. Cluster ingress throttling
 remains defense in depth before public enablement.
 
+2026-08-10 cancellation increment: each verification email now carries a
+fixed cancellation link using the same digest-only opaque handle. A
+CSRF-protected confirmation consumes purpose-bound cancellation evidence and
+terminally abandons the matching registration. Cancellation and verification
+atomically invalidate one another, replay fails closed, and no identity is
+created from cancellation. The full user-engine suite passes 133 tests with
+three environment-dependent skips; email-connect passes all 24 tests.
+
 ## T02 - Orchestrate provider identity creation
 
 ```task
@@ -179,7 +187,7 @@ step-up. user-engine must not become the token assurance authority.
 
 ```task
 id: USER-WP-0022-T05
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "0a5a5f3a-0d47-4d5d-bda5-e2c7c737fee6"
 ```
@@ -204,3 +212,10 @@ linking to an existing account. Reusing an existing provider username fails at
 the identity-link uniqueness boundary, leaves the original link unchanged, and
 never transfers that identity to the later registration. The full suite passes
 131 tests with three environment-dependent skips.
+
+The latest tested image is published at
+`forgejo.coulomb.social/coulomb/user-engine@sha256:bbc4ae9373b09432e67bdc66bc32878b5c4ecbcb128ebed8c7ca25d2d4b3d741`.
+The cluster already applies a Traefik-wide rate limit, and the runtime manifest
+now explicitly configures the stricter application registration limit. Public
+registration remains disabled pending its OpenBao verification/delivery tokens
+and transactional SMTP configuration.