Add public registration cancellation

workplans/USER-WP-0021-portal-product-expansion.md

@@ -4,13 +4,14 @@ type: workplan
 title: "Expand user-engine portal beyond the proven Binky MVP"
 domain: communication
 repo: user-engine
-status: active
+status: blocked
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
 updated: "2026-08-10"
 depends_on:
   - USER-WP-0020
+  - TEN-WP-0005
 state_hub_workstream_id: "ba217f48-5fa5-4178-9c79-73aa225f3f2e"
 ---
 
@@ -23,7 +24,7 @@ holding the proven production MVP open. Activate according to tenant demand.
 
 ```task
 id: USER-WP-0021-T01
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "342299b8-d9a3-408d-bf0d-914496714d5f"
 ```
@@ -205,3 +206,9 @@ supports tenant creation plus role/plan operations, but exposes no tenant
 metadata-update or retirement operation. Portal update/retirement routes must
 remain out until that authority owns the corresponding lifecycle contract;
 user-engine will not simulate authoritative tenant state locally.
+
+TEN-WP-0005 is now registered and ready in tenant-engine for the authoritative
+metadata update, retirement, and reactivation contract. This task is waiting
+on that workplan and on the OpenBao-backed event/mail delivery credentials.
+The non-secret flex-auth runtime URL is live and verified, removing that item
+from the rollout gate.