Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts

IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.

workplans/USER-WP-0021-portal-product-expansion.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Expand user-engine portal beyond the proven Binky MVP"
 domain: communication
 repo: user-engine
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
-updated: "2026-08-16"
+updated: "2026-08-19"
 depends_on:
   - USER-WP-0020
   - TEN-WP-0005
@@ -190,7 +190,7 @@ deployed and wants its own permission.
 
 ```task
 id: USER-WP-0021-T05
-status: wait
+status: done
 priority: low
 state_hub_task_id: "05046780-9625-47c2-8caf-f57e9239c603"
 ```
@@ -199,6 +199,24 @@ When a tenant requires SAML/OIDC federation, SCIM, directory synchronization,
 just-in-time provisioning, or customer-owned lifecycle, create a dedicated
 cross-repository plan against the provider-neutral contracts.
 
+2026-08-19 policy-nexus adaptation: no tenant has demanded those
+integrations, so this workplan does not spawn one. The trigger now points
+at published contracts rather than unpublished drafts:
+
+- IAM Profile v0.3 at
+  `https://policy.coulomb.social/standards/iam-profile/v0.3/` — Keycloak
+  expanded mode remains the interchangeable enterprise-federation
+  implementation; grouping and `tenant_roles` are independent axes
+  (ADR-0013 / ADR-0014). Existing v0.2 claim handling stays conformant.
+- Tenancy Posture v0.1 at
+  `https://policy.coulomb.social/standards/tenancy-posture/v0.1/`.
+- NetKingdom architecture draft-2 at
+  `https://policy.coulomb.social/architecture/net-kingdom/v0.1/`.
+
+user-engine still does not own federation, SCIM, or directory
+synchronization. A new workplan is the right vehicle if a tenant later
+requires them. This workplan's product-expansion scope is complete.
+
 ## Production rollout (2026-08-08)
 
 Commit `8229c6d` passed 115 tests with three external-provider skips, was
@@ -283,3 +301,17 @@ instead of receiving the documented bounded automatic retry. The query now
 selects every undelivered, non-dead-letter event; regression coverage checks
 that failed rows are not filtered out. The full suite passes 133 tests with
 three external-provider skips.
+
+## Residuals after close (2026-08-19)
+
+- Live tenant-lifecycle probe from a user-engine pod (GET / PATCH / retire /
+  reactivate on a disposable tenant) remains owed with USER-WP-0023-T03.
+  Contract tests cannot see a digest pin rollback.
+- Outbox transport activation still waits on governed OpenBao event/mail
+  tokens and transactional SMTP credentials.
+- Optional `tenant_roles` is now forwarded to flex-auth. Privileged
+  live re-query against tenant-engine is required only if a future policy
+  treats those roles as `aal2`-class input; flex-auth currently has no
+  such policy.
+- A new workplan is required if a tenant demands federation, SCIM, or
+  directory synchronization.

workplans/USER-WP-0023-flex-auth-caller-identity.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-08-18"
-updated: "2026-08-18"
+updated: "2026-08-19"
 state_hub_workstream_id: "014d0886-b690-4860-8337-c718e440f678"
 ---
 
@@ -80,4 +80,26 @@ This task stays `wait` on FLEX-WP-0015-T02 promotion through FLEX-WP-0011,
 and on an operator shell with cluster credentials, which agent sessions in
 this repo do not hold.
 
+2026-08-19 policy-nexus adaptation: the published contracts now name the
+same split this workplan already implemented.
+
+- IAM Profile v0.3 Service Account Flow
+  (`https://policy.coulomb.social/standards/iam-profile/v0.3/`) requires
+  audience-scoped, rotating workload credentials delivered through the
+  credential-management standard — that is the projected ServiceAccount
+  token we already send. The optional `tenant_roles` claim is forwarded
+  to flex-auth as a subject attribute and is never used as a local
+  authorization decision.
+- Tenancy Posture v0.1
+  (`https://policy.coulomb.social/standards/tenancy-posture/v0.1/`) is the
+  public A2 target T03 is waiting to prove: a single inbound choke point
+  that refuses an unbound caller. Our half of that vector is deployed;
+  flex-auth's running digest is still A0.
+- NetKingdom architecture draft-2
+  (`https://policy.coulomb.social/architecture/net-kingdom/v0.1/`) lists
+  both documents in chapter 9.
+
+The workplan stays `active` because T03's live proof is still owed. That
+proof is not unblocked by publication.
+
 Contract: `docs/flex-auth-caller-identity.md`.