---
id: USER-WP-0020
type: workplan
title: "Production self-service and user administration portal"
domain: communication
repo: user-engine
status: active
owner: codex
topic_slug: netkingdom
created: "2026-07-27"
updated: "2026-07-27"
depends_on:
  - USER-WP-0014
  - USER-WP-0015
  - USER-WP-0019
state_hub_workstream_id: "35b9c315-e721-4e0b-9710-bad04f8d2519"
---

# USER-WP-0020 - Production self-service and user administration portal

Turn the transport-neutral UI contracts from `USER-WP-0014` into a real,
secure browser application and HTTP API backed by user-engine. The first
production acceptance case is onboarding
`bernd.worsch@binky-hedgehog.com` as tenant administrator for
`tenant:friendly:binky`.

user-engine remains authoritative for user-domain records, profiles,
memberships, invitations, registration sessions, and onboarding state.
KeyCape/NetKingdom remains authoritative for login, credentials, MFA,
authentication sessions, and OIDC tokens. flex-auth remains authoritative for
authorization decisions.

## T01 - Ratify the portal boundary and threat model

```task
id: USER-WP-0020-T01
status: done
priority: high
state_hub_task_id: "9886ac8d-7456-4de0-b019-351dfd74ec20"
```

Define browser/API trust boundaries, public and authenticated routes, role
projections, CSRF/session/XSS controls, rate limits, account-enumeration
resistance, invitation abuse controls, audit correlation, privacy retention,
and recovery behavior. Define an explicit `IdentityProvisioningPort`; the
domain must not import LLDAP, privacyIDEA, KeyCape, email, or flex-auth clients.

Keep enterprise federation, SCIM, corporate directory synchronization, and
SAML administration out of scope while preserving provider-neutral identity
links, membership envelopes, provisioning adapters, and external ownership
metadata for that later stage.

## T02 - Implement a production HTTP API

```task
id: USER-WP-0020-T02
status: wait
priority: high
state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411"
```

Expose versioned APIs for registration start/resume/complete, invitation
claim, current-user profile, tenant membership, onboarding, tenant-admin user
management, and platform-admin tenant/user management. Consume verified
KeyCape claims and require flex-auth decisions for protected writes. Add
idempotency keys, optimistic concurrency, pagination, structured errors,
OpenAPI, health/readiness, redacted audit, and transactional outbox behavior.

## T03 - Implement self-service login and registration UX

```task
id: USER-WP-0020-T03
status: progress
priority: high
state_hub_task_id: "45ed1485-003d-4e5f-99fb-91b1b430f3fa"
```

Build an accessible responsive browser flow for sign in, registration,
invitation acceptance, email verification status, password-setup handoff,
MFA-enrollment handoff, consent, profile completion, tenant selection, and
resumable onboarding. Authentication and factor screens must redirect or
handoff to NetKingdom-owned surfaces; the portal must never handle provider
admin credentials or store password/MFA secrets.

## T04 - Implement tenant-admin and platform-admin UX

```task
id: USER-WP-0020-T04
status: progress
priority: high
state_hub_task_id: "16555b68-17ef-4902-bd30-f9a0cfe10f9e"
```

Tenant admins can invite, list, inspect, suspend, reactivate, and remove only
users and memberships in tenants they administer, assign approved tenant
roles, resend/expire invitations, and inspect redacted lifecycle/audit state.
Platform admins can create/manage tenants, bootstrap the first tenant admin,
inspect cross-tenant lifecycle gaps, and perform explicitly authorized
recovery actions. Prove ordinary users and tenant admins cannot reach
platform or other-tenant data.

## T05 - Add production persistence and operability

```task
id: USER-WP-0020-T05
status: progress
priority: high
state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04"
```

Package the service and web assets, use the provider-backed Postgres adapter,
run migrations safely, expose metrics and structured logs, deliver secrets
through approved runtime references, implement backups/restore evidence, and
document rollback and zero-downtime upgrade expectations. Browser state must
never become authoritative.

## T06 - Security, accessibility, and workflow conformance

```task
id: USER-WP-0020-T06
status: wait
priority: high
state_hub_task_id: "39dc383c-7213-495d-8e12-58e614706afe"
```

Automate positive and negative flows for self-registration, invite-only
registration where configured, duplicate identities, expired/replayed
invitations, cross-tenant access, role escalation, CSRF, session expiry,
provider outage, partial provisioning compensation, audit redaction, WCAG
keyboard/screen-reader behavior, and mobile/desktop layouts.

## T07 - Binky production acceptance

```task
id: USER-WP-0020-T07
status: wait
priority: high
state_hub_task_id: "b8d1c048-24d2-416c-908f-e500d63c6865"
```

Through the deployed portal—not a one-shot script—create or claim Binky,
onboard `bernd.worsch@binky-hedgehog.com`, complete KeyCape login and MFA,
assign only the Binky tenant-admin membership, and prove denial for
`tenant:platform`, `tenant:coulomb`, and unrelated tenants. Confirm the same
admin can invite and lifecycle-manage a disposable Binky test user.

## T08 - Closure and next-stage handoff

```task
id: USER-WP-0020-T08
status: wait
priority: medium
state_hub_task_id: "ecbdeef3-a0a9-40d6-9722-5cc650d78a49"
```

Close after the portal is production-operable and the Binky acceptance case
passes. Record enterprise federation follow-up triggers: customer demand for
SAML/OIDC federation, SCIM, directory synchronization, just-in-time
provisioning, or customer-owned identity lifecycle. Do not pre-implement
those integrations here.