Add user-engine architecture workplans

workplans/NK-WP-0019-user-engine-finalization-polish.md

@@ -0,0 +1,142 @@
+---
+id: NK-WP-0019
+type: workplan
+title: "User Engine Implementation Assessment And Polish"
+domain: netkingdom
+repo: net-kingdom
+status: ready
+owner: codex
+topic_slug: netkingdom
+planning_priority: medium
+planning_order: 19
+created: "2026-05-22"
+updated: "2026-05-22"
+depends_on:
+  - NK-WP-0018
+state_hub_workstream_id: "d2daa8b4-8ecf-4377-b382-492e653735f7"
+---
+
+# NK-WP-0019 - User Engine Implementation Assessment And Polish
+
+## Goal
+
+Assess the implemented user-engine against its PRD, architecture blueprint,
+NetKingdom boundary contracts, and integrated test scenarios. Finalize
+documentation, operational readiness, release packaging, and handoff criteria
+for future `user-account` and `user-manager` UI work.
+
+## Scope
+
+In scope:
+
+- implementation review against PRD and blueprint;
+- boundary review against NetKingdom IAM Profile, flex-auth, key-cape,
+  Keycloak, OpenBao, and Railiance responsibilities;
+- API/schema polish;
+- operability and documentation polish;
+- release readiness;
+- State Hub and responsibility-map reconciliation;
+- UI handoff readiness.
+
+Out of scope:
+
+- building user-account or user-manager UIs;
+- adding new major product capabilities;
+- enterprise provisioning beyond documented adapter boundaries.
+
+## Tasks
+
+```task
+id: NK-WP-0019-T1
+status: todo
+priority: high
+state_hub_task_id: "116b5362-ebbf-4d21-83e8-bbc82e80a71a"
+```
+
+**Implementation assessment.** Review implemented behavior against
+`INTENT.md`, the PRD, the architecture blueprint, the architecture review,
+and NK-WP-0014 boundary contracts. Record gaps, accepted deviations, and
+follow-up work.
+
+```task
+id: NK-WP-0019-T2
+status: todo
+priority: high
+state_hub_task_id: "08bd8ca3-dd7e-41c9-b8d2-c9b7c72ceb0a"
+```
+
+**Boundary and responsibility review.** Verify that user-engine has not
+absorbed identity provider, MFA, credential, PDP, UI, or deployment
+responsibilities. Update NetKingdom responsibility-map classification if
+user-engine is now a shared platform service holding NetKingdom-orchestrated
+resources.
+
+```task
+id: NK-WP-0019-T3
+status: todo
+priority: medium
+state_hub_task_id: "b8ff89a1-cdfb-445a-ae4d-ca4fd4a455eb"
+```
+
+**API and schema polish.** Stabilize endpoint names, error taxonomy, catalog
+descriptor schemas, projection responses, audit event shapes, and migration
+contracts. Remove accidental implementation details from public contracts.
+
+```task
+id: NK-WP-0019-T4
+status: todo
+priority: medium
+state_hub_task_id: "f57d87d7-fdc8-485c-ba93-86c5a8342f04"
+```
+
+**Operability polish.** Add readiness diagnostics, metrics, structured logs,
+audit correlation checks, outbox drain diagnostics, cache status, and
+runbooks for common failure modes.
+
+```task
+id: NK-WP-0019-T5
+status: todo
+priority: medium
+state_hub_task_id: "42a01f4e-c646-4551-bd94-e122c9c16226"
+```
+
+**Documentation and examples.** Finalize developer docs for standalone setup,
+application onboarding, catalog authoring, projection consumption, tenant
+administration boundaries, and event/audit integration.
+
+```task
+id: NK-WP-0019-T6
+status: todo
+priority: medium
+state_hub_task_id: "7838d62b-94eb-437a-8418-7a900cde9716"
+```
+
+**Release readiness.** Decide versioning, packaging, image/build artifacts,
+SBOM/security scan requirements, migration policy, and compatibility
+guarantees for future consumers.
+
+```task
+id: NK-WP-0019-T7
+status: todo
+priority: low
+state_hub_task_id: "19569b30-c8df-441a-b815-c9217a82abaf"
+```
+
+**UI handoff readiness.** Produce the API, projection, catalog metadata, and
+test fixtures needed for future user-account and user-manager repos to start
+without inventing separate backends.
+
+## Acceptance Criteria
+
+- A final assessment document records what was implemented, what changed, and
+  what remains open.
+- Public API/schema/catalog/projection contracts are coherent and documented.
+- Operability and release-readiness checks pass.
+- NetKingdom State Hub and responsibility-map records are reconciled.
+- Future UI work has a clear backend contract.
+
+## Dependencies And Sequencing
+
+- Depends on NK-WP-0018 integrated scenario tests.
+- Closes the initial user-engine implementation program and feeds future UI
+  workplans.