generated from coulomb/repo-seed
152 lines
4.6 KiB
Markdown
152 lines
4.6 KiB
Markdown
---
|
|
id: NK-WP-0015
|
|
type: workplan
|
|
title: "User Engine Isolated MVP"
|
|
domain: netkingdom
|
|
repo: net-kingdom
|
|
status: ready
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
planning_priority: high
|
|
planning_order: 15
|
|
created: "2026-05-22"
|
|
updated: "2026-05-22"
|
|
depends_on:
|
|
- NK-WP-0014
|
|
state_hub_workstream_id: "343e035d-41e1-4fc4-b209-6872e4a5fdc8"
|
|
---
|
|
|
|
# NK-WP-0015 - User Engine Isolated MVP
|
|
|
|
## Goal
|
|
|
|
Implement the smallest useful isolated user-engine in `/home/worsch/user-engine`
|
|
with automated tests for all MVP use cases: users, accounts, external identity
|
|
links, application registration, customization catalogs, profile values,
|
|
effective profile resolution, projections, audit records, and domain events.
|
|
|
|
The MVP must run without the full NetKingdom platform while preserving the
|
|
same boundaries used by platform mode.
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
|
|
- repo skeleton and local development workflow;
|
|
- domain core independent of HTTP;
|
|
- local persistence and migrations;
|
|
- headless API for MVP resources;
|
|
- local IAM Profile fixture or local-identity integration;
|
|
- pluggable flex-auth check interface with a local test adapter;
|
|
- audit and transactional outbox;
|
|
- automated unit and integration tests.
|
|
|
|
Out of scope:
|
|
|
|
- multi-tenant production operation beyond one explicit tenant context;
|
|
- multi-application governance beyond one or two demo applications;
|
|
- SCIM server or enterprise provisioning;
|
|
- UI implementation;
|
|
- production deployment through Railiance.
|
|
|
|
## Tasks
|
|
|
|
```task
|
|
id: NK-WP-0015-T1
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "81a88eaa-df2e-4b9f-85f4-a1570c9c9f86"
|
|
```
|
|
|
|
**Repo scaffold and implementation stack.** Choose the initial implementation
|
|
stack, create the repository layout, define commands for lint/test/run, and
|
|
keep the domain core separate from HTTP handlers and infrastructure adapters.
|
|
|
|
```task
|
|
id: NK-WP-0015-T2
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "fc4172f7-e7f1-4ad9-98c3-37ccb08c7386"
|
|
```
|
|
|
|
**Domain model and persistence.** Implement users, accounts, identity links,
|
|
applications, catalogs, attribute definitions, profile values, audit records,
|
|
and outbox events with migrations and test fixtures.
|
|
|
|
```task
|
|
id: NK-WP-0015-T3
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "8aa5a9e9-3f23-4124-aa3b-01c099ce88bc"
|
|
```
|
|
|
|
**Identity and authorization adapters.** Implement an IAM Profile actor
|
|
adapter using fixtures or local-identity for isolated mode. Implement a
|
|
flex-auth check port with a local deterministic test adapter. Ensure
|
|
production code paths can later swap to real flex-auth without changing
|
|
domain logic.
|
|
|
|
```task
|
|
id: NK-WP-0015-T4
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "cedd6319-e4c2-460c-888c-d0d95d7bdbef"
|
|
```
|
|
|
|
**Headless MVP API.** Add API endpoints for health/readiness, `me`, users,
|
|
account lifecycle transitions, identity links, application registration,
|
|
catalog registration/activation, profile updates, effective profile
|
|
resolution, projections, and audit inspection.
|
|
|
|
```task
|
|
id: NK-WP-0015-T5
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "62ecafaa-237a-4cae-ac78-1ed79ca881a1"
|
|
```
|
|
|
|
**Catalog and profile resolver.** Implement JSON/YAML catalog registration,
|
|
attribute validation, default values, global plus application profile layers,
|
|
basic precedence rules, and inspectable effective profile resolution.
|
|
|
|
```task
|
|
id: NK-WP-0015-T6
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "d627db12-2019-4870-a255-354fc77a1d22"
|
|
```
|
|
|
|
**Projection, audit, and event outbox.** Implement self-service, admin,
|
|
application runtime, audit, and agent-context projection skeletons with
|
|
sensitivity-aware redaction. Persist audit records and outbox events in the
|
|
same transaction as mutations.
|
|
|
|
```task
|
|
id: NK-WP-0015-T7
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "803e979d-a83a-43d8-a93d-ce97c83015ec"
|
|
```
|
|
|
|
**MVP test suite.** Cover user/account lifecycle, identity linking, catalog
|
|
validation failures, profile update authorization, effective profile
|
|
resolution, projection redaction, audit/outbox atomicity, local issuer
|
|
handling, and deny paths from the authorization adapter.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- The user-engine repo can be checked out and tested in isolation.
|
|
- A demo application can register, register a catalog, update profile values,
|
|
and request an effective profile projection.
|
|
- A current user can read/update allowed self-service profile fields.
|
|
- An admin-like actor can perform allowed scoped user operations through the
|
|
test authorization adapter.
|
|
- Sensitive attributes are redacted from non-eligible projections.
|
|
- Mutations produce audit and outbox records atomically.
|
|
- Tests cover positive and negative MVP use cases.
|
|
|
|
## Dependencies And Sequencing
|
|
|
|
- Gated by NK-WP-0014 boundary contracts.
|
|
- Enables NK-WP-0016 and NK-WP-0017.
|