Close IAM Profile integration gate

workplans/CUST-WP-0025-fos-hub-bootstrap.md

@@ -91,7 +91,7 @@ Cross-reference: net-kingdom NK-WP-0002.
 
 ```task
 id: CUST-WP-0025-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "e9894ac9-add3-45a6-9893-ea67c6e5e260"
 ```
@@ -104,7 +104,17 @@ Write a minimal test service + integration test that:
 
 This test becomes the template for hub-core auth middleware.
 
-2026-06-27 sequencing update: this remains the real open identity gate, but it should target the current NetKingdom IAM Profile v0.2 contract and either local-identity or KeyCape lightweight issuer, not the archived `NK-WP-0001` Keycloak path.
+2026-06-27 sequencing update: this was kept as the real identity gate, targeted at the current NetKingdom IAM Profile v0.2 contract and either local-identity or KeyCape lightweight issuer, not the archived `NK-WP-0001` Keycloak path.
+
+Completed 2026-06-27: Core Hub now has a reusable FastAPI IAM Profile verifier
+and dependency in `/home/worsch/core-hub/src/core_hub/iam_profile.py`.
+`tests/test_iam_profile.py` proves a fixture IAM Profile issuer can expose OIDC
+discovery/JWKS, issue an authorization-code + PKCE token, call a protected
+FastAPI endpoint, and validate issuer, audience, expiry, roles, groups, scopes,
+tenant, principal type, and assurance claims. Negative tests reject missing
+bearer tokens, wrong audience, and production use of local-development issuers.
+This closes the identity integration template without requiring NetKingdom repo
+changes or production secrets.
 
 ### T04 — Canon standard: IAM Profile specification
 

workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md

@@ -454,8 +454,8 @@ mega-hub pattern.
 
 Recommended order:
 
-1. Keep `CUST-WP-0025-T03` as the remaining identity integration gate, targeting
-   the current IAM Profile v0.2 contract and local-identity or KeyCape issuer.
+1. Keep the completed `CUST-WP-0025-T03` IAM Profile verifier/test as the
+   template for Core Hub auth consumers and future production issuer wiring.
 2. Execute the rewritten Core Hub Phase 3 lane: ops evidence contract/read-model
    gaps, deployed Core Hub smoke, activity-core Core Hub sink smoke,
    migration/cutover readiness, and whynot-aligned first UI screens.
@@ -501,8 +501,8 @@ Progress 2026-06-27 Core Hub ops evidence contract:
 - The spec defines API resources, non-secret evidence fields, event vocabulary,
   service-inventory-to-widget/event mapping, readiness-summary inputs, and
   read-model gaps to close before UI expansion or cutover claims.
-- T07 sequencing now keeps `T03`, `T16`, `T17`, and `T18` open; T14 no longer
-  blocks the Core Hub replacement lane.
+- T07 sequencing now keeps `T16`, `T17`, and `T18` open; T14 no longer blocks
+  the Core Hub replacement lane.
 
 Progress 2026-06-27 CUST-WP-0052 closeout:
 
@@ -511,9 +511,19 @@ Progress 2026-06-27 CUST-WP-0052 closeout:
   HelixForge/Railiance Forge practice, and posted non-secret State Hub
   requirements to `railiance-apps` and `railiance-forge`.
 - The remaining T07 gates are execution gates, not sequencing ambiguity:
-  `CUST-WP-0025-T03` identity integration, `T16/T17` deployed
-  evidence/cutover waits, and `T18` Core Hub operator UI first screens. `T14`
-  is complete as the ops evidence contract definition gate.
+  `T16/T17` deployed evidence/cutover waits and `T18` Core Hub operator UI
+  first screens. `T14` is complete as the ops evidence contract definition
+  gate.
+
+Progress 2026-06-27 IAM Profile integration:
+
+- Completed `CUST-WP-0025-T03` by adding Core Hub's reusable IAM Profile
+  verifier/dependency and a FastAPI fixture integration test covering OIDC
+  discovery, JWKS, authorization-code + PKCE token issuance, protected endpoint
+  access, required IAM Profile claims, missing-token rejection, wrong-audience
+  rejection, and production rejection of local-development issuers.
+- Remaining T07 gates are now `CUST-WP-0025-T16`, `T17`, and `T18`; identity no
+  longer blocks the Core Hub replacement lane.
 
 ## Task: Create The Stable Pickup Checkpoint