Add implementation workplans and integration boundaries

workplans/USER-WP-0004-multi-application-catalogs.md

@@ -0,0 +1,106 @@
+---
+id: USER-WP-0004
+type: workplan
+title: "User Engine Multi-Application And Catalog Support"
+domain: netkingdom
+repo: user-engine
+status: ready
+owner: codex
+topic_slug: netkingdom
+planning_priority: high
+planning_order: 4
+created: "2026-05-22"
+updated: "2026-05-22"
+depends_on:
+  - USER-WP-0002
+state_hub_workstream_id: "85676f7f-c82c-411a-9e1f-92098e8662ba"
+---
+
+# USER-WP-0004 - User Engine Multi-Application And Catalog Support
+
+## Goal
+
+Support multiple registered applications, catalog namespace ownership,
+versioned customization catalogs, application-specific profile layers, and
+runtime projections without attribute collisions or data leakage.
+
+## Tasks
+
+```task
+id: USER-WP-0004-T1
+status: todo
+priority: high
+state_hub_task_id: "a9952b07-35e0-4b6a-921e-321c55fee011"
+```
+
+Implement user-engine application records with bindings to external client,
+protected-system, catalog namespace, event identity, and deployment metadata.
+
+```task
+id: USER-WP-0004-T2
+status: todo
+priority: high
+state_hub_task_id: "d4ada2e3-9859-489c-b2a9-529b0d9e03fb"
+```
+
+Implement catalog namespace ownership, semantic versions, lifecycle states,
+compatibility checks, and sensitivity downgrade prevention.
+
+```task
+id: USER-WP-0004-T3
+status: todo
+priority: high
+state_hub_task_id: "add3cbdb-f7ec-4362-a257-93ab874a2093"
+```
+
+Add application-specific profile values, preferences, defaults, and precedence
+rules.
+
+```task
+id: USER-WP-0004-T4
+status: todo
+priority: high
+state_hub_task_id: "d5ef60ee-c007-4efd-86e4-3244e92c555a"
+```
+
+Implement application runtime projections with attribute-level visibility,
+mutability, sensitivity, and redaction rules.
+
+```task
+id: USER-WP-0004-T5
+status: todo
+priority: medium
+state_hub_task_id: "c824c44d-24f5-4f28-91fd-4d739b5fa254"
+```
+
+Specify and optionally prototype a cache-backed claims-enrichment projection
+adapter that does not make user-engine a token issuer.
+
+```task
+id: USER-WP-0004-T6
+status: todo
+priority: high
+state_hub_task_id: "8a506280-d8d6-4fbd-9d05-831a76e3e8be"
+```
+
+Add tests for namespace collisions, catalog activation failures,
+application-specific profile values, projection redaction, application access
+denial, and catalog migration checks.
+
+```task
+id: USER-WP-0004-T7
+status: todo
+priority: medium
+state_hub_task_id: "c8fd8760-ccc4-4df4-85c7-c1c4950b82d9"
+```
+
+Add developer-facing examples for registering an application, publishing a
+catalog, requesting projections, and handling profile-change events.
+
+## Acceptance Criteria
+
+- Multiple applications can register without attribute collisions.
+- Catalog ownership and lifecycle are enforced.
+- Application-specific values resolve consistently with global and tenant
+  layers.
+- Claims enrichment remains optional and adapter-owned.