Implement durable store contract and registration roadmap

workplans/USER-WP-0014-registration-and-access-management-ui.md

@@ -0,0 +1,125 @@
+---
+id: USER-WP-0014
+type: workplan
+title: "Registration And Access Management UI"
+domain: netkingdom
+repo: user-engine
+status: proposed
+owner: codex
+topic_slug: netkingdom
+planning_priority: medium
+planning_order: 14
+created: "2026-06-15"
+updated: "2026-06-15"
+depends_on:
+  - USER-WP-0010
+  - USER-WP-0011
+  - USER-WP-0012
+  - USER-WP-0013
+state_hub_workstream_id: "011f7d20-5c9d-42a9-b7a3-b20a8ae9f557"
+---
+
+# USER-WP-0014 - Registration And Access Management UI
+
+## Goal
+
+Build an optional NetKingdom registration and access management UI backed by
+user-engine APIs. The UI should make registration, factor status, prepared
+rights, hat selection, profile completion, and onboarding journeys convenient
+without hiding IAM, authorization, proofing, or service-runtime boundaries.
+
+## Scope Direction
+
+The UI is an operating surface over user-engine domain APIs. It should be thin,
+workflow-oriented, and suitable for self-service users, tenant admins, family
+owners, and operators.
+
+## Non-Goals
+
+- Do not implement credential entry, password reset, passkeys, MFA challenges,
+  or token issuance in the UI.
+- Do not embed final authorization policy rules in frontend code.
+- Do not replace service-specific admin consoles.
+- Do not make UI state authoritative over domain records.
+
+## Tasks
+
+```task
+id: USER-WP-0014-T1
+status: todo
+priority: high
+state_hub_task_id: "983087e1-c512-419f-86a6-b954d0a1ab54"
+```
+
+Define UI information architecture for registration, factor status,
+prepared-account claim, hat selection, profile completion, onboarding journey,
+and admin setup views.
+
+```task
+id: USER-WP-0014-T2
+status: todo
+priority: high
+state_hub_task_id: "0af5d8ef-0d1e-44bd-b807-bc40e87afef2"
+```
+
+Define UI API contracts or route handlers over the headless service facades.
+Keep proofing, IAM, authorization, and notification calls behind adapters.
+
+```task
+id: USER-WP-0014-T3
+status: todo
+priority: high
+state_hub_task_id: "a2e00aa3-5849-469c-a3a3-f4f5bd2df6c8"
+```
+
+Implement the self-service registration flow with resume, prepared rights
+review, factor status, terms/consent, and completion states.
+
+```task
+id: USER-WP-0014-T4
+status: todo
+priority: medium
+state_hub_task_id: "36d49049-cfe7-4f87-9a7f-78e37de9188a"
+```
+
+Implement hat selection and active access context views for realms, services,
+groups, and assets.
+
+```task
+id: USER-WP-0014-T5
+status: todo
+priority: medium
+state_hub_task_id: "e58038fc-6138-40cc-bb6b-4cbf7a8b0b87"
+```
+
+Implement admin views for prepared accounts, invitations, access profiles,
+group membership, realms/services/assets, and onboarding diagnostics.
+
+```task
+id: USER-WP-0014-T6
+status: todo
+priority: medium
+state_hub_task_id: "4de949d6-e330-41b2-87cf-9b9425f0f8be"
+```
+
+Add usability, accessibility, error-state, redaction, and mobile/desktop tests
+for the registration and admin flows.
+
+## Acceptance Criteria
+
+- A new user can complete a registration flow through the UI using adapter
+  supplied factor evidence.
+- A prepared account claim can be reviewed and accepted or denied through the
+  UI.
+- Users can choose an active hat and see available realms/services without
+  exposing internal policy logic.
+- Admins can prepare accounts and inspect onboarding state.
+- The UI does not store or display secrets, raw proofing payloads, or hidden
+  authorization decisions.
+
+## Expected Outputs
+
+- Registration UI and API contract.
+- Hat/access management UI views.
+- Admin prepared-account and onboarding views.
+- Frontend verification artifacts.