feat: implement access profiles and hats

workplans/USER-WP-0012-hats-realms-services-assets-access-profiles.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Hats, Realms, Services, Assets, And Access Profiles"
 domain: netkingdom
 repo: user-engine
-status: proposed
+status: finished
 owner: codex
 topic_slug: netkingdom
 planning_priority: high
@@ -42,7 +42,7 @@ and protected services own runtime enforcement.
 
 ```task
 id: USER-WP-0012-T1
-status: todo
+status: done
 priority: high
 state_hub_task_id: "b86f0072-e666-479b-9b90-96d4015bbfa0"
 ```
@@ -53,7 +53,7 @@ canon reference patterns.
 
 ```task
 id: USER-WP-0012-T2
-status: todo
+status: done
 priority: high
 state_hub_task_id: "66117083-8e85-44e1-9a76-cfd10dd24d23"
 ```
@@ -63,7 +63,7 @@ active hat for a tenant, realm, service, or asset context when allowed.
 
 ```task
 id: USER-WP-0012-T3
-status: todo
+status: done
 priority: high
 state_hub_task_id: "1dffda4c-f979-480e-9d6d-12ec9576780d"
 ```
@@ -73,7 +73,7 @@ requirements, profile defaults, and claims projection rules.
 
 ```task
 id: USER-WP-0012-T4
-status: todo
+status: done
 priority: high
 state_hub_task_id: "b07494fe-f301-49e2-8ea8-267a4c5219ee"
 ```
@@ -83,7 +83,7 @@ realm, service, asset, group, access profile, and evidence references.
 
 ```task
 id: USER-WP-0012-T5
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "c78e10c4-b245-4a83-a75d-4b46a6073fd2"
 ```
@@ -93,7 +93,7 @@ systems while preserving source-of-truth boundaries.
 
 ```task
 id: USER-WP-0012-T6
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "f9f32165-3a12-424e-a370-bb2ab8348c21"
 ```
@@ -116,3 +116,38 @@ group-derived access, service-specific projection, and redacted diagnostics.
 - Active context service facade.
 - Identity-context and claims projection updates.
 - Access-control fact export tests.
+
+## Implementation Notes
+
+Implemented on 2026-06-15:
+
+- Added `AccessScopeType`, `AccessMembershipRequirement`, `AccessProfile`,
+  `ActiveAccessContext`, and `AccessControlFact` domain models.
+- Added access-profile and active-context persistence to `UserEngineStore` and
+  `InMemoryUserEngineStore`, including transaction snapshots and record
+  counts.
+- Added `UserEngineService` facade methods:
+  `register_access_profile`, `list_access_profiles`, `select_active_hat`,
+  `export_access_control_facts`, and `access_profile_diagnostics`.
+- Added fail-closed active hat selection requiring tenant context, active
+  tenant account state, matching membership facts, unexpired factor evidence,
+  non-approval-required profile state, and authorization-port approval.
+- Extended `identity_context` with active access context, access-control facts,
+  canon references for hats/realms/services/assets/groups, and active-hat
+  relationship references.
+- Extended claims-enrichment projections with service-filtered access context
+  while keeping raw factor values out of events and diagnostics.
+- Added adapter-neutral access-control fact export for direct memberships,
+  group-derived facts, and active-context facts.
+- Added `docs/hats-realms-services-assets-access-profiles.md`, public contract
+  updates, and tests for active hat selection, cross-tenant denial, missing
+  factor assurance, group-derived access, service-specific projections, and
+  redacted diagnostics.
+
+Verification:
+
+```text
+make test
+Ran 61 tests in 0.515s
+OK
+```