Implement registration identity model

src/user_engine/ports.py

@@ -21,10 +21,13 @@ from user_engine.domain import (
     CanonEntityReference,
     Catalog,
     ExternalIdentity,
+    FactorVerification,
     FamilyInvitation,
+    IdentityFactor,
     Membership,
     OutboxEvent,
     ProfileValue,
+    RegistrationSession,
     TenantAccount,
     User,
 )
@@ -120,6 +123,31 @@ class UserEngineStore(Protocol):
     ) -> tuple[FamilyInvitation, ...]:
         """Return family invitations for a user."""
 
+    def save_registration_session(self, session: RegistrationSession) -> None:
+        """Create or replace a registration session."""
+
+    def registration_session(
+        self, registration_id: str
+    ) -> RegistrationSession | None:
+        """Return a registration session by id."""
+
+    def all_registration_sessions(self) -> tuple[RegistrationSession, ...]:
+        """Return all registration sessions."""
+
+    def save_identity_factor(self, factor: IdentityFactor) -> None:
+        """Create or replace a verified identity factor."""
+
+    def identity_factor(self, factor_id: str) -> IdentityFactor | None:
+        """Return a verified identity factor by id."""
+
+    def factors_for_registration(
+        self, registration_id: str
+    ) -> tuple[IdentityFactor, ...]:
+        """Return verified factors attached to a registration session."""
+
+    def factors_for_user(self, user_id: str) -> tuple[IdentityFactor, ...]:
+        """Return verified factors attached to a user."""
+
     def save_profile_value(self, value: ProfileValue) -> None:
         """Create or replace a profile value."""
 
@@ -152,6 +180,13 @@ class IdentityClaimsAdapter(Protocol):
         """Return the stable external identity link key."""
 
 
+class FactorVerificationAdapter(Protocol):
+    """Normalize external proofing results into safe factor evidence."""
+
+    def normalize(self, proofing_result: Mapping[str, Any]) -> FactorVerification:
+        """Return normalized verified factor evidence without secret payloads."""
+
+
 class AuthorizationCheckPort(Protocol):
     """Ask whether an actor may perform an action."""