docs(workplan): close credential grant integration

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

WORK-RECORDS.md

@@ -19,7 +19,7 @@
 | workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | workplan | FLEX-WP-0011 | finished | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
-| workplan | FLEX-WP-0012 | active | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
+| workplan | FLEX-WP-0012 | finished | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
 | workplan | FLEX-WP-0013 | finished | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
 | workplan | FLEX-WP-0014 | finished | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
 | workplan | FLEX-WP-0015 | finished | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
@@ -81,10 +81,10 @@
 | task | FLEX-WP-0011-T01 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
 | task | FLEX-WP-0011-T02 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
 | task | FLEX-WP-0011-T03 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
-| task | FLEX-WP-0012-T01 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
+| task | FLEX-WP-0012-T01 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
 | task | FLEX-WP-0012-T02 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
-| task | FLEX-WP-0012-T03 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
+| task | FLEX-WP-0012-T03 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
-| task | FLEX-WP-0012-T04 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
+| task | FLEX-WP-0012-T04 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
 | task | FLEX-WP-0013-T01 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
 | task | FLEX-WP-0013-T02 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
 | task | FLEX-WP-0013-T03 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |

workplans/FLEX-WP-0012-credential-grant-authorization-surface.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Authorize railiance-platform credential-grant requests"
 domain: infotech
 repo: flex-auth
-status: active
+status: finished
 owner: codex
 topic_slug: netkingdom
 planning_priority: P3
@@ -84,7 +84,7 @@ What is *actually* missing is narrower and worth stating precisely:
 
 ```task
 id: FLEX-WP-0012-T01
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "a1c9ba0c-3413-4823-9f9e-ccee09cf5d74"
 ```
@@ -131,6 +131,11 @@ options and was automatically escalated for human resolution; coordination
 message `338e54d9-7313-433f-a8fe-8ad572d00365` asks the consumer to choose and
 place duration normalization explicitly.
 
+Resolved 2026-08-23: the operator approved Option A. railiance-platform owns
+translation to canonical `POST /v1/check`, reads `DecisionEnvelope`, and parses
+`requested_ttl` to integer seconds before the policy boundary. This preserves
+one generic flex-auth decision surface.
+
 ## T02 - Credential-grant policy package and fixtures
 
 ```task
@@ -181,7 +186,7 @@ returned `credential_grant_allowed` for the registered runtime grant and
 
 ```task
 id: FLEX-WP-0012-T03
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "3335b2b7-cf1a-411d-95b3-03c4b4c35659"
 ```
@@ -208,9 +213,20 @@ request metadata only. Nothing in this workplan should read, log, or persist a
 credential value; if a task appears to require one, that is a signal the
 design has drifted, not a reason to handle secrets here.
 
-Waiting on T01's wire-translation decision. The policy-side normalized request
+Completed 2026-08-23. railiance-platform implemented Option A in commit
-contract is implemented; either integration option must produce its numeric
+`c9d0214`: its real credential helper now emits canonical `CheckRequest`,
-TTL field without changing policy semantics.
+normalizes TTLs to integer seconds, consumes `DecisionEnvelope`, validates the
+returned subject/resource/provenance binding, and fails closed on every
+non-allow effect.
+
+The integration was exercised over real HTTP against `flex-auth serve` with
+this repository's railiance registry and policy. A bound request allowed; the
+same helper rejected `ttl_out_of_bounds`, `actor_type_not_allowed`,
+`purpose_not_allowed`, and `delivery_mode_not_allowed`. With flex-auth
+unreachable, strict mode blocked and optional mode deliberately continued as
+`local-preauthorized`. No credential issuance function or secret material was
+used. The 70-test railiance credential suite, `go test ./...`, and `go vet
+./...` all pass.
 
 Done when allow and all four denials are demonstrated against the real helper
 over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
@@ -219,7 +235,7 @@ over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
 
 ```task
 id: FLEX-WP-0012-T04
-status: wait
+status: done
 priority: low
 state_hub_task_id: "40015a87-040c-4d48-b360-fd5566dbc552"
 ```
@@ -239,6 +255,12 @@ actually meant before promising an endpoint.
 Update `docs/` with a credential-grant action vocabulary, matching the
 existing per-consumer vocabulary docs.
 
-The source-side action vocabulary is now present at
+Completed 2026-08-23. The source-side action vocabulary is present at
-`docs/railiance-platform-action-vocabulary.md`; final consumer/deployment
+`docs/railiance-platform-action-vocabulary.md`, and the consumer handoff is
-handoff waits on T01 and T03.
+implemented and verified in railiance-platform. The flex-auth changes are
+pushed and covered by the repository image workflow, but no live
+credential-grant endpoint was deployed or probed in this workplan: capability
+status is explicitly **in source, not deployed**. The intended runtime remains
+the helper-configured local endpoint (currently documented as
+`127.0.0.1:18090`); selecting and operating that runtime is deployment work,
+not part of this policy/interface closure.