Add NK-WP-0045: machine-readable custody record for the root grant

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 6969@bnt-lap001
Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0

workplans/NK-WP-0045-root-grant-custody-record.md

@@ -0,0 +1,107 @@
+---
+id: NK-WP-0045
+type: workplan
+title: "Make the platform-root custody record readable as a non-secret root-grant fact"
+domain: infotech
+repo: net-kingdom
+status: proposed
+flavor: implementation
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-09-29"
+updated: "2026-09-29"
+related: [NK-ADR-0017, NK-WP-0042]
+---
+
+NK-ADR-0017 makes the platform-root custody record the authority for the root
+grant, but the record has no machine-readable, non-secret form a workload can
+read. Until it does, user-engine returns "no root grant" and USER-WP-0037-T02
+stays blocked. This workplan defines that form and its read surface. It does
+not change custody itself, and no secret material enters the record.
+
+## Accept ADR-0017
+
+```task
+id: NK-WP-0045-T01
+status: wait
+needs_human: true
+blocking_reason: "Bernd accepts or amends NK-ADR-0017 (proposed) after user-engine confirms the AccountAuthority mapping."
+priority: high
+```
+
+Resolve the open points (15-minute cache bound, envelope mapping) and move the
+ADR to `accepted`.
+
+## Define the custody-record schema
+
+```task
+id: NK-WP-0045-T02
+status: todo
+depends_on: [NK-WP-0045-T01]
+priority: high
+```
+
+Add `canon/schemas/custody-record_v0.1.schema.json`: record id and revision,
+`(issuer, subject)`, relation `platform-root-custodian`, `tenant:platform`,
+granted-at, superseded-by, revoked-at with actor and reason. Non-secret only;
+the schema rejects token, key, share and recovery-code fields.
+
+## Add a validator and fixtures
+
+```task
+id: NK-WP-0045-T03
+status: todo
+depends_on: [NK-WP-0045-T02]
+priority: medium
+```
+
+Validator with grant, revocation and supersession fixtures, plus negative cases:
+projection-only grants, tenant-admin implication, secret-bearing fields.
+Follow the existing tool layout under `tools/`.
+
+## Decide the read surface
+
+```task
+id: NK-WP-0045-T04
+status: wait
+depends_on: [NK-WP-0045-T02]
+needs_human: true
+blocking_reason: "Needs a decision on where a workload reads the record (OpenBao-held, platform service, or repository artifact) and which owner delivers it."
+priority: high
+```
+
+Options and the owner (net-kingdom versus railiance-platform) go to Bernd; the
+answer fixes T05.
+
+## Deliver the read path with the owner
+
+```task
+id: NK-WP-0045-T05
+status: wait
+depends_on: [NK-WP-0045-T04]
+blocking_reason: "Depends on the read-surface decision and on the delivering owner."
+priority: medium
+```
+
+Hand off the schema and read contract to the owner; NetKingdom does not absorb
+the runtime. Include the fail-closed and staleness rules from ADR-0017.
+
+## Close the loop with user-engine
+
+```task
+id: NK-WP-0045-T06
+status: wait
+depends_on: [NK-WP-0045-T05]
+blocking_reason: "Needs the delivered read path."
+priority: medium
+```
+
+Tell user-engine the read path is live so USER-WP-0037-T02 can derive
+`AccountAuthority.root-grant` from it, and record the evidence.
+
+## Acceptance Criteria
+
+- The custody-record schema and validator exist and reject secret-bearing and
+  projection-only inputs.
+- A workload can read the root-grant fact from an owner-delivered surface.
+- user-engine derives the root grant without inferring it from claims.