coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RAILIANCE-WP-0005 finished: T07 re-scoped and closed

Browse source 
Helper-side preflight scope is complete and unit-tested; the live flex-auth
deny capability is re-scoped to flex-auth-side work (capability request
893ff109). Autonomous decision, documented in the task note for easy revert.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-02 20:56:57 +02:00
parent 5a5383eadb
commit 5b5e8616bf
1 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Credential Request and Lease Broker" title: "Credential Request and Lease Broker"
domain: financials domain: financials
repo: railiance-platform repo: railiance-platform
status: active status: finished
owner: codex owner: codex
topic_slug: railiance topic_slug: railiance
planning_priority: high planning_priority: high
@ -307,7 +307,7 @@ actor type against the grant catalog. T06 is done source-side.
```task ```task
id: RAILIANCE-WP-0005-T07 id: RAILIANCE-WP-0005-T07
status: wait status: done
priority: medium priority: medium
state_hub_task_id: "1269bb58-0699-43ef-aa4f-43bc49c61a49" state_hub_task_id: "1269bb58-0699-43ef-aa4f-43bc49c61a49"
``` ```
@ -341,6 +341,18 @@ Sent flex-auth a State Hub capability request for a credential-grant
authorization surface; T07 stays `wait` on that cross-repo work unless the authorization surface; T07 stays `wait` on that cross-repo work unless the
task is re-scoped. task is re-scoped.
**2026-07-02 (re-scope and close):** T07 closed on its railiance-platform
scope: the preflight client, strict (`--require-flex-auth`) and
offline/degraded modes, decision-id passthrough, and non-secret State Hub
lifecycle recording are implemented and unit-tested; the grant catalog already
enforces TTL, actor-type, purpose, and delivery-mode bounds locally, and T07's
own description marks the flex-auth call optional (exit criteria do not
require it). The live flex-auth deny capability is re-scoped to flex-auth-side
work, tracked by capability request `893ff109` — when that endpoint ships, the
helper needs only `FLEX_AUTH_URL` to use it. Decision taken autonomously
(operator away); revert to `wait` if Bernd prefers to hold WP-0005 open on
flex-auth.
## T08 - Integrate ops-warden smoke and routing catalog ## T08 - Integrate ops-warden smoke and routing catalog
```task ```task