Consolidate platform workplans and assess intent gaps

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md

@@ -1,75 +0,0 @@
----
-id: RPF-WP-0026
-type: workplan
-title: "Adopt canonical flex-auth credential-grant checks"
-domain: financials
-repo: railiance-platform
-status: finished
-owner: codex
-topic_slug: railiance
-created: "2026-08-23"
-updated: "2026-08-23"
-related:
-  - FLEX-WP-0012
-origin: routed
-origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
-state_hub_workstream_id: "7677326a-04db-52ef-b05c-967dabe1759e"
----
-
-# RPF-WP-0026 — canonical flex-auth credential-grant checks
-
-## Goal
-
-Adopt flex-auth's single canonical `POST /v1/check` decision surface for
-credential-grant preflight without exposing credential values or adding a
-consumer-specific flex-auth endpoint.
-
-## T01 — Resolve translation ownership
-
-```task
-id: RPF-WP-0026-T01
-status: done
-priority: high
-state_hub_task_id: "07f3fead-76d6-5e53-9a7b-9930560182d9"
-```
-
-The operator explicitly approved Option A in State Hub decision
-`1f9f257d-c9f2-4a5e-a018-8058a3f2a51a`: railiance-platform maps its grant
-metadata to `CheckRequest` and reads `DecisionEnvelope`. Duration parsing and
-normalization belong here, before the flex-auth policy boundary.
-
-## T02 — Implement the canonical request and response
-
-```task
-id: RPF-WP-0026-T02
-status: done
-priority: high
-state_hub_task_id: "659ac0ee-c2b7-56fc-80d8-92b2fcf30e7b"
-```
-
-Change the helper default to `/v1/check`, emit the coordinated
-`tenant:platform` / `credential-grant:<id>` / `issue` request vocabulary, send
-`requested_ttl_seconds` as an integer, and accept only `effect: allow`.
-
-Completed in source. Actor classes map to canonical subject types (`Human`,
-`Agent`, or `Automation`); the bound subject and non-secret actor metadata are
-carried in context. Missing, deny, redact, audit-only, and not-applicable
-effects all fail closed. An allow also requires a non-empty decision id,
-evaluator provenance, and subject/resource binding back to the request.
-
-## T03 — Verify and route the contract
-
-```task
-id: RPF-WP-0026-T03
-status: done
-priority: medium
-state_hub_task_id: "8f6b7481-e8c2-56eb-98b5-c49cae562d60"
-```
-
-Exercise focused allow and deny tests, validate the complete repository suite,
-and route the adopted mapping to flex-auth without requesting live credentials
-or a production mutation.
-
-Completed with 70 focused credential tests, all credential-helper dry-runs,
-credential-catalog validation, and the complete 146-test offline suite passing.
-No flex-auth production endpoint was called and no credential was issued.