Adopt canonical flex-auth credential checks

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

workplans/ADHOC-2026-08-23.md

@@ -28,3 +28,20 @@ the new entries satisfy the current-posture evidence contract directly.
 
 Verification runs the canonical NetKingdom tenancy-posture validator against
 this repository's declaration and checks the repository diff.
+
+## Stabilize expired-engagement broker readiness tests
+
+```task
+id: ADHOC-2026-08-23-T02
+status: done
+priority: medium
+```
+
+Full test discovery exposed two WP0025 broker-readiness tests that built a
+receipt with wall-clock time for a terminal prior-day engagement. Add an
+optional explicit clock to the receipt builders and pin the unit fixtures to
+the contract window so the production default stays current UTC while offline
+tests remain deterministic.
+
+The complete 146-test offline suite now passes on dates after the terminal
+engagement window.

workplans/RAILIANCE-WP-0028-flex-auth-credential-grant-integration.md

@@ -0,0 +1,71 @@
+---
+id: RAILIANCE-WP-0028
+type: workplan
+title: "Adopt canonical flex-auth credential-grant checks"
+domain: financials
+repo: railiance-platform
+status: finished
+owner: codex
+topic_slug: railiance
+created: "2026-08-23"
+updated: "2026-08-23"
+related:
+  - FLEX-WP-0012
+origin: routed
+origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
+---
+
+# RAILIANCE-WP-0028 — canonical flex-auth credential-grant checks
+
+## Goal
+
+Adopt flex-auth's single canonical `POST /v1/check` decision surface for
+credential-grant preflight without exposing credential values or adding a
+consumer-specific flex-auth endpoint.
+
+## T01 — Resolve translation ownership
+
+```task
+id: RAILIANCE-WP-0028-T01
+status: done
+priority: high
+```
+
+The operator explicitly approved Option A in State Hub decision
+`1f9f257d-c9f2-4a5e-a018-8058a3f2a51a`: railiance-platform maps its grant
+metadata to `CheckRequest` and reads `DecisionEnvelope`. Duration parsing and
+normalization belong here, before the flex-auth policy boundary.
+
+## T02 — Implement the canonical request and response
+
+```task
+id: RAILIANCE-WP-0028-T02
+status: done
+priority: high
+```
+
+Change the helper default to `/v1/check`, emit the coordinated
+`tenant:platform` / `credential-grant:<id>` / `issue` request vocabulary, send
+`requested_ttl_seconds` as an integer, and accept only `effect: allow`.
+
+Completed in source. Actor classes map to canonical subject types (`Human`,
+`Agent`, or `Automation`); the bound subject and non-secret actor metadata are
+carried in context. Missing, deny, redact, audit-only, and not-applicable
+effects all fail closed. An allow also requires a non-empty decision id,
+evaluator provenance, and subject/resource binding back to the request.
+
+## T03 — Verify and route the contract
+
+```task
+id: RAILIANCE-WP-0028-T03
+status: done
+priority: medium
+```
+
+Exercise focused allow and deny tests, validate the complete repository suite,
+and route the adopted mapping to flex-auth without requesting live credentials
+or a production mutation.
+
+Completed with 70 focused credential tests, all credential-helper dry-runs,
+credential-catalog validation, and the complete 146-test offline suite passing.
+No flex-auth production endpoint was called and no credential was issued.