---
id: RPF-WP-0051
type: workplan
title: "Prepare and admit informed-decision requester workload delivery"
domain: financials
repo: railiance-platform
status: finished
owner: codex
topic_slug: platform-services
created: "2026-10-04"
updated: "2026-10-05"
flavor: implementation
origin: routed
origin_ref: "RPF-WP-0050-T03; INFD-WP-0005-T05; cd811073-d6db-41cf-8a57-10df0b360eab"
state_hub_workstream_id: "a27c47bc-4b0d-513b-bfb2-1eb404fde5a9"
---

The founder selected existing batched attended custody and delegated relevance
selection for the 2026-10-04 10:00 Europe/Berlin preparation window, then directed
platform to continue. This work owns the new workload reader for existing
requester custody. Existing issuer registration and applied CCR-2026-0026/0027
are preserved. Private listener, TokenReview transport, runtime OIDC exchange,
submitter admission and live intake rollout remain separately owned.

## Prepare exact workload reader and owner review bundle

```task
id: RPF-WP-0051-T01
status: done
priority: high
state_hub_task_id: "3de19f19-d18a-5714-858e-db8dc05e44ca"
```

Allocate proposed CCR-2026-0032; render exact-path policy and prospective
Kubernetes-auth role, namespace-restricted ESO, dedicated auth ServiceAccount
and read-only review-pod mount proposal. Keep the bundle outside all active
GitOps rendering. Validate the actual source bundle and record its digests;
preparation supplies no credentials, admitted identity or native receipt.

2026-10-04: Prepared and validated actual proposed CCR-2026-0032 and generator
input, canonical exact-path policy, prospective auth payload, namespace-restricted
ESO, dedicated auth ServiceAccount and required read-only mount proposal. Added
silent attended metadata child with reviewed-digest/status/binding/envelope gates,
both-object preflight, conflict refusal, missing-only writes and readback. Ten
focused helper tests, fourteen scaffold regressions and seven window regressions
pass; actual bundle checks verify path/namespace/TTL/projection/annotation limits
and proposed-state refusal. Separate INFD-WP-0005-T05 decision checklist maps the
CCR/lane/receipt contract and remains NOT READY. No live action or issuer change.

## Obtain exact owner runtime and binding acceptance

```task
id: RPF-WP-0051-T02
status: done
priority: high
state_hub_task_id: "dfc17e0a-9f63-5a97-b87e-13bd3a8325d6"
```

Review `docs/credential-lane-designs/informed-decision-requester-workload.md`
against INFD-WP-0005-T05 and its owner dependency contract. Confirm ESO token
creation authority for the exact ServiceAccount. A draft identity is not an
owner acceptance. Retain exact immutable runtime/config references and a bounded
positive/negative/rotation/revocation proof plan before promotion.

2026-10-04: Founder authorized the prepared owner coordination requests. Sent
request `2c1507b2-b361-4ef9-b5d4-3245014c7c52` to informed-decision on preparation
thread `f84637fa-2355-4971-a2dc-7f1fd01710a8`, reviewing source commit
`6b91d510395215d178d60ee8884e7fc00930a0cf`. It carries the design approval and
asks for exact binding/mount/runtime/verification ownership and remaining native
evidence. Hub creation receipt is retained; owner acceptance is still outstanding.

2026-10-04 owner-return review: source binding/mount acceptance and rotating
RequesterTokenProvider/compose_intake implementation are delivered at
`eb9614c2677c7f07c9d78eee7543f95f329d2c83`; exact-primary source receipt is
`f06b7e9c53d3477f1e690ed8259f2eaab3661f91`. Replies 17bcfb39 and d304e328
and `informed-decision/docs/requester-workload-owner-review.md` retain 37 focused
owner tests and remaining process/transport/publication gaps. Platform's explicit
SubjectAccessReview of the actual controller confirms TokenRequest permission
for the namespace without minting a token. T02 waits only on independent owner
source readiness, not its entire live task (which needs platform delivery).
Native custody/delivery acceptance remains T03. Plan moved to blocked after
completing available local preparation; concrete requirements/reopen conditions
are in this window's `dependency-requirements.md`.

## Apply and accept the scoped workload delivery

```task
id: RPF-WP-0051-T03
status: done
priority: high
depends_on: [RPF-WP-0051-T02]
needs_human: false
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77"
```

The founder approves the exact new reader, then runs the reviewed contained
metadata child in their terminal. Apply only the new policy/role; do not seed,
rotate or reapply historical requester custody. Promote ESO/runtime through
their actual owner deployment paths after diff/server dry-run and resource
checks. Accept delivery, exact token-policy/identity/TTL, sibling/list denial,
create-only exchange and cleanup/revocation receipts. Revoke this reader on
abort without touching the issuer or historical verifier/attended-reader lanes.

2026-10-04 founder design decision: Bernd answered "I approve" after review of
the exact new delivery boundary, namespace-level trust and credential persistence
beyond reader-token lifetime. Design approval for owner integration is recorded
in CCR-2026-0032 and the lane contract. Owner binding/runtime acceptance and the
separate concrete live go remain; no repeated design decision is required unless
scope materially changes. The broader INFD-WP-0005-T05 decision remains open for
runtime/listener acceptance and deployment. No credential action occurred.

## Exact live delivery approval — 2026-10-04

Founder answered "I approve" to the concrete CCR-2026-0032 requester delivery
following informed-decision c084600 release review. Source/runtime acceptance
closes T02: private listener, CA-verified TokenReview, requester exchange and
separate audience tokens are composed; immutable service 2768bd1 and worker
410fb6b passed recorded tests/scans. Approved CCR retains only the existing path,
exact ESO identity, audience openbao, 900-second limits and read-only projection.
The metadata child still requires the founder terminal OIDC/MFA. Native claims,
delivery, negative proofs and revocation remain unproven under T03. No broader
cutover or issuer rotation approval is inferred.

## Attended child failure and bounded repair — 2026-10-04

Founder reported Warden exit 11; the local audit confirms child_failed. This
does not prove that metadata stayed unchanged or that revocation succeeded.
The installed bao binary against a synthetic HTTP 404 reproduces a helper bug:
it emits exact path-specific No value found, not Code: 404. Updated handling
accepts only the exact read diagnostic with exit 2 and empty stdout; denials,
wrong paths and other failures refuse. Real installed-CLI tests cover missing
objects, both writes/readbacks and an idempotent repeat without another write.

Each child now retains only fixed phase/exit metadata in
docs/evidence/requester-metadata/*.json and remains silent. Twelve focused tests
pass. The approved CCR and permissions are unchanged. A fresh attended attempt
will compare both objects before any missing-only write and record its phase.
Native delivery remains pending; do not mark the earlier attempt successful.

## Native delivery result and required amendment — 2026-10-04

Founder reported exit 0 and helper receipt confirms metadata_verified. Created
the reviewed dedicated manual ArgoCD application/project and synced three delivery
objects from 4332c39 after diff/server dry-run. Corrected the draft audience field
to serviceAccountRef.audiences using the installed ESO schema. Node IP and CPU
headroom checked (3445m/4000m); no workload rollout or image change occurred.

ArgoCD sync succeeded; ClusterSecretStore and ExternalSecret are not Ready.
Bounded condition inspection confirms 403 on auth/token/lookup-self. Existing
ESO readers include self lookup/read and revoke/update, omitted by this packet.
Prepared only that amendment and an exact-predecessor policy migration in the
silent helper; 14 tests pass. CCR returns to proposed for changed capabilities,
retaining original approval/application history. T03 stays waiting for amendment
approval and fresh attended execution. Evidence: 2026-10-04-requester-delivery.json.

Founder explicitly approved lookup-self/read and revoke-self/update. Amended
CCR approved and exact helper source/digest validated offline. Only fresh attended
execution and native delivery proofs remain for this amendment; no renewed
permission request is needed within this scope.

## Native scoped delivery proven — 2026-10-04

Attended amendment exit 0 and metadata_verified receipt retained. After refresh,
ArgoCD Synced, ClusterSecretStore Valid and ExternalSecret SecretSynced. Safe
annotation helper confirms no duplicate credential annotation. Temporary native
workloads proved exact identity/policy and TTL/max bounds; wrong namespace,
ServiceAccount and audience refused; sibling GET and parent LIST refused.
Projection is 0440 and equals the exact authorized KV field without emitting it.

Native exchange exposed requester client_secret_post incompatibility. Fixed
informed-decision at 03f18d8 to use KeyCape client_secret_basic with form-encoded
credential halves; image 804d89fb passes 664 tests/1 skipped, 13 container checks
and zero HIGH/CRITICAL scan findings. With the service's exact Traefik HTTPS peer,
native signed create-only exchange and approve/read/consume refusals all pass.
The test reader self-revoked and post-revoke lookup fails; all eight temporary
verification objects are removed. CCR is applied; actual review Deployment mount
and cutover acceptance remain T03. Issuer rotation stays separately governed,
not inferred from unchanged-file projection or callback unit tests.

## Receiving service acceptance — 2026-10-05

The approved schema-5 service is live. Its actual receiving pod mounts the
requester field read-only at 0440 and completes the pinned, signed create-only
KeyCape exchange. Native intake created approval 22b30fe7-c565-46f2-8193-d8875975ad9e
and retained its exact binding receipt. Public/private isolation, wrong caller
and crossed-audience checks pass. No credential value was emitted.

Initial workload delivery is complete. Residual RPF-IN-0004 owns the separately
governed issuer rotation and changed-projection/predecessor-rejection proof;
this cutover neither performs nor authorizes rotation. Human acceptance of the
decision product stays with INFD-WP-0007-T07 / STATE-WP-0096-T03.