---
id: RPF-WP-0060
type: workplan
title: "Implement Platform bindings for the browser SecurityCase successor"
domain: financials
repo: railiance-platform
status: active
owner: codex
topic_slug: netkingdom
created: "2026-10-17"
updated: "2026-10-17"
flavor: implementation
origin: cross-repo
origin_ref: NK-WP-0048-T16
state_hub_workstream_id: "43110f82-ef9f-5a46-a305-f0e287b7b226"
---

Demand: Platform's source review of the proposed browser SecurityCase 1.3
requires four concrete owner obligations before owner-descriptor acceptance.
The review labels `RPF-1.3-T1` through `T4` were not live work records; this
workplan makes them ordinary owner tasks without changing RPF-WP-0054's
completed first-generation lane or implementing its residual rotation work.

Review: `the-custodian/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json`.
The 1.3 type remains proposed. This workplan grants no native access, case
acceptance, owner acknowledgment, catalog activation or policy change.

## T01 — Bind the broker to reviewed acknowledged type sources

```task
id: RPF-WP-0060-T01
status: progress
priority: high
state_hub_task_id: "afec2053-1995-506d-a112-cda1de552c1c"
```

Implements review obligation RPF-1.3-T1. The broker's explicit source map admits
only its existing 1.1 revision. Exact type and producer bytes, parameter
fingerprint, acknowledgment state and case schema are checked before any Bao
call. Source-only 1.2 and proposed 1.3 remain refused. The fixed installation
layout is `railiance-platform` and `net-kingdom` as real sibling directories;
missing, symlinked or drifted selected sources refuse rather than fall back.

2026-10-17: source hardening and catalog regressions independently reviewed in
`the-custodian/docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/`.
The exact case reference binds caller-supplied bytes; schema validation does
not authenticate case acceptance. Existing Warden admission/native evidence
must establish that independently. This task remains open for the real binding
and explicit 1.3 source/parameter pins after genuine acknowledgment and review.
No speculative successor pin or acknowledgment is added.

Done when the actual admitted-case binding is verified, the genuinely
acknowledged successor is explicitly selected, and refusal tests cover unknown,
unacknowledged, wrong-case and drifted-source inputs before native effects.

## T02 — Correct the documented mint caller and issuer binding

```task
id: RPF-WP-0060-T02
status: done
priority: high
state_hub_task_id: "1a764c10-3a41-5eff-af96-c9e33a6e2c8b"
```

Implements review obligation RPF-1.3-T2. `credential-grants/catalog.yaml` now
names human-operator only and the exact existing issuer role
`auth/netkingdom/role/credential-broker-keycape-client-secret-generate`.
Regression checks bind this statement to CCR-2026-0043's role source,
net-kingdom-admins membership and aal2 claim. No OpenBao role, policy, grant,
credential or live configuration changes.

## T03 — Implement mint, guarded destruction and authenticated evidence

```task
id: RPF-WP-0060-T03
status: todo
priority: high
state_hub_task_id: "b5d73ec6-c593-50a9-8367-f899edec6f5f"
```

Implements review obligation RPF-1.3-T3. Bind the actual generator to the closed
`railiance-platform.custody-mint.v1` projection and authenticated publication.
Capture grant accessor and revocation evidence and revoke the issuer session.
Destruction uses attended platform-admin authority and compares the original
CAS-0 version-1 creation time, current version and absence of other versions
before metadata deletion. No standing family-wide delete grant is introduced.
Unavailable authority, uncertain effects or failed revocation remain UNCERTAIN
for owner reconciliation. Verify with the frozen adapter, then obtain the
required native authority and actual execution receipts.

## T04 — Implement and admit the delivery lane and capability

```task
id: RPF-WP-0060-T04
status: todo
priority: high
state_hub_task_id: "84f8b0a4-8450-5623-8608-dc277978383b"
```

Implements review obligation RPF-1.3-T4. Reuse the fixed proposed issuer Store
contract; validate the preexisting Store and only create the case-derived
ExternalSecret in `sso`. Refuse conflicts; report NO_CHANGE only for matching
preexisting configuration; establish current Ready status before success.
Return the closed metadata-only `netkingdom.deliver-secret.v1` receipt and use
UID and resourceVersion preconditions to remove only authenticated case-created
resources. Never read Secret values or create the Store through this lane.

Bind real human net-kingdom-admins/aal2 admission, per-attempt session and
revocation, durable pre-intent/recovery journal and authenticated owner evidence.
The separate command-mechanics candidate is preparation, not this capability;
its production factory refuses. Review freshness/defaulting/transport failure
cases before integrating it. Obtain ops-warden's catalog routing acceptance for
`platform-secret-delivery` through an authorized handoff before recording owner
acceptance. No routing handoff or native action is implied by this work record.

The parent stays active until these obligations and their required owner
acceptance are proved. Source tests do not complete native acceptance or
KEY-WP-0039's negative/expiry/cleanup exercise.