railiance-platform/workplans/RPF-WP-0050-attended-provisioning-preparation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	state_hub_workstream_id
RPF-WP-0050	workplan	Prepare generated attended windows and explicit value-custody choice	financials	railiance-platform	finished	codex	platform-services	2026-10-03	2026-10-10	implementation	0c7e3b0c-1c36-568c-af51-b06f912a0f1d

Origin: Custodian proposal f84637fa-2355-4971-a2dc-7f1fd01710a8, CUST-WP-0075 P2/P3. Platform accepts bounded preparation; Custodian owns cadence, founder owns custody policy and live authorization. No recurring event is enabled.

Render offline decision-task-CCR preparation checklist

id: RPF-WP-0050-T01
status: done
priority: high
state_hub_task_id: "43fac4d5-98de-5469-ac86-c8925ea3a31b"

Implemented credential-change.py window-checklist and scripts/provisioning_window.py. Reads authoritative open non-residual task blocks and explicit CCR/lane/receipt contracts. Missing/stale joins and non-approved/applied CCRs prevent a complete checklist. No execution, scheduling, credential reads or printing arbitrary CCR contents. Contract: docs/attended-provisioning-window.md. Synthetic regression suite verifies actual decision joins and replay refusal. This completes the bounded source renderer, not a real attended session.

Obtain exact founder value-custody choice

id: RPF-WP-0050-T02
status: done
priority: high
decision_id: "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa"
state_hub_task_id: "99b73b3f-66b1-57a9-9f68-43e3fe12bf26"

P3 options and required review boundaries are drafted in the contract. Existing attended custody remains in force. No delivery helper, delegated value role or policy change is admitted by preparation.

2026-10-04: Bernd explicitly selected "Batched attended custody (existing approach)" in this session. T02 is done for that choice under the existing attended-login boundary, recorded in docs/attended-provisioning-window.md: founder OIDC/MFA, exact per-item reviewed CCR/actor/path/audience, contained silent child, existing TTL/revocation, compare-before-write, replay refusal and per-item abort/verification/rollback. No alternate delivery lane is adopted. Shared D3 has other unresolved subjects and is not resolved by this task completion. T03 still requires the dated scope and owner receipt mappings; no live command or schedule is authorized by this choice.

Bind a real dated window and owner receipt manifests

id: RPF-WP-0050-T03
status: cancel
priority: medium
state_hub_task_id: "1ae5a6b8-9c83-5813-982f-ca8ad24be8b5"

Generate a checklist from all named authoritative roots, verified Hub decision joins and owner CCR/lane/receipt mappings; revalidate each exact revision, upstream acceptance, native readiness and rollback. Applied custody such as RPF-WP-0035-T08 is excluded. Each session returns exact receipts for each owner; missing receipts leave waits intact. Do not activate schedules in this workplan.

2026-10-04: Bernd directed "Pick lanes by relevance for today 10am". Prepared the one-time 10:00 Europe/Berlin (08:00 UTC) source packet in docs/provisioning-windows/2026-10-04-1000/. Priority scope: secrets-engine service JWT login (RPF-WP-0035-T02), informed-decision requester workload delivery (INFD-WP-0005-T05, separate decision), and user-engine transactional mail (USER-WP-0035-T02). The packet records per-owner required receipts, historical custody replay exclusions and the separate no-session RPF-WP-0035-T06 acceptance. Current D1 roots and exact Hub task joins are reviewed in the evidence inventory. No eligible reviewed new execution candidate is claimed; the generated checklist remains NOT READY. T03 stays wait for Custodian review and concrete owner contracts/commands/mappings, rather than the now-supplied date. No schedule or live command is executed.

2026-10-04 continuation: Direct founder date/scope selection supplies the platform date gate without requiring a repeated Custodian confirmation; its residual source remains its owner's record. Prepared concrete informed-decision reader artifacts and silent conflict-refusing metadata child under RPF-WP-0051-T01 (done). The separate owner-decision checklist now has an explicit proposed CCR/lane/receipt join, retaining approval/binding/runtime blockers. Corrected mail priority from credential provisioning to the provider password-setup-link handoff: USER-WP-0035's 2026-09-27 qualification confirms existing authenticated mail. owner-returns.md names the actual three remaining owner acts. T03 depends on those returns rather than an already-supplied date. No applied requester/mail custody is replayed.

2026-10-04 blocked-task review: worker returns reconciled, platform issuer-reader CCR-2026-0033/policy/auth/ESO/receipt source implemented, and actual ESO controller TokenRequest authorization checked without minting a token. Required independent owner phases and reopen conditions are recorded in docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md. T03 stays wait; the plan is blocked because remaining progress requires receiving repo source/registration/custody/handoff evidence. Existing date/design approvals are retained. No source receipt is substituted for native acceptance.

Accept platform seam for catalog lane scaffold proposal

id: RPF-WP-0050-T04
status: done
priority: medium
state_hub_task_id: "6475d924-92c6-504a-b9a1-4f035273f0e1"

P4 accepted for platform-side source review and bounded scaffolding after Warden returns its contract. Catalog entry/scaffold never supplies credentials, reviews, admission or live authority. Keep owner acceptance explicit before implementation.

2026-10-03: Platform source review accepts the delivered Warden seam at ops-warden/wiki/CatalogLaneScaffoldContract.md (ac112d8). T04 is now a ready source implementation task for the platform-owned rendering and schema fixture. Warden T02 may progress independently; no mutual owner-return wait remains. This is source contract acceptance, not credential admission or production authorization.

2026-10-04 T04 implementation: closed platform metadata schema and credential-change.py scaffold-lane authored with deterministic proposed CCR, existing exact-path policy/auth rendering, namespace-restricted draft ESO with annotation containment, and non-executed owner evidence checklist. Shared synthetic platform/Warden pointer fixtures retain unknown workload identity and unconfirmed auth claims. Fourteen focused offline tests pass in isolated prepared source; cross-owner staging fixture acceptance remains before marking T04 done. No admission, credentials, human answer or production execution.

2026-10-04 T04 acceptance: actual applied-source scaffold tests 14/14 and existing window tests 7/7 pass, with CLI help and diff checks. Both actual owner CLIs produced matching cross-owner synthetic fixture drafts; platform independently verified Warden catalog/model loading, exact lane/owner/consumer/risk/CCR pointers and fixture digest, preserved unknown workload, unconfirmed prospective auth, proposed/unresolvable frontdoor, explicit ESO target annotations and non-executed evidence. Six platform artifacts match the independently generated second platform stage byte-for-byte. Receipt: docs/evidence/2026-10-04-catalog-lane-scaffold-offline.json. T04 is done for offline source/scaffold/fixture acceptance only. T02 remains the founder custody-choice wait; T03 remains the Custodian dated-window handoff. No admission, actual credentials, schedule or production execution was performed.

Closure and consolidation — 2026-10-10

The bounded preparation is complete: checklist renderer (T01), founder choice of batched attended custody (T02), and platform/Warden offline scaffold acceptance (T04). The founder supplied the one-time 2026-10-04 10:00 Berlin window and selected scope directly; CUST-WP-0076 records that cadence closure. No recurring event or standing execution grant follows from it.

T03 is cancelled as retired orchestration for that historical window, rather than marked done: its packet was NOT READY and no eligible completed window checklist is claimed. Under the founder's request to consolidate the open security work, its actual owner acceptance obligations stay in their existing live records:

• RPF-WP-0051-T02/T03 now record source and native informed-decision requester delivery acceptance; RPF-WP-0051 is finished, with issuer rotation handed to RPF-IN-0004 and complete decision-product acceptance in INFD-WP-0007-T07 / STATE-WP-0096-T03.
• RPF-WP-0035-T02 retains the service-JWT negative claims, unrelated-path capability denies, bounded lifetime/revocation and consumer opt-in acceptance. The positive login and custody proofs do not close those checks.
• USER-WP-0035-T02 retains the provider-supported setup-link delivery contract and intended-recipient evidence. It is not a new platform credential lane.

The dated packet and owner-return documents are historical preparation evidence. They must not be used as current approval or replay authority. No remaining acceptance requirement is removed, no residual demand is created merely to duplicate those existing owners, and no native acceptance is inferred from this preparation closure. A future attended run must regenerate and revalidate its exact reviewed packet against the remaining owner records.