railiance-platform/workplans/RPF-WP-0050-attended-provisioning-preparation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	state_hub_workstream_id
RPF-WP-0050	workplan	Prepare generated attended windows and explicit value-custody choice	financials	railiance-platform	blocked	codex	platform-services	2026-10-03	2026-10-04	implementation	0c7e3b0c-1c36-568c-af51-b06f912a0f1d

Origin: Custodian proposal f84637fa-2355-4971-a2dc-7f1fd01710a8, CUST-WP-0075 P2/P3. Platform accepts bounded preparation; Custodian owns cadence, founder owns custody policy and live authorization. No recurring event is enabled.

Render offline decision-task-CCR preparation checklist

id: RPF-WP-0050-T01
status: done
priority: high
state_hub_task_id: "43fac4d5-98de-5469-ac86-c8925ea3a31b"

Implemented credential-change.py window-checklist and scripts/provisioning_window.py. Reads authoritative open non-residual task blocks and explicit CCR/lane/receipt contracts. Missing/stale joins and non-approved/applied CCRs prevent a complete checklist. No execution, scheduling, credential reads or printing arbitrary CCR contents. Contract: docs/attended-provisioning-window.md. Synthetic regression suite verifies actual decision joins and replay refusal. This completes the bounded source renderer, not a real attended session.

Obtain exact founder value-custody choice

id: RPF-WP-0050-T02
status: done
priority: high
decision_id: "1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa"
state_hub_task_id: "99b73b3f-66b1-57a9-9f68-43e3fe12bf26"

P3 options and required review boundaries are drafted in the contract. Existing attended custody remains in force. No delivery helper, delegated value role or policy change is admitted by preparation.

2026-10-04: Bernd explicitly selected "Batched attended custody (existing approach)" in this session. T02 is done for that choice under the existing attended-login boundary, recorded in docs/attended-provisioning-window.md: founder OIDC/MFA, exact per-item reviewed CCR/actor/path/audience, contained silent child, existing TTL/revocation, compare-before-write, replay refusal and per-item abort/verification/rollback. No alternate delivery lane is adopted. Shared D3 has other unresolved subjects and is not resolved by this task completion. T03 still requires the dated scope and owner receipt mappings; no live command or schedule is authorized by this choice.

Bind a real dated window and owner receipt manifests

id: RPF-WP-0050-T03
status: wait
priority: medium
depends_on: [RPF-WP-0051-T02, RPF-WP-0035-T02, USER-WP-0035-T02]
blocking_reason: "Platform preparation and founder design choice are complete. Independent informed-decision runtime source/publication, KeyCape custody/registration/issuance, secrets-engine consumer custody coordinates and provider setup-link handoff remain; dependency-requirements.md names the exact owner deliveries."
state_hub_task_id: "1ae5a6b8-9c83-5813-982f-ca8ad24be8b5"

Generate a checklist from all named authoritative roots, verified Hub decision joins and owner CCR/lane/receipt mappings; revalidate each exact revision, upstream acceptance, native readiness and rollback. Applied custody such as RPF-WP-0035-T08 is excluded. Each session returns exact receipts for each owner; missing receipts leave waits intact. Do not activate schedules in this workplan.

2026-10-04: Bernd directed "Pick lanes by relevance for today 10am". Prepared the one-time 10:00 Europe/Berlin (08:00 UTC) source packet in docs/provisioning-windows/2026-10-04-1000/. Priority scope: secrets-engine service JWT login (RPF-WP-0035-T02), informed-decision requester workload delivery (INFD-WP-0005-T05, separate decision), and user-engine transactional mail (USER-WP-0035-T02). The packet records per-owner required receipts, historical custody replay exclusions and the separate no-session RPF-WP-0035-T06 acceptance. Current D1 roots and exact Hub task joins are reviewed in the evidence inventory. No eligible reviewed new execution candidate is claimed; the generated checklist remains NOT READY. T03 stays wait for Custodian review and concrete owner contracts/commands/mappings, rather than the now-supplied date. No schedule or live command is executed.

2026-10-04 continuation: Direct founder date/scope selection supplies the platform date gate without requiring a repeated Custodian confirmation; its residual source remains its owner's record. Prepared concrete informed-decision reader artifacts and silent conflict-refusing metadata child under RPF-WP-0051-T01 (done). The separate owner-decision checklist now has an explicit proposed CCR/lane/receipt join, retaining approval/binding/runtime blockers. Corrected mail priority from credential provisioning to the provider password-setup-link handoff: USER-WP-0035's 2026-09-27 qualification confirms existing authenticated mail. owner-returns.md names the actual three remaining owner acts. T03 depends on those returns rather than an already-supplied date. No applied requester/mail custody is replayed.

2026-10-04 blocked-task review: worker returns reconciled, platform issuer-reader CCR-2026-0033/policy/auth/ESO/receipt source implemented, and actual ESO controller TokenRequest authorization checked without minting a token. Required independent owner phases and reopen conditions are recorded in docs/provisioning-windows/2026-10-04-1000/dependency-requirements.md. T03 stays wait; the plan is blocked because remaining progress requires receiving repo source/registration/custody/handoff evidence. Existing date/design approvals are retained. No source receipt is substituted for native acceptance.

Accept platform seam for catalog lane scaffold proposal

id: RPF-WP-0050-T04
status: done
priority: medium
state_hub_task_id: "6475d924-92c6-504a-b9a1-4f035273f0e1"

P4 accepted for platform-side source review and bounded scaffolding after Warden returns its contract. Catalog entry/scaffold never supplies credentials, reviews, admission or live authority. Keep owner acceptance explicit before implementation.

2026-10-03: Platform source review accepts the delivered Warden seam at ops-warden/wiki/CatalogLaneScaffoldContract.md (ac112d8). T04 is now a ready source implementation task for the platform-owned rendering and schema fixture. Warden T02 may progress independently; no mutual owner-return wait remains. This is source contract acceptance, not credential admission or production authorization.

2026-10-04 T04 implementation: closed platform metadata schema and credential-change.py scaffold-lane authored with deterministic proposed CCR, existing exact-path policy/auth rendering, namespace-restricted draft ESO with annotation containment, and non-executed owner evidence checklist. Shared synthetic platform/Warden pointer fixtures retain unknown workload identity and unconfirmed auth claims. Fourteen focused offline tests pass in isolated prepared source; cross-owner staging fixture acceptance remains before marking T04 done. No admission, credentials, human answer or production execution.

2026-10-04 T04 acceptance: actual applied-source scaffold tests 14/14 and existing window tests 7/7 pass, with CLI help and diff checks. Both actual owner CLIs produced matching cross-owner synthetic fixture drafts; platform independently verified Warden catalog/model loading, exact lane/owner/consumer/risk/CCR pointers and fixture digest, preserved unknown workload, unconfirmed prospective auth, proposed/unresolvable frontdoor, explicit ESO target annotations and non-executed evidence. Six platform artifacts match the independently generated second platform stage byte-for-byte. Receipt: docs/evidence/2026-10-04-catalog-lane-scaffold-offline.json. T04 is done for offline source/scaffold/fixture acceptance only. T02 remains the founder custody-choice wait; T03 remains the Custodian dated-window handoff. No admission, actual credentials, schedule or production execution was performed.