railiance-platform/workplans/RAILIANCE-WP-0028-flex-auth-credential-grant-integration.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	origin	origin_ref	state_hub_workstream_id
RAILIANCE-WP-0028	workplan	Adopt canonical flex-auth credential-grant checks	financials	railiance-platform	finished	codex	railiance	2026-08-23	2026-08-23	FLEX-WP-0012	routed	State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a	022dda1f-8772-57ad-862e-672924455f11

RAILIANCE-WP-0028 — canonical flex-auth credential-grant checks

Goal

Adopt flex-auth's single canonical POST /v1/check decision surface for credential-grant preflight without exposing credential values or adding a consumer-specific flex-auth endpoint.

T01 — Resolve translation ownership

id: RAILIANCE-WP-0028-T01
status: done
priority: high
state_hub_task_id: "cfec3a0a-a198-580a-988b-4b2d7bac206c"

The operator explicitly approved Option A in State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a: railiance-platform maps its grant metadata to CheckRequest and reads DecisionEnvelope. Duration parsing and normalization belong here, before the flex-auth policy boundary.

T02 — Implement the canonical request and response

id: RAILIANCE-WP-0028-T02
status: done
priority: high
state_hub_task_id: "971f243a-a6cd-5a3a-965a-8191c51c7577"

Change the helper default to /v1/check, emit the coordinated tenant:platform / credential-grant:<id> / issue request vocabulary, send requested_ttl_seconds as an integer, and accept only effect: allow.

Completed in source. Actor classes map to canonical subject types (Human, Agent, or Automation); the bound subject and non-secret actor metadata are carried in context. Missing, deny, redact, audit-only, and not-applicable effects all fail closed. An allow also requires a non-empty decision id, evaluator provenance, and subject/resource binding back to the request.

T03 — Verify and route the contract

id: RAILIANCE-WP-0028-T03
status: done
priority: medium
state_hub_task_id: "60725d60-ae38-5fe8-971f-8c714261fd1d"

Exercise focused allow and deny tests, validate the complete repository suite, and route the adopted mapping to flex-auth without requesting live credentials or a production mutation.

Completed with 70 focused credential tests, all credential-helper dry-runs, credential-catalog validation, and the complete 146-test offline suite passing. No flex-auth production endpoint was called and no credential was issued.