221668a487
Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
75 lines
2.4 KiB
Markdown
75 lines
2.4 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0028
|
|
type: workplan
|
|
title: "Adopt canonical flex-auth credential-grant checks"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- FLEX-WP-0012
|
|
origin: routed
|
|
origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
|
|
state_hub_workstream_id: "022dda1f-8772-57ad-862e-672924455f11"
|
|
---
|
|
|
|
# RAILIANCE-WP-0028 — canonical flex-auth credential-grant checks
|
|
|
|
## Goal
|
|
|
|
Adopt flex-auth's single canonical `POST /v1/check` decision surface for
|
|
credential-grant preflight without exposing credential values or adding a
|
|
consumer-specific flex-auth endpoint.
|
|
|
|
## T01 — Resolve translation ownership
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0028-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "cfec3a0a-a198-580a-988b-4b2d7bac206c"
|
|
```
|
|
|
|
The operator explicitly approved Option A in State Hub decision
|
|
`1f9f257d-c9f2-4a5e-a018-8058a3f2a51a`: railiance-platform maps its grant
|
|
metadata to `CheckRequest` and reads `DecisionEnvelope`. Duration parsing and
|
|
normalization belong here, before the flex-auth policy boundary.
|
|
|
|
## T02 — Implement the canonical request and response
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0028-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "971f243a-a6cd-5a3a-965a-8191c51c7577"
|
|
```
|
|
|
|
Change the helper default to `/v1/check`, emit the coordinated
|
|
`tenant:platform` / `credential-grant:<id>` / `issue` request vocabulary, send
|
|
`requested_ttl_seconds` as an integer, and accept only `effect: allow`.
|
|
|
|
Completed in source. Actor classes map to canonical subject types (`Human`,
|
|
`Agent`, or `Automation`); the bound subject and non-secret actor metadata are
|
|
carried in context. Missing, deny, redact, audit-only, and not-applicable
|
|
effects all fail closed. An allow also requires a non-empty decision id,
|
|
evaluator provenance, and subject/resource binding back to the request.
|
|
|
|
## T03 — Verify and route the contract
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0028-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "60725d60-ae38-5fe8-971f-8c714261fd1d"
|
|
```
|
|
|
|
Exercise focused allow and deny tests, validate the complete repository suite,
|
|
and route the adopted mapping to flex-auth without requesting live credentials
|
|
or a production mutation.
|
|
|
|
Completed with 70 focused credential tests, all credential-helper dry-runs,
|
|
credential-catalog validation, and the complete 146-test offline suite passing.
|
|
No flex-auth production endpoint was called and no credential was issued.
|