2fb7f951eb
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 236506@bnt-lap001 Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4
132 lines
6.6 KiB
Markdown
132 lines
6.6 KiB
Markdown
---
|
|
id: RPF-WP-0060
|
|
type: workplan
|
|
title: "Implement Platform bindings for the browser SecurityCase successor"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-10-17"
|
|
updated: "2026-11-03"
|
|
flavor: implementation
|
|
origin: cross-repo
|
|
origin_ref: NK-WP-0048-T16
|
|
state_hub_workstream_id: "43110f82-ef9f-5a46-a305-f0e287b7b226"
|
|
---
|
|
|
|
Demand: Platform's source review of the proposed browser SecurityCase 1.3
|
|
requires four concrete owner obligations before owner-descriptor acceptance.
|
|
The review labels `RPF-1.3-T1` through `T4` were not live work records; this
|
|
workplan makes them ordinary owner tasks without changing RPF-WP-0054's
|
|
completed first-generation lane or implementing its residual rotation work.
|
|
|
|
Review: `the-custodian/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json`.
|
|
The 1.3 type remains proposed. This workplan grants no native access, case
|
|
acceptance, owner acknowledgment, catalog activation or policy change.
|
|
|
|
## T01 — Bind the broker to reviewed acknowledged type sources
|
|
|
|
```task
|
|
id: RPF-WP-0060-T01
|
|
status: wait
|
|
priority: high
|
|
blocking_reason: "NK-WP-0048-T16: the 1.3 type is not acknowledged and is still changing (coordinator r6 rejected; awaiting re-freeze, coordinator r7 and owner re-check; NK-WP-0048 triaged blocked 2026-10-28)."
|
|
state_hub_task_id: "afec2053-1995-506d-a112-cda1de552c1c"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T1. The broker's explicit source map admits
|
|
only its existing 1.1 revision. Exact type and producer bytes, parameter
|
|
fingerprint, acknowledgment state and case schema are checked before any Bao
|
|
call. Source-only 1.2 and proposed 1.3 remain refused. The fixed installation
|
|
layout is `railiance-platform` and `net-kingdom` as real sibling directories;
|
|
missing, symlinked or drifted selected sources refuse rather than fall back.
|
|
|
|
2026-10-17: source hardening and catalog regressions independently reviewed in
|
|
`the-custodian/docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/`.
|
|
The exact case reference binds caller-supplied bytes; schema validation does
|
|
not authenticate case acceptance. Existing Warden admission/native evidence
|
|
must establish that independently. This task remains open for the real binding
|
|
and explicit 1.3 source/parameter pins after genuine acknowledgment and review.
|
|
No speculative successor pin or acknowledgment is added.
|
|
|
|
Done when the actual admitted-case binding is verified, the genuinely
|
|
acknowledged successor is explicitly selected, and refusal tests cover unknown,
|
|
unacknowledged, wrong-case and drifted-source inputs before native effects.
|
|
|
|
## T02 — Correct the documented mint caller and issuer binding
|
|
|
|
```task
|
|
id: RPF-WP-0060-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "1a764c10-3a41-5eff-af96-c9e33a6e2c8b"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T2. `credential-grants/catalog.yaml` now
|
|
names human-operator only and the exact existing issuer role
|
|
`auth/netkingdom/role/credential-broker-keycape-client-secret-generate`.
|
|
Regression checks bind this statement to CCR-2026-0043's role source,
|
|
net-kingdom-admins membership and aal2 claim. No OpenBao role, policy, grant,
|
|
credential or live configuration changes.
|
|
|
|
## T03 — Implement mint, guarded destruction and authenticated evidence
|
|
|
|
```task
|
|
id: RPF-WP-0060-T03
|
|
status: wait
|
|
priority: high
|
|
blocking_reason: "NK-WP-0048-T16: the 1.3 type is not acknowledged and is still changing (coordinator r6 rejected; awaiting re-freeze, coordinator r7 and owner re-check; NK-WP-0048 triaged blocked 2026-10-28)."
|
|
state_hub_task_id: "b5d73ec6-c593-50a9-8367-f899edec6f5f"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T3. Bind the actual generator to the closed
|
|
`railiance-platform.custody-mint.v1` projection and authenticated publication.
|
|
Capture grant accessor and revocation evidence and revoke the issuer session.
|
|
Destruction uses attended platform-admin authority and compares the original
|
|
CAS-0 version-1 creation time, current version and absence of other versions
|
|
before metadata deletion. No standing family-wide delete grant is introduced.
|
|
Unavailable authority, uncertain effects or failed revocation remain UNCERTAIN
|
|
for owner reconciliation. Verify with the frozen adapter, then obtain the
|
|
required native authority and actual execution receipts.
|
|
|
|
## T04 — Implement and admit the delivery lane and capability
|
|
|
|
```task
|
|
id: RPF-WP-0060-T04
|
|
status: wait
|
|
priority: high
|
|
blocking_reason: "NK-WP-0048-T16: the 1.3 type is not acknowledged and is still changing (coordinator r6 rejected; awaiting re-freeze, coordinator r7 and owner re-check; NK-WP-0048 triaged blocked 2026-10-28)."
|
|
state_hub_task_id: "84f8b0a4-8450-5623-8608-dc277978383b"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T4. Reuse the fixed proposed issuer Store
|
|
contract; validate the preexisting Store and only create the case-derived
|
|
ExternalSecret in `sso`. Refuse conflicts; report NO_CHANGE only for matching
|
|
preexisting configuration; establish current Ready status before success.
|
|
Return the closed metadata-only `netkingdom.deliver-secret.v1` receipt and use
|
|
UID and resourceVersion preconditions to remove only authenticated case-created
|
|
resources. Never read Secret values or create the Store through this lane.
|
|
|
|
Bind real human net-kingdom-admins/aal2 admission, per-attempt session and
|
|
revocation, durable pre-intent/recovery journal and authenticated owner evidence.
|
|
The separate command-mechanics candidate is preparation, not this capability;
|
|
its production factory refuses. Review freshness/defaulting/transport failure
|
|
cases before integrating it. Obtain ops-warden's catalog routing acceptance for
|
|
`platform-secret-delivery` through an authorized handoff before recording owner
|
|
acceptance. No routing handoff or native action is implied by this work record.
|
|
|
|
The parent stays active until these obligations and their required owner
|
|
acceptance are proved. Source tests do not complete native acceptance or
|
|
KEY-WP-0039's negative/expiry/cleanup exercise.
|
|
|
|
2026-11-03: the founder set this plan to blocked. T01, T03 and T04 all bind to
|
|
the 1.3 SecurityCase type, which is still not acknowledged and is still
|
|
changing. NK-WP-0048-T16 waits on the 1.3 re-freeze after the F3/T12
|
|
integration (net-kingdom `2a9d946`, 2026-10-23), then coordinator review r7
|
|
and the owner re-check, and NetKingdom triaged NK-WP-0048 as blocked on
|
|
2026-10-28. Implementing mint/destruction (T03) or the delivery lane (T04)
|
|
now would likely mean rework after the re-freeze. Resume when NK-WP-0048-T16
|
|
reopens the owner re-check. At that point, also confirm whether NetKingdom's
|
|
separate `oidc-service-client` 0.1 type (NK-WP-0056-T14) changes what Platform
|
|
must bind. T02 remains done.
|