d35c0f9d4b
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
118 lines
5.3 KiB
Markdown
118 lines
5.3 KiB
Markdown
---
|
|
id: RPF-WP-0060
|
|
type: workplan
|
|
title: "Implement Platform bindings for the browser SecurityCase successor"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: active
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-10-17"
|
|
updated: "2026-10-17"
|
|
flavor: implementation
|
|
origin: cross-repo
|
|
origin_ref: NK-WP-0048-T16
|
|
state_hub_workstream_id: "43110f82-ef9f-5a46-a305-f0e287b7b226"
|
|
---
|
|
|
|
Demand: Platform's source review of the proposed browser SecurityCase 1.3
|
|
requires four concrete owner obligations before owner-descriptor acceptance.
|
|
The review labels `RPF-1.3-T1` through `T4` were not live work records; this
|
|
workplan makes them ordinary owner tasks without changing RPF-WP-0054's
|
|
completed first-generation lane or implementing its residual rotation work.
|
|
|
|
Review: `the-custodian/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json`.
|
|
The 1.3 type remains proposed. This workplan grants no native access, case
|
|
acceptance, owner acknowledgment, catalog activation or policy change.
|
|
|
|
## T01 — Bind the broker to reviewed acknowledged type sources
|
|
|
|
```task
|
|
id: RPF-WP-0060-T01
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "afec2053-1995-506d-a112-cda1de552c1c"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T1. The broker's explicit source map admits
|
|
only its existing 1.1 revision. Exact type and producer bytes, parameter
|
|
fingerprint, acknowledgment state and case schema are checked before any Bao
|
|
call. Source-only 1.2 and proposed 1.3 remain refused. The fixed installation
|
|
layout is `railiance-platform` and `net-kingdom` as real sibling directories;
|
|
missing, symlinked or drifted selected sources refuse rather than fall back.
|
|
|
|
2026-10-17: source hardening and catalog regressions independently reviewed in
|
|
`the-custodian/docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/`.
|
|
The exact case reference binds caller-supplied bytes; schema validation does
|
|
not authenticate case acceptance. Existing Warden admission/native evidence
|
|
must establish that independently. This task remains open for the real binding
|
|
and explicit 1.3 source/parameter pins after genuine acknowledgment and review.
|
|
No speculative successor pin or acknowledgment is added.
|
|
|
|
Done when the actual admitted-case binding is verified, the genuinely
|
|
acknowledged successor is explicitly selected, and refusal tests cover unknown,
|
|
unacknowledged, wrong-case and drifted-source inputs before native effects.
|
|
|
|
## T02 — Correct the documented mint caller and issuer binding
|
|
|
|
```task
|
|
id: RPF-WP-0060-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "1a764c10-3a41-5eff-af96-c9e33a6e2c8b"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T2. `credential-grants/catalog.yaml` now
|
|
names human-operator only and the exact existing issuer role
|
|
`auth/netkingdom/role/credential-broker-keycape-client-secret-generate`.
|
|
Regression checks bind this statement to CCR-2026-0043's role source,
|
|
net-kingdom-admins membership and aal2 claim. No OpenBao role, policy, grant,
|
|
credential or live configuration changes.
|
|
|
|
## T03 — Implement mint, guarded destruction and authenticated evidence
|
|
|
|
```task
|
|
id: RPF-WP-0060-T03
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "b5d73ec6-c593-50a9-8367-f899edec6f5f"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T3. Bind the actual generator to the closed
|
|
`railiance-platform.custody-mint.v1` projection and authenticated publication.
|
|
Capture grant accessor and revocation evidence and revoke the issuer session.
|
|
Destruction uses attended platform-admin authority and compares the original
|
|
CAS-0 version-1 creation time, current version and absence of other versions
|
|
before metadata deletion. No standing family-wide delete grant is introduced.
|
|
Unavailable authority, uncertain effects or failed revocation remain UNCERTAIN
|
|
for owner reconciliation. Verify with the frozen adapter, then obtain the
|
|
required native authority and actual execution receipts.
|
|
|
|
## T04 — Implement and admit the delivery lane and capability
|
|
|
|
```task
|
|
id: RPF-WP-0060-T04
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "84f8b0a4-8450-5623-8608-dc277978383b"
|
|
```
|
|
|
|
Implements review obligation RPF-1.3-T4. Reuse the fixed proposed issuer Store
|
|
contract; validate the preexisting Store and only create the case-derived
|
|
ExternalSecret in `sso`. Refuse conflicts; report NO_CHANGE only for matching
|
|
preexisting configuration; establish current Ready status before success.
|
|
Return the closed metadata-only `netkingdom.deliver-secret.v1` receipt and use
|
|
UID and resourceVersion preconditions to remove only authenticated case-created
|
|
resources. Never read Secret values or create the Store through this lane.
|
|
|
|
Bind real human net-kingdom-admins/aal2 admission, per-attempt session and
|
|
revocation, durable pre-intent/recovery journal and authenticated owner evidence.
|
|
The separate command-mechanics candidate is preparation, not this capability;
|
|
its production factory refuses. Review freshness/defaulting/transport failure
|
|
cases before integrating it. Obtain ops-warden's catalog routing acceptance for
|
|
`platform-secret-delivery` through an authorized handoff before recording owner
|
|
acceptance. No routing handoff or native action is implied by this work record.
|
|
|
|
The parent stays active until these obligations and their required owner
|
|
acceptance are proved. Source tests do not complete native acceptance or
|
|
KEY-WP-0039's negative/expiry/cleanup exercise.
|