railiance-platform/workplans/RPF-WP-0060-browser-case-platform-bindings.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	origin	origin_ref	state_hub_workstream_id
RPF-WP-0060	workplan	Implement Platform bindings for the browser SecurityCase successor	financials	railiance-platform	blocked	codex	netkingdom	2026-10-17	2026-11-03	implementation	cross-repo	NK-WP-0048-T16	43110f82-ef9f-5a46-a305-f0e287b7b226

Demand: Platform's source review of the proposed browser SecurityCase 1.3 requires four concrete owner obligations before owner-descriptor acceptance. The review labels RPF-1.3-T1 through T4 were not live work records; this workplan makes them ordinary owner tasks without changing RPF-WP-0054's completed first-generation lane or implementing its residual rotation work.

Review: the-custodian/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json. The 1.3 type remains proposed. This workplan grants no native access, case acceptance, owner acknowledgment, catalog activation or policy change.

T01 — Bind the broker to reviewed acknowledged type sources

id: RPF-WP-0060-T01
status: wait
priority: high
blocking_reason: "NK-WP-0048-T16: the 1.3 type is not acknowledged and is still changing (coordinator r6 rejected; awaiting re-freeze, coordinator r7 and owner re-check; NK-WP-0048 triaged blocked 2026-10-28)."
state_hub_task_id: "afec2053-1995-506d-a112-cda1de552c1c"

Implements review obligation RPF-1.3-T1. The broker's explicit source map admits only its existing 1.1 revision. Exact type and producer bytes, parameter fingerprint, acknowledgment state and case schema are checked before any Bao call. Source-only 1.2 and proposed 1.3 remain refused. The fixed installation layout is railiance-platform and net-kingdom as real sibling directories; missing, symlinked or drifted selected sources refuse rather than fall back.

2026-10-17: source hardening and catalog regressions independently reviewed in the-custodian/docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/. The exact case reference binds caller-supplied bytes; schema validation does not authenticate case acceptance. Existing Warden admission/native evidence must establish that independently. This task remains open for the real binding and explicit 1.3 source/parameter pins after genuine acknowledgment and review. No speculative successor pin or acknowledgment is added.

Done when the actual admitted-case binding is verified, the genuinely acknowledged successor is explicitly selected, and refusal tests cover unknown, unacknowledged, wrong-case and drifted-source inputs before native effects.

T02 — Correct the documented mint caller and issuer binding

id: RPF-WP-0060-T02
status: done
priority: high
state_hub_task_id: "1a764c10-3a41-5eff-af96-c9e33a6e2c8b"

Implements review obligation RPF-1.3-T2. credential-grants/catalog.yaml now names human-operator only and the exact existing issuer role auth/netkingdom/role/credential-broker-keycape-client-secret-generate. Regression checks bind this statement to CCR-2026-0043's role source, net-kingdom-admins membership and aal2 claim. No OpenBao role, policy, grant, credential or live configuration changes.

T03 — Implement mint, guarded destruction and authenticated evidence

id: RPF-WP-0060-T03
status: wait
priority: high
blocking_reason: "NK-WP-0048-T16: the 1.3 type is not acknowledged and is still changing (coordinator r6 rejected; awaiting re-freeze, coordinator r7 and owner re-check; NK-WP-0048 triaged blocked 2026-10-28)."
state_hub_task_id: "b5d73ec6-c593-50a9-8367-f899edec6f5f"

Implements review obligation RPF-1.3-T3. Bind the actual generator to the closed railiance-platform.custody-mint.v1 projection and authenticated publication. Capture grant accessor and revocation evidence and revoke the issuer session. Destruction uses attended platform-admin authority and compares the original CAS-0 version-1 creation time, current version and absence of other versions before metadata deletion. No standing family-wide delete grant is introduced. Unavailable authority, uncertain effects or failed revocation remain UNCERTAIN for owner reconciliation. Verify with the frozen adapter, then obtain the required native authority and actual execution receipts.

T04 — Implement and admit the delivery lane and capability

id: RPF-WP-0060-T04
status: wait
priority: high
blocking_reason: "NK-WP-0048-T16: the 1.3 type is not acknowledged and is still changing (coordinator r6 rejected; awaiting re-freeze, coordinator r7 and owner re-check; NK-WP-0048 triaged blocked 2026-10-28)."
state_hub_task_id: "84f8b0a4-8450-5623-8608-dc277978383b"

Implements review obligation RPF-1.3-T4. Reuse the fixed proposed issuer Store contract; validate the preexisting Store and only create the case-derived ExternalSecret in sso. Refuse conflicts; report NO_CHANGE only for matching preexisting configuration; establish current Ready status before success. Return the closed metadata-only netkingdom.deliver-secret.v1 receipt and use UID and resourceVersion preconditions to remove only authenticated case-created resources. Never read Secret values or create the Store through this lane.

Bind real human net-kingdom-admins/aal2 admission, per-attempt session and revocation, durable pre-intent/recovery journal and authenticated owner evidence. The separate command-mechanics candidate is preparation, not this capability; its production factory refuses. Review freshness/defaulting/transport failure cases before integrating it. Obtain ops-warden's catalog routing acceptance for platform-secret-delivery through an authorized handoff before recording owner acceptance. No routing handoff or native action is implied by this work record.

The parent stays active until these obligations and their required owner acceptance are proved. Source tests do not complete native acceptance or KEY-WP-0039's negative/expiry/cleanup exercise.

2026-11-03: the founder set this plan to blocked. T01, T03 and T04 all bind to the 1.3 SecurityCase type, which is still not acknowledged and is still changing. NK-WP-0048-T16 waits on the 1.3 re-freeze after the F3/T12 integration (net-kingdom 2a9d946, 2026-10-23), then coordinator review r7 and the owner re-check, and NetKingdom triaged NK-WP-0048 as blocked on 2026-10-28. Implementing mint/destruction (T03) or the delivery lane (T04) now would likely mean rework after the re-freeze. Resume when NK-WP-0048-T16 reopens the owner re-check. At that point, also confirm whether NetKingdom's separate oidc-service-client 0.1 type (NK-WP-0056-T14) changes what Platform must bind. T02 remains done.