codex
86209c756c
The RAILIANCE-WP migration numbered from RPF-WP-0001 without checking whether the target prefix was already in use. It was: this repository already had RPF-WP records, and the migration collided at 0018, 0019 and 0020, putting two unrelated workplans on each identifier. Central was left holding mixed records — rpf-wp-0018 carried the status of one file and the backing path of the other, because the reset processed two files claiming one identifier. The three files the migration displaced move to 0025-0027; the pre-existing records keep their numbers. Projection UUIDs are re-derived. Refs STATE-WP-0083-T05 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
75 lines
2.4 KiB
Markdown
75 lines
2.4 KiB
Markdown
---
|
|
id: RPF-WP-0026
|
|
type: workplan
|
|
title: "Adopt canonical flex-auth credential-grant checks"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- FLEX-WP-0012
|
|
origin: routed
|
|
origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
|
|
state_hub_workstream_id: "7677326a-04db-52ef-b05c-967dabe1759e"
|
|
---
|
|
|
|
# RPF-WP-0026 — canonical flex-auth credential-grant checks
|
|
|
|
## Goal
|
|
|
|
Adopt flex-auth's single canonical `POST /v1/check` decision surface for
|
|
credential-grant preflight without exposing credential values or adding a
|
|
consumer-specific flex-auth endpoint.
|
|
|
|
## T01 — Resolve translation ownership
|
|
|
|
```task
|
|
id: RPF-WP-0026-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "07f3fead-76d6-5e53-9a7b-9930560182d9"
|
|
```
|
|
|
|
The operator explicitly approved Option A in State Hub decision
|
|
`1f9f257d-c9f2-4a5e-a018-8058a3f2a51a`: railiance-platform maps its grant
|
|
metadata to `CheckRequest` and reads `DecisionEnvelope`. Duration parsing and
|
|
normalization belong here, before the flex-auth policy boundary.
|
|
|
|
## T02 — Implement the canonical request and response
|
|
|
|
```task
|
|
id: RPF-WP-0026-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "659ac0ee-c2b7-56fc-80d8-92b2fcf30e7b"
|
|
```
|
|
|
|
Change the helper default to `/v1/check`, emit the coordinated
|
|
`tenant:platform` / `credential-grant:<id>` / `issue` request vocabulary, send
|
|
`requested_ttl_seconds` as an integer, and accept only `effect: allow`.
|
|
|
|
Completed in source. Actor classes map to canonical subject types (`Human`,
|
|
`Agent`, or `Automation`); the bound subject and non-secret actor metadata are
|
|
carried in context. Missing, deny, redact, audit-only, and not-applicable
|
|
effects all fail closed. An allow also requires a non-empty decision id,
|
|
evaluator provenance, and subject/resource binding back to the request.
|
|
|
|
## T03 — Verify and route the contract
|
|
|
|
```task
|
|
id: RPF-WP-0026-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "8f6b7481-e8c2-56eb-98b5-c49cae562d60"
|
|
```
|
|
|
|
Exercise focused allow and deny tests, validate the complete repository suite,
|
|
and route the adopted mapping to flex-auth without requesting live credentials
|
|
or a production mutation.
|
|
|
|
Completed with 70 focused credential tests, all credential-helper dry-runs,
|
|
credential-catalog validation, and the complete 146-test offline suite passing.
|
|
No flex-auth production endpoint was called and no credential was issued.
|