railiance-platform/workplans/RPF-WP-0060-browser-case-platform-bindings.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	origin	origin_ref	state_hub_workstream_id
RPF-WP-0060	workplan	Implement Platform bindings for the browser SecurityCase successor	financials	railiance-platform	active	codex	netkingdom	2026-10-17	2026-10-17	implementation	cross-repo	NK-WP-0048-T16	43110f82-ef9f-5a46-a305-f0e287b7b226

Demand: Platform's source review of the proposed browser SecurityCase 1.3 requires four concrete owner obligations before owner-descriptor acceptance. The review labels RPF-1.3-T1 through T4 were not live work records; this workplan makes them ordinary owner tasks without changing RPF-WP-0054's completed first-generation lane or implementing its residual rotation work.

Review: the-custodian/docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-platform.json. The 1.3 type remains proposed. This workplan grants no native access, case acceptance, owner acknowledgment, catalog activation or policy change.

T01 — Bind the broker to reviewed acknowledged type sources

id: RPF-WP-0060-T01
status: progress
priority: high
state_hub_task_id: "afec2053-1995-506d-a112-cda1de552c1c"

Implements review obligation RPF-1.3-T1. The broker's explicit source map admits only its existing 1.1 revision. Exact type and producer bytes, parameter fingerprint, acknowledgment state and case schema are checked before any Bao call. Source-only 1.2 and proposed 1.3 remain refused. The fixed installation layout is railiance-platform and net-kingdom as real sibling directories; missing, symlinked or drifted selected sources refuse rather than fall back.

2026-10-17: source hardening and catalog regressions independently reviewed in the-custodian/docs/changes/netkingdom-target-2026-10-17/platform-broker-review-r1/. The exact case reference binds caller-supplied bytes; schema validation does not authenticate case acceptance. Existing Warden admission/native evidence must establish that independently. This task remains open for the real binding and explicit 1.3 source/parameter pins after genuine acknowledgment and review. No speculative successor pin or acknowledgment is added.

Done when the actual admitted-case binding is verified, the genuinely acknowledged successor is explicitly selected, and refusal tests cover unknown, unacknowledged, wrong-case and drifted-source inputs before native effects.

T02 — Correct the documented mint caller and issuer binding

id: RPF-WP-0060-T02
status: done
priority: high
state_hub_task_id: "1a764c10-3a41-5eff-af96-c9e33a6e2c8b"

Implements review obligation RPF-1.3-T2. credential-grants/catalog.yaml now names human-operator only and the exact existing issuer role auth/netkingdom/role/credential-broker-keycape-client-secret-generate. Regression checks bind this statement to CCR-2026-0043's role source, net-kingdom-admins membership and aal2 claim. No OpenBao role, policy, grant, credential or live configuration changes.

T03 — Implement mint, guarded destruction and authenticated evidence

id: RPF-WP-0060-T03
status: todo
priority: high
state_hub_task_id: "b5d73ec6-c593-50a9-8367-f899edec6f5f"

Implements review obligation RPF-1.3-T3. Bind the actual generator to the closed railiance-platform.custody-mint.v1 projection and authenticated publication. Capture grant accessor and revocation evidence and revoke the issuer session. Destruction uses attended platform-admin authority and compares the original CAS-0 version-1 creation time, current version and absence of other versions before metadata deletion. No standing family-wide delete grant is introduced. Unavailable authority, uncertain effects or failed revocation remain UNCERTAIN for owner reconciliation. Verify with the frozen adapter, then obtain the required native authority and actual execution receipts.

T04 — Implement and admit the delivery lane and capability

id: RPF-WP-0060-T04
status: todo
priority: high
state_hub_task_id: "84f8b0a4-8450-5623-8608-dc277978383b"

Implements review obligation RPF-1.3-T4. Reuse the fixed proposed issuer Store contract; validate the preexisting Store and only create the case-derived ExternalSecret in sso. Refuse conflicts; report NO_CHANGE only for matching preexisting configuration; establish current Ready status before success. Return the closed metadata-only netkingdom.deliver-secret.v1 receipt and use UID and resourceVersion preconditions to remove only authenticated case-created resources. Never read Secret values or create the Store through this lane.

Bind real human net-kingdom-admins/aal2 admission, per-attempt session and revocation, durable pre-intent/recovery journal and authenticated owner evidence. The separate command-mechanics candidate is preparation, not this capability; its production factory refuses. Review freshness/defaulting/transport failure cases before integrating it. Obtain ops-warden's catalog routing acceptance for platform-secret-delivery through an authorized handoff before recording owner acceptance. No routing handoff or native action is implied by this work record.

The parent stays active until these obligations and their required owner acceptance are proved. Source tests do not complete native acceptance or KEY-WP-0039's negative/expiry/cleanup exercise.