coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/workplans/RAILIANCE-WP-0028-flex-auth-credential-grant-integration.md
codex c9d02147d3
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Adopt canonical flex-auth credential checks 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093
2026-08-23 14:03:40 +02:00

2.2 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated related origin origin_ref
RAILIANCE-WP-0028 workplan Adopt canonical flex-auth credential-grant checks financials railiance-platform finished codex railiance 2026-08-23 2026-08-23
FLEX-WP-0012
routed State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a

RAILIANCE-WP-0028 — canonical flex-auth credential-grant checks

Goal

Adopt flex-auth's single canonical POST /v1/check decision surface for credential-grant preflight without exposing credential values or adding a consumer-specific flex-auth endpoint.

T01 — Resolve translation ownership

id: RAILIANCE-WP-0028-T01
status: done
priority: high

The operator explicitly approved Option A in State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a: railiance-platform maps its grant metadata to CheckRequest and reads DecisionEnvelope. Duration parsing and normalization belong here, before the flex-auth policy boundary.

T02 — Implement the canonical request and response

id: RAILIANCE-WP-0028-T02
status: done
priority: high

Change the helper default to /v1/check, emit the coordinated tenant:platform / credential-grant:<id> / issue request vocabulary, send requested_ttl_seconds as an integer, and accept only effect: allow.

Completed in source. Actor classes map to canonical subject types (Human, Agent, or Automation); the bound subject and non-secret actor metadata are carried in context. Missing, deny, redact, audit-only, and not-applicable effects all fail closed. An allow also requires a non-empty decision id, evaluator provenance, and subject/resource binding back to the request.

T03 — Verify and route the contract

id: RAILIANCE-WP-0028-T03
status: done
priority: medium

Exercise focused allow and deny tests, validate the complete repository suite, and route the adopted mapping to flex-auth without requesting live credentials or a production mutation.

Completed with 70 focused credential tests, all credential-helper dry-runs, credential-catalog validation, and the complete 146-test offline suite passing. No flex-auth production endpoint was called and no credential was issued.