coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md
codex e4af2a1d10
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
fix(workplans): migrate active workplans off the retired RAILIANCE-WP prefix 
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix
registry already lists it retired). Three repositories independently used one
number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here,
a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This
repository also carried two files both numbered 0016.

Active workplans move to the successor prefix and are renumbered from 0001 in
historical order. Archived workplans keep their historical identifiers.

Projection UUIDs are re-derived from the new canonical ids. Records already
registered under the old identifiers leave orphaned hub rows behind; that debt
is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands.

Refs CUST-WP-0068-T03

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 22:58:35 +02:00

2.4 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated related origin origin_ref state_hub_workstream_id
RPF-WP-0019 workplan Adopt canonical flex-auth credential-grant checks financials railiance-platform finished codex railiance 2026-08-23 2026-08-23
FLEX-WP-0012
routed State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a 6ded9d76-e3a8-5d52-9221-2c7935f3b364

RPF-WP-0019 — canonical flex-auth credential-grant checks

Goal

Adopt flex-auth's single canonical POST /v1/check decision surface for credential-grant preflight without exposing credential values or adding a consumer-specific flex-auth endpoint.

T01 — Resolve translation ownership

id: RPF-WP-0019-T01
status: done
priority: high
state_hub_task_id: "9f0c7e4f-6351-51c1-8c5e-39f770668605"

The operator explicitly approved Option A in State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a: railiance-platform maps its grant metadata to CheckRequest and reads DecisionEnvelope. Duration parsing and normalization belong here, before the flex-auth policy boundary.

T02 — Implement the canonical request and response

id: RPF-WP-0019-T02
status: done
priority: high
state_hub_task_id: "8c95e2b5-884c-5504-9998-5bdd8ae64b5d"

Change the helper default to /v1/check, emit the coordinated tenant:platform / credential-grant:<id> / issue request vocabulary, send requested_ttl_seconds as an integer, and accept only effect: allow.

Completed in source. Actor classes map to canonical subject types (Human, Agent, or Automation); the bound subject and non-secret actor metadata are carried in context. Missing, deny, redact, audit-only, and not-applicable effects all fail closed. An allow also requires a non-empty decision id, evaluator provenance, and subject/resource binding back to the request.

T03 — Verify and route the contract

id: RPF-WP-0019-T03
status: done
priority: medium
state_hub_task_id: "9d8c534d-72b7-5cac-ada1-72273fb3ab01"

Exercise focused allow and deny tests, validate the complete repository suite, and route the adopted mapping to flex-auth without requesting live credentials or a production mutation.

Completed with 70 focused credential tests, all credential-helper dry-runs, credential-catalog validation, and the complete 146-test offline suite passing. No flex-auth production endpoint was called and no credential was issued.