railiance-platform/workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	origin	origin_ref	state_hub_workstream_id
RPF-WP-0026	workplan	Adopt canonical flex-auth credential-grant checks	financials	railiance-platform	finished	codex	railiance	2026-08-23	2026-08-23	FLEX-WP-0012	routed	State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a	7677326a-04db-52ef-b05c-967dabe1759e

RPF-WP-0026 — canonical flex-auth credential-grant checks

Goal

Adopt flex-auth's single canonical POST /v1/check decision surface for credential-grant preflight without exposing credential values or adding a consumer-specific flex-auth endpoint.

T01 — Resolve translation ownership

id: RPF-WP-0026-T01
status: done
priority: high
state_hub_task_id: "07f3fead-76d6-5e53-9a7b-9930560182d9"

The operator explicitly approved Option A in State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a: railiance-platform maps its grant metadata to CheckRequest and reads DecisionEnvelope. Duration parsing and normalization belong here, before the flex-auth policy boundary.

T02 — Implement the canonical request and response

id: RPF-WP-0026-T02
status: done
priority: high
state_hub_task_id: "659ac0ee-c2b7-56fc-80d8-92b2fcf30e7b"

Change the helper default to /v1/check, emit the coordinated tenant:platform / credential-grant:<id> / issue request vocabulary, send requested_ttl_seconds as an integer, and accept only effect: allow.

Completed in source. Actor classes map to canonical subject types (Human, Agent, or Automation); the bound subject and non-secret actor metadata are carried in context. Missing, deny, redact, audit-only, and not-applicable effects all fail closed. An allow also requires a non-empty decision id, evaluator provenance, and subject/resource binding back to the request.

T03 — Verify and route the contract

id: RPF-WP-0026-T03
status: done
priority: medium
state_hub_task_id: "8f6b7481-e8c2-56eb-98b5-c49cae562d60"

Exercise focused allow and deny tests, validate the complete repository suite, and route the adopted mapping to flex-auth without requesting live credentials or a production mutation.

Completed with 70 focused credential tests, all credential-helper dry-runs, credential-catalog validation, and the complete 146-test offline suite passing. No flex-auth production endpoint was called and no credential was issued.