codex
e4af2a1d10
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
75 lines
2.4 KiB
Markdown
75 lines
2.4 KiB
Markdown
---
|
|
id: RPF-WP-0019
|
|
type: workplan
|
|
title: "Adopt canonical flex-auth credential-grant checks"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- FLEX-WP-0012
|
|
origin: routed
|
|
origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
|
|
state_hub_workstream_id: "6ded9d76-e3a8-5d52-9221-2c7935f3b364"
|
|
---
|
|
|
|
# RPF-WP-0019 — canonical flex-auth credential-grant checks
|
|
|
|
## Goal
|
|
|
|
Adopt flex-auth's single canonical `POST /v1/check` decision surface for
|
|
credential-grant preflight without exposing credential values or adding a
|
|
consumer-specific flex-auth endpoint.
|
|
|
|
## T01 — Resolve translation ownership
|
|
|
|
```task
|
|
id: RPF-WP-0019-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "9f0c7e4f-6351-51c1-8c5e-39f770668605"
|
|
```
|
|
|
|
The operator explicitly approved Option A in State Hub decision
|
|
`1f9f257d-c9f2-4a5e-a018-8058a3f2a51a`: railiance-platform maps its grant
|
|
metadata to `CheckRequest` and reads `DecisionEnvelope`. Duration parsing and
|
|
normalization belong here, before the flex-auth policy boundary.
|
|
|
|
## T02 — Implement the canonical request and response
|
|
|
|
```task
|
|
id: RPF-WP-0019-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "8c95e2b5-884c-5504-9998-5bdd8ae64b5d"
|
|
```
|
|
|
|
Change the helper default to `/v1/check`, emit the coordinated
|
|
`tenant:platform` / `credential-grant:<id>` / `issue` request vocabulary, send
|
|
`requested_ttl_seconds` as an integer, and accept only `effect: allow`.
|
|
|
|
Completed in source. Actor classes map to canonical subject types (`Human`,
|
|
`Agent`, or `Automation`); the bound subject and non-secret actor metadata are
|
|
carried in context. Missing, deny, redact, audit-only, and not-applicable
|
|
effects all fail closed. An allow also requires a non-empty decision id,
|
|
evaluator provenance, and subject/resource binding back to the request.
|
|
|
|
## T03 — Verify and route the contract
|
|
|
|
```task
|
|
id: RPF-WP-0019-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "9d8c534d-72b7-5cac-ada1-72273fb3ab01"
|
|
```
|
|
|
|
Exercise focused allow and deny tests, validate the complete repository suite,
|
|
and route the adopted mapping to flex-auth without requesting live credentials
|
|
or a production mutation.
|
|
|
|
Completed with 70 focused credential tests, all credential-helper dry-runs,
|
|
credential-catalog validation, and the complete 146-test offline suite passing.
|
|
No flex-auth production endpoint was called and no credential was issued.
|