whitehat-security/workplans/WHITEHAT-WP-0005-broker-receipt-admission.md

---
id: WHITEHAT-WP-0005
type: workplan
title: "Require a WP-0025 broker receipt at plane admission"
domain: infotech
repo: whitehat-security
status: finished
owner: net-kingdom
topic_slug: whitehat-security
created: "2026-08-22"
updated: "2026-09-01"
related:
  - WHITEHAT-WP-0004
  - RAILIANCE-WP-0025
state_hub_workstream_id: "d37a91f7-7002-53bc-a23d-d60f91c10a59"
quality_dod: DoD-Ok
quality_dod_at: "2026-09-01"
quality_dod_by: grok
quality_dod_note: "T01–T02 done; broker receipt required at admit-plane and runner reports bind cleanup. Authorizes no traffic."
---

# WHITEHAT-WP-0005 — broker receipt admission

## Goal

Close the remaining WP-0025 operational binding from platform review
`cb6620f` / `5a0eb6b`: a projection receipt must not admit a plane lease
unless the caller also supplies the broker-readiness receipt whose digest
equals `broker_receipt_digest`.

This plan authorizes no engagement, runner, credential, or traffic.

## Origin

Platform progress at 2026-08-22T20:26:00Z: `PlatformCustodyBroker` checks
the broker digest only when optional `broker=` is supplied;
`broker_from_receipt` / `admit-plane` expose no broker-receipt input. A
recanonicalized projection receipt with a substituted all-zero broker
digest was accepted on the operational constructor path.

## Tasks

### T01 — Required `--broker-receipt` and CLI fail-closed coverage

```task
id: WHITEHAT-WP-0005-T01
status: done
priority: high
state_hub_task_id: "a6209f8a-b767-5ce8-8842-c9e454977f83"
```

Add required `--broker-receipt` for WP-0025 admission, pass it through
`broker_from_receipt`, and require exact digest equality. CLI tests cover
a missing broker receipt and a mismatched recanonicalized digest.

### T02 — Bind runner authorization and final report to cleanup

```task
id: WHITEHAT-WP-0005-T02
status: done
priority: high
state_hub_task_id: "a3255581-af7d-5a9c-bc46-b9fe980fb326"
```


Fresh-run setup found two remaining operational misbindings. The audit-core
runner hard-coded the authorization id from the original 2026-08-21 attempt,
and its sanitized report could only say credential cleanup was pending.

The runner now requires `--authorization-id` and carries that exact value into
the report. `finalize-report` validates the WP-0025 projection contract,
projection receipt, and cleanup receipt, binds their engagement, target, image,
lease, and canonical receipt id to the runner report, and only then records
custody revocation as complete. Mismatched reports fail closed.