Require a WP-0025 broker receipt at admit-plane

Platform reproduced a recanonicalized projection receipt with a
substituted all-zero broker digest on the operational path. WP-0025
admission now requires --broker-receipt, threads it through
broker_from_receipt, and refuses unless the digest matches exactly.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

workplans/WHITEHAT-WP-0005-broker-receipt-admission.md

@@ -0,0 +1,48 @@
+---
+id: WHITEHAT-WP-0005
+type: workplan
+title: "Require a WP-0025 broker receipt at plane admission"
+domain: infotech
+repo: whitehat-security
+status: finished
+owner: net-kingdom
+topic_slug: whitehat-security
+created: "2026-08-22"
+updated: "2026-08-22"
+related:
+  - WHITEHAT-WP-0004
+  - RAILIANCE-WP-0025
+---
+
+# WHITEHAT-WP-0005 — broker receipt admission
+
+## Goal
+
+Close the remaining WP-0025 operational binding from platform review
+`cb6620f` / `5a0eb6b`: a projection receipt must not admit a plane lease
+unless the caller also supplies the broker-readiness receipt whose digest
+equals `broker_receipt_digest`.
+
+This plan authorizes no engagement, runner, credential, or traffic.
+
+## Origin
+
+Platform progress at 2026-08-22T20:26:00Z: `PlatformCustodyBroker` checks
+the broker digest only when optional `broker=` is supplied;
+`broker_from_receipt` / `admit-plane` expose no broker-receipt input. A
+recanonicalized projection receipt with a substituted all-zero broker
+digest was accepted on the operational constructor path.
+
+## Tasks
+
+### T01 — Required `--broker-receipt` and CLI fail-closed coverage
+
+```task
+id: WHITEHAT-WP-0005-T01
+status: done
+priority: high
+```
+
+Add required `--broker-receipt` for WP-0025 admission, pass it through
+`broker_from_receipt`, and require exact digest equality. CLI tests cover
+a missing broker receipt and a mismatched recanonicalized digest.