Bind WP-0025 receipts to a canonical projection contract

Railiance's WP-0025 review found the first adapter fail-open: --contract
was optional, receipt_id was not canonical, and target, identities,
resources, UIDs, broker digest and times were unbound. Require the
contract and refuse any receipt that is not the platform canonical form.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

workplans/WHITEHAT-WP-0004-canonical-custody-binding.md

@@ -0,0 +1,51 @@
+---
+id: WHITEHAT-WP-0004
+type: workplan
+title: "Bind the WP-0025 adapter to canonical, fail-closed custody receipts"
+domain: infotech
+repo: whitehat-security
+status: finished
+owner: net-kingdom
+topic_slug: whitehat-security
+created: "2026-08-22"
+updated: "2026-08-22"
+related:
+  - WHITEHAT-WP-0003
+  - RAILIANCE-WP-0025
+---
+
+# WHITEHAT-WP-0004 — canonical custody binding
+
+## Goal
+
+Close the Railiance WP-0025 owner review of adapter `1a38080` / HEAD
+`da6f5fb`: the consumer discovered the four schemas and its focused tests
+passed, but it was not fail-closed or canonically bound. A live projection
+receipt must not admit a plane lease unless it matches a supplied projection
+contract.
+
+This plan authorizes no engagement, runner, credential, or traffic.
+
+## Origin
+
+Platform progress `d1fce546` (2026-08-22T20:09:59Z) on RAILIANCE-WP-0025 T03:
+noncanonical `receipt_id`, `projection_contract_digest` not derived from the
+supplied contract, incomplete resource UIDs accepted, runtime `--contract`
+optional, and receipt validation unbound from target, identities, resources,
+broker digest, times, and canonical receipt id.
+
+## Tasks
+
+### T01 — Require a contract and bind the receipt canonically
+
+```task
+id: WHITEHAT-WP-0004-T01
+status: done
+priority: high
+```
+
+`PlatformCustodyBroker` and `admit-plane` refuse a WP-0025 projection receipt
+without `--contract`. Validation derives the contract digest, requires the
+canonical `receipt_id`, and binds target, identities, resource names, the
+three Kubernetes UIDs, broker digest, and projection/expiry times. The focused
+adapter tests reject each of those fail-open cases.