Prepare receipt-bound audit E2 third attempt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

src/whitehat_security/cli.py

@@ -14,7 +14,7 @@ from .engagement import AuthorizationError, Engagement
 from .fixtures import FixtureService, probe_suite
 from .model import RunReport, utc_now
 from .plane import KillSwitch, admit, default_broker, retired_ids
-from .platform_custody import broker_from_receipt
+from .platform_custody import broker_from_receipt, finalize_run_report
 from .reporting import queue_risk_nexus, risk_nexus_message
 from .targets import load_catalog, load_registration
 
@@ -100,6 +100,12 @@ def main(argv: list[str] | None = None) -> None:
         "--broker-receipt",
         help="WP-0025 broker-readiness receipt; required for railiance.custody-projection-receipt",
     )
+    finalize = commands.add_parser("finalize-report")
+    finalize.add_argument("report")
+    finalize.add_argument("--contract", required=True)
+    finalize.add_argument("--receipt", required=True)
+    finalize.add_argument("--cleanup-receipt", required=True)
+    finalize.add_argument("--output", required=True)
     commands.add_parser("kill-switch")
     deliver = commands.add_parser("deliver")
     deliver.add_argument("report")
@@ -171,6 +177,27 @@ def main(argv: list[str] | None = None) -> None:
             raise SystemExit(1)
         print("clear")
         return
+    if args.command == "finalize-report":
+        try:
+            report = json.loads(Path(args.report).read_text(encoding="utf-8"))
+            contract = json.loads(Path(args.contract).read_text(encoding="utf-8"))
+            projection = json.loads(Path(args.receipt).read_text(encoding="utf-8"))
+            cleanup = json.loads(Path(args.cleanup_receipt).read_text(encoding="utf-8"))
+            finalized = finalize_run_report(
+                report, projection=projection, cleanup=cleanup, contract=contract
+            )
+            RunReport(**finalized)
+            output = Path(args.output)
+            output.parent.mkdir(parents=True, exist_ok=True)
+            output.write_text(
+                json.dumps(finalized, indent=2, sort_keys=True) + "\n",
+                encoding="utf-8",
+            )
+        except (AuthorizationError, OSError, ValueError, json.JSONDecodeError, TypeError) as error:
+            print(f"not authorized: {error}", file=sys.stderr)
+            raise SystemExit(2) from None
+        print(f"finalized: {output}")
+        return
     if args.command == "deliver":
         try:
             report = RunReport(**json.loads(Path(args.report).read_text(encoding="utf-8")))

src/whitehat_security/platform_custody.py

@@ -331,6 +331,32 @@ def validate_cleanup_receipt(
     return document
 
 
+def finalize_run_report(
+    report: dict[str, Any], *, projection: dict[str, Any],
+    cleanup: dict[str, Any], contract: dict[str, Any]
+) -> dict[str, Any]:
+    """Bind a sanitized runner report to the canonical custody cleanup."""
+    validate_projection_contract(contract)
+    validate_projection_receipt(projection, contract=contract)
+    validate_cleanup_receipt(cleanup, projection=projection, contract=contract)
+    if report.get("engagement_id") != contract["engagement_id"]:
+        raise AuthorizationError("run report engagement does not match custody contract")
+    if report.get("target") != contract["target"]["id"]:
+        raise AuthorizationError("run report target does not match custody contract")
+    if report.get("target_revision") != contract["target"]["image_digest"]:
+        raise AuthorizationError("run report revision does not match custody contract")
+    result = dict(report)
+    result["cleanup"] = (
+        "WP-0025 receipt-bound cleanup completed at "
+        f"{cleanup['cleaned_at']} for projection {projection['receipt_id']}"
+    )
+    result["credential_revocation"] = (
+        "revoked by railiance-platform custody cleanup for lease "
+        f"{projection['lease_id']}"
+    )
+    return result
+
+
 def validate_broker_readiness(
     document: dict[str, Any], *, contract: dict[str, Any], now: datetime | None = None
 ) -> dict[str, Any]: