---
id: WHITEHAT-WP-0005
type: workplan
title: "Require a WP-0025 broker receipt at plane admission"
domain: infotech
repo: whitehat-security
status: finished
owner: net-kingdom
topic_slug: whitehat-security
created: "2026-08-22"
updated: "2026-08-22"
related:
  - WHITEHAT-WP-0004
  - RAILIANCE-WP-0025
state_hub_workstream_id: "d37a91f7-7002-53bc-a23d-d60f91c10a59"
---

# WHITEHAT-WP-0005 — broker receipt admission

## Goal

Close the remaining WP-0025 operational binding from platform review
`cb6620f` / `5a0eb6b`: a projection receipt must not admit a plane lease
unless the caller also supplies the broker-readiness receipt whose digest
equals `broker_receipt_digest`.

This plan authorizes no engagement, runner, credential, or traffic.

## Origin

Platform progress at 2026-08-22T20:26:00Z: `PlatformCustodyBroker` checks
the broker digest only when optional `broker=` is supplied;
`broker_from_receipt` / `admit-plane` expose no broker-receipt input. A
recanonicalized projection receipt with a substituted all-zero broker
digest was accepted on the operational constructor path.

## Tasks

### T01 — Required `--broker-receipt` and CLI fail-closed coverage

```task
id: WHITEHAT-WP-0005-T01
status: done
priority: high
state_hub_task_id: "a6209f8a-b767-5ce8-8842-c9e454977f83"
```

Add required `--broker-receipt` for WP-0025 admission, pass it through
`broker_from_receipt`, and require exact digest equality. CLI tests cover
a missing broker receipt and a mismatched recanonicalized digest.