---
id: WHITEHAT-WP-0004
type: workplan
title: "Bind the WP-0025 adapter to canonical, fail-closed custody receipts"
domain: infotech
repo: whitehat-security
status: finished
owner: net-kingdom
topic_slug: whitehat-security
created: "2026-08-22"
updated: "2026-09-01"
related:
  - WHITEHAT-WP-0003
  - RAILIANCE-WP-0025
state_hub_workstream_id: "779ad220-2ce3-5117-aec8-bb4a97d43d98"
quality_dod: DoD-Ok
quality_dod_at: "2026-09-01"
quality_dod_by: grok
quality_dod_note: "T01 done; WP-0025 receipts fail closed without a matching projection contract. Authorizes no traffic."
---

# WHITEHAT-WP-0004 — canonical custody binding

## Goal

Close the Railiance WP-0025 owner review of adapter `1a38080` / HEAD
`da6f5fb`: the consumer discovered the four schemas and its focused tests
passed, but it was not fail-closed or canonically bound. A live projection
receipt must not admit a plane lease unless it matches a supplied projection
contract.

This plan authorizes no engagement, runner, credential, or traffic.

## Origin

Platform progress `d1fce546` (2026-08-22T20:09:59Z) on RAILIANCE-WP-0025 T03:
noncanonical `receipt_id`, `projection_contract_digest` not derived from the
supplied contract, incomplete resource UIDs accepted, runtime `--contract`
optional, and receipt validation unbound from target, identities, resources,
broker digest, times, and canonical receipt id.

## Tasks

### T01 — Require a contract and bind the receipt canonically

```task
id: WHITEHAT-WP-0004-T01
status: done
priority: high
state_hub_task_id: "e3cf7d58-de89-5f6f-b411-297418bdd79a"
```

`PlatformCustodyBroker` and `admit-plane` refuse a WP-0025 projection receipt
without `--contract`. Validation derives the contract digest, requires the
canonical `receipt_id`, and binds target, identities, resource names, the
three Kubernetes UIDs, broker digest, and projection/expiry times. The focused
adapter tests reject each of those fail-open cases.