whitehat-security/workplans/WHITEHAT-WP-0005-broker-receipt-admission.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
WHITEHAT-WP-0005	workplan	Require a WP-0025 broker receipt at plane admission	infotech	whitehat-security	finished	net-kingdom	whitehat-security	2026-08-22	2026-08-22	WHITEHAT-WP-0004 RAILIANCE-WP-0025	d37a91f7-7002-53bc-a23d-d60f91c10a59

WHITEHAT-WP-0005 — broker receipt admission

Goal

Close the remaining WP-0025 operational binding from platform review cb6620f / 5a0eb6b: a projection receipt must not admit a plane lease unless the caller also supplies the broker-readiness receipt whose digest equals broker_receipt_digest.

This plan authorizes no engagement, runner, credential, or traffic.

Origin

Platform progress at 2026-08-22T20:26:00Z: PlatformCustodyBroker checks the broker digest only when optional broker= is supplied; broker_from_receipt / admit-plane expose no broker-receipt input. A recanonicalized projection receipt with a substituted all-zero broker digest was accepted on the operational constructor path.

Tasks

T01 — Required --broker-receipt and CLI fail-closed coverage

id: WHITEHAT-WP-0005-T01
status: done
priority: high
state_hub_task_id: "a6209f8a-b767-5ce8-8842-c9e454977f83"

Add required --broker-receipt for WP-0025 admission, pass it through broker_from_receipt, and require exact digest equality. CLI tests cover a missing broker receipt and a mismatched recanonicalized digest.

T02 — Bind runner authorization and final report to cleanup

id: WHITEHAT-WP-0005-T02
status: done
priority: high

Fresh-run setup found two remaining operational misbindings. The audit-core runner hard-coded the authorization id from the original 2026-08-21 attempt, and its sanitized report could only say credential cleanup was pending.

The runner now requires --authorization-id and carries that exact value into the report. finalize-report validates the WP-0025 projection contract, projection receipt, and cleanup receipt, binds their engagement, target, image, lease, and canonical receipt id to the runner report, and only then records custody revocation as complete. Mismatched reports fail closed.