whitehat-security/workplans/WHITEHAT-WP-0004-canonical-custody-binding.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
WHITEHAT-WP-0004	workplan	Bind the WP-0025 adapter to canonical, fail-closed custody receipts	infotech	whitehat-security	finished	net-kingdom	whitehat-security	2026-08-22	2026-08-22	WHITEHAT-WP-0003 RAILIANCE-WP-0025	779ad220-2ce3-5117-aec8-bb4a97d43d98

WHITEHAT-WP-0004 — canonical custody binding

Goal

Close the Railiance WP-0025 owner review of adapter 1a38080 / HEAD da6f5fb: the consumer discovered the four schemas and its focused tests passed, but it was not fail-closed or canonically bound. A live projection receipt must not admit a plane lease unless it matches a supplied projection contract.

This plan authorizes no engagement, runner, credential, or traffic.

Origin

Platform progress d1fce546 (2026-08-22T20:09:59Z) on RAILIANCE-WP-0025 T03: noncanonical receipt_id, projection_contract_digest not derived from the supplied contract, incomplete resource UIDs accepted, runtime --contract optional, and receipt validation unbound from target, identities, resources, broker digest, times, and canonical receipt id.

Tasks

T01 — Require a contract and bind the receipt canonically

id: WHITEHAT-WP-0004-T01
status: done
priority: high
state_hub_task_id: "e3cf7d58-de89-5f6f-b411-297418bdd79a"

PlatformCustodyBroker and admit-plane refuse a WP-0025 projection receipt without --contract. Validation derives the contract digest, requires the canonical receipt_id, and binds target, identities, resource names, the three Kubernetes UIDs, broker digest, and projection/expiry times. The focused adapter tests reject each of those fail-open cases.