Admit the compact sitting review package on a dedicated pin.

CI image 8007ede@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba
now serves examples/informed-decision-sitting. T03 deployment is unchanged.
Native caller checks pass with synthetic identities; human bind stays with
INFD-WP-0002.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6

WORK-RECORDS.md

@@ -35,6 +35,7 @@
 | workplan | FLEX-WP-0025 | finished | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
 | workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md |
 | workplan | FLEX-WP-0027 | active | — | workplans/FLEX-WP-0027-t03-human-review.md |
+| workplan | FLEX-WP-0028 | active | — | workplans/FLEX-WP-0028-compact-sitting-review.md |
 | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@@ -158,6 +159,8 @@
 | task | FLEX-WP-0027-T01 | done | — | workplans/FLEX-WP-0027-t03-human-review.md |
 | task | FLEX-WP-0027-T02 | done | — | workplans/FLEX-WP-0027-t03-human-review.md |
 | task | FLEX-WP-0027-T03 | wait | — | workplans/FLEX-WP-0027-t03-human-review.md |
+| task | FLEX-WP-0028-T01 | done | — | workplans/FLEX-WP-0028-compact-sitting-review.md |
+| task | FLEX-WP-0028-T02 | wait | — | workplans/FLEX-WP-0028-compact-sitting-review.md |
 | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
 | decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |

docs/evidence/2026-09-15-sitting-native-review-policy.json

@@ -0,0 +1,62 @@
+{
+  "scope": "native caller and policy with synthetic subject claims; not real human approval; T03 deployment unchanged",
+  "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba",
+  "caller": "system:serviceaccount:informed-decision:review",
+  "service": "flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
+  "checks": [
+    {
+      "case": "admitted-group-c02-accept",
+      "http": 200,
+      "effect": "allow",
+      "reason": "operator_admitted_compact_sitting",
+      "policy_package": "informed-decision.compact-sitting",
+      "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
+      "ok": true
+    },
+    {
+      "case": "unrelated-group-c02-accept",
+      "http": 200,
+      "effect": "deny",
+      "reason": "compact_sitting_scope_or_identity_refused",
+      "policy_package": "informed-decision.compact-sitting",
+      "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
+      "ok": true
+    },
+    {
+      "case": "omitted-c01-accept",
+      "http": 200,
+      "effect": "deny",
+      "reason": "compact_sitting_scope_or_identity_refused",
+      "policy_package": "informed-decision.compact-sitting",
+      "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
+      "ok": true
+    },
+    {
+      "case": "t03-memo-accept",
+      "http": 200,
+      "effect": "deny",
+      "reason": "compact_sitting_scope_or_identity_refused",
+      "policy_package": "informed-decision.compact-sitting",
+      "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
+      "ok": true
+    },
+    {
+      "case": "consume-c02",
+      "http": 200,
+      "effect": "deny",
+      "reason": "compact_sitting_scope_or_identity_refused",
+      "policy_package": "informed-decision.compact-sitting",
+      "policy_package_digest": "sha256:e0afd52e046616a93142f4064704b1cee6496801d94612fce29a958cf04eb41a",
+      "ok": true
+    },
+    {
+      "case": "missing-token",
+      "http": 401,
+      "effect": null,
+      "reason": "unauthenticated\n",
+      "policy_package": null,
+      "policy_package_digest": null,
+      "ok": true
+    }
+  ]
+}

docs/request-enrichment.md

@@ -110,7 +110,7 @@ genuinely the request; **ambiguous** is the T01 input.
 | markitect (example) | subject.groups | membership | allowlist | yes (first-class `groups`) |
 | markitect (example) | subject.roles | membership | allowlist | yes (first-class `roles`) |
 | informed-decision-t03 (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T01 | fixture-only; not a published consumer package |
-| informed-decision-sitting (fixture) | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | new package, not a T03 expansion; unpublished until FLEX-WP-0028-T02 |
+| informed-decision-sitting | subject.assurance, groups, principal_type_source, tenant_source | mixed | see T03 | published pin, not a T03 expansion |
 
 No published-package ceiling or allowlist remains unbacked after the two
 declaration fixes above. `ttl_hours`, `purpose`, `requested_ttl_seconds`, and

values/informed-decision-sitting.yaml

@@ -1,12 +1,10 @@
 # Compact sitting exact-record human review. Distinct from
 # values/informed-decision-t03.yaml / FLEX-WP-0027.
-# image.digest is filled after CI builds the commit that added
+# CI image of 8007ede (examples/informed-decision-sitting).
-# examples/informed-decision-sitting. Do not helm-upgrade until then:
-# the live T03 digest does not contain this package.
 name: flex-auth-informed-decision-sitting
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  digest: sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba
 args:
   - serve
   - --addr

workplans/FLEX-WP-0028-compact-sitting-review.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Admit scoped human review for the seven compact sitting memos"
 domain: infotech
 repo: flex-auth
-status: active
+status: finished
 flavor: implementation
 owner: grok
 topic_slug: netkingdom
@@ -13,6 +13,7 @@ updated: "2026-09-15"
 related_workplans:
   - FLEX-WP-0027
   - INFD-WP-0002
+state_hub_workstream_id: "f7491b94-9f0e-5e5c-a03c-72e70d210807"
 ---
 
 Opened from informed-decision inbox `f266bf8c-072e-4a80-9a6b-ff89ee422d6b`.
@@ -24,6 +25,7 @@ Do not widen `examples/informed-decision-t03` / FLEX-WP-0027.
 id: FLEX-WP-0028-T01
 status: done
 priority: high
+state_hub_task_id: "c9c28feb-d735-55a1-adc5-d229ab630f59"
 ```
 
 Pins from `docs/evidence/2026-09-15-sitting-approval-creates.json`.
@@ -38,13 +40,16 @@ Receipt: `docs/evidence/2026-09-15-sitting-review-policy.json`.
 
 ```task
 id: FLEX-WP-0028-T02
-status: wait
+status: done
 priority: high
+state_hub_task_id: "2d9be9d6-b8a0-5018-b5f5-524e72fc6239"
 ```
 
-Wait for CI to publish an image that contains `examples/informed-decision-sitting`,
+Dedicated release revision 1 uses CI image of `8007ede`,
-then pin `values/informed-decision-sitting.yaml` by digest and helm-upgrade a
+`sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba`.
-new release. Do not reuse the T03 image or change the T03 Deployment.
+Service `flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080`.
 TokenReview admits only `system:serviceaccount:informed-decision:review`.
-Native caller checks with synthetic identities are required before calling
+T03 Deployment image and generation unchanged. Six native caller checks pass
-this admitted. Human bind stays with INFD-WP-0002.
+with synthetic identities (allow c02, deny wrong group / c01 / T03 memo /
+consume, 401 without token). Human bind stays with INFD-WP-0002.
+Receipt: `docs/evidence/2026-09-15-sitting-native-review-policy.json`.