Open FLEX-WP-0032 for informed-decision's list-action request.

Admitting list is sound in principle — browsing your own outcomes should not
need binding-grade freshness — and holds independent of the KeyCape stale-MFA
defect that exposed it. read is not loosened to work around that defect.

Verified that the v2 sitting rule scopes by exact-record pinning, group and
fresh MFA, and does not check recipient. Option (A) would drop both PDP-side
scopes for list at once and rest the allow on a consumer check the consumer
itself says is not an entitlement. Recommends (B). Scope and freshness bound are
left to the operator, by the precedent of FLEX-WP-0027/0028.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d

workplans/FLEX-WP-0032-informed-decision-list-action.md

@@ -0,0 +1,139 @@
+---
+id: FLEX-WP-0032
+type: workplan
+title: "Admit a list action for the informed-decision overview without handing the scope to the consumer"
+domain: infotech
+repo: flex-auth
+status: proposed
+flavor: implementation
+owner: claude
+topic_slug: netkingdom
+planning_priority: P1
+planning_order: 320
+related_workplans:
+  - FLEX-WP-0027
+  - FLEX-WP-0028
+created: "2026-09-21"
+updated: "2026-09-21"
+---
+
+# FLEX-WP-0032 — `list` for the informed-decision decision overview
+
+Opened from informed-decision intake `INFD-IN-0008` (`INFD-WP-0004-T02`), hub
+message `a7b9ef3b-f95c-4c50-bfc5-7628d16881f6`. Full request:
+`informed-decision/docs/flex-auth-request-list-action.md` @ `98c8de0`.
+
+## What is asked
+
+A new action, `list`, on `decision-memo` resources of system
+`informed-decision`: the same identity bar as `read` **minus the 900-second MFA
+freshness window**, over the memos of **both** admitted packages, shipped as v3
+of `informed-decision.compact-sitting`. A `list` allow shows only memo id,
+version and question, the live approval status, and the person's own responses.
+It never shows brief or packet and never enables an act. `read` and every act
+stay as in v2.
+
+## Why the request is sound in principle
+
+Looking back at your own outcomes is a different act from binding a new one, and
+should not need binding-grade freshness. That holds on its own, **independent of
+the KeyCape defect** that exposed it (`INFD-IN-0005`: KeyCape copies the previous
+session's MFA timestamp even after an actual MFA, so `at` understates freshness).
+The bug is key-cape's to fix; `read` is **not** loosened to work around it.
+Loosening a binding bar to compensate for a claim defect would be the PDP
+silently absorbing an identity-layer fault.
+
+## What the PDP checks today — verified
+
+The v2 sitting rule (`examples/informed-decision-sitting/policy.md:76`) scopes a
+decision with three things: exact-record pinning (memo id → approval id and
+binding digest), group `net-kingdom-admins`, and fresh AAL2 MFA. It does **not**
+check that the memo is addressed to the subject. Recipient scoping today comes
+from the operator's admission and the consumer's structural match.
+
+## The two scope options
+
+- **(A) resource-type-wide.** Any `decision-memo` of `informed-decision` in
+  `tenant:platform`. Removes exact-record pinning for `list` — and together with
+  the dropped freshness window, removes **both** PDP-side scopes at once. The
+  only thing between a group member and every memo's question and status would
+  be consumer code; flex-auth would record `allow` for memos never admitted by
+  anyone and not addressed to the subject. The consumer's own document says its
+  structural match "is not an entitlement". A PDP cannot rest an allow on a check
+  the consumer disclaims.
+- **(B) exact-record union.** The eight sitting records plus the three T03
+  records, pinned by approval id and binding digest as today. The PDP keeps its
+  own scope. Costs a package version per sitting — which is the property, not
+  the cost: a new memo becomes listable when someone admitted it.
+
+Recommendation: **(B)**.
+
+## Open decisions (operator)
+
+1. **Scope** — (A) or (B). Recommended (B), for the reason above.
+2. **Freshness for `list`** — unbounded as asked, a longer bounded window, or
+   decline. Unbounded means an MFA of any age satisfies `list` as long as the
+   consumer presents a key-cape session; the PDP would state no bound at all.
+
+Both are operator decisions by precedent: the reviewer identity bar on this
+surface was admitted by the operator (`FLEX-WP-0027-T01`, `FLEX-WP-0028`).
+
+## 1. Record the decision
+
+```task
+id: FLEX-WP-0032-T01
+status: wait
+priority: high
+```
+
+Owner: operator decides; `flex-auth` records as a `FLEX-DEC`.
+
+## 2. Compile compact-sitting v3
+
+```task
+id: FLEX-WP-0032-T02
+status: todo
+priority: high
+```
+
+Owner: `flex-auth`.
+
+- New `list` rule; `read` and all five acts byte-identical in effect to v2.
+- Under (B), per-record `memo_version`: the three T03 records are at version 2
+  (`f85479c`), the sitting records at 1. The v2 rule's global
+  `memo_version == 1` cannot be reused for the union.
+- `list` never satisfies any act: a separate rule, not an extra action in the
+  existing allow set.
+- A version bump, per `FLEX-DEC-2026-008`: a widened bar must be visible to the
+  consumer as a version change.
+
+## 3. Fixtures and the exercise receipt
+
+```task
+id: FLEX-WP-0032-T03
+status: todo
+priority: high
+```
+
+Owner: `flex-auth`, with informed-decision's fixtures.
+
+At minimum: stale MFA allowed for `list`, refused for `read`; no group refused;
+agent refused; `principal_type_source` other than `authentication-derived`
+refused; under (B), an unlisted memo refused and each T03 record listable at
+version 2 only. Every v2 check must still pass unchanged — the existing 147
+sitting checks and T03's 57.
+
+Gate: `flex-auth validate`, `test-policy`, and the exercise scripts green; a
+receipt in `docs/evidence/`.
+
+## 4. Publish and hand back
+
+```task
+id: FLEX-WP-0032-T04
+status: todo
+priority: medium
+```
+
+Owner: `flex-auth` publishes the package, version and digest; informed-decision
+updates its admission input. **Deploying the pin is a production change to a
+live human-review surface and is confirmed with the operator before it runs.**