Admit the 2026-09-21 budget memo as compact sitting v2
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 3s
Build and Publish Container Image / build-and-push (push) Successful in 1m22s

v2 adds exactly memo:infd-20260921-b01 (SECRETS-WP-0009-T03 spend
envelope) with native pins from the sitting-create receipt; the seven v1
records and the identity bar are unchanged. The exercise reads the policy
version from the package. 168 local evaluator checks pass (147 prior + 21).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 272244@bnt-lap001
Assistant-Session: c8962fa7-b290-47df-865f-403ddb6c77e9
This commit is contained in:
tegwick 2026-09-21 19:09:17 +02:00
parent 067d93a1e0
commit 4f66c4d6cf
5 changed files with 746 additions and 2 deletions

View file

@ -0,0 +1,41 @@
{
"observed_at": "2026-09-21T17:07:04.289175+00:00",
"status": "created",
"phase": "seven_unapproved_requests_created",
"requests": [
{
"memo_id": "infd-20260921-b01",
"approval": {
"binding": {
"action": "accept",
"actor": "informed-decision",
"digest": "sha256:e9eaf454e94871ec2060855fcfbd327bcaec873d2c61cae031bec9f95a34bcae",
"human_control": true,
"pdp_digest": null,
"pdp_path": false,
"principal": "helixforge-factory",
"purpose": "Accept the spend envelope for metered Glas runs on the Anthropic key",
"target": {
"id": "spend-envelope:hfact-glas-anthropic-2026-09",
"system": "rein-aharness",
"type": "spend-envelope"
}
},
"created_at": "2026-09-21T17:07:08+00:00",
"entries": [],
"id": "ba5ce2d8-8b6d-40be-af89-2e8c147029a3",
"required_count": 1,
"status": "requested",
"superseded_by": null,
"updated_at": "2026-09-21T17:07:08+00:00",
"validity": {
"expires_at": "2026-09-22T17:07:05.525777+00:00",
"not_before": "2026-09-21T17:07:05.525777+00:00"
}
}
}
],
"credential_values_emitted": false,
"human_entries_created": false,
"skipped": []
}

View file

@ -0,0 +1,677 @@
{
"scope": "local actual evaluator with synthetic identity; no live human approvals; T03 package untouched",
"checks": [
{
"check": "c02:read",
"effect": "allow"
},
{
"check": "c02:acknowledge",
"effect": "allow"
},
{
"check": "c02:accept",
"effect": "allow"
},
{
"check": "c02:return",
"effect": "allow"
},
{
"check": "c02:discuss",
"effect": "allow"
},
{
"check": "c02:decline",
"effect": "allow"
},
{
"check": "c02:wrong-group",
"effect": "deny"
},
{
"check": "c02:no-group",
"effect": "deny"
},
{
"check": "c02:service",
"effect": "deny"
},
{
"check": "c02:stale-mfa",
"effect": "deny"
},
{
"check": "c02:future-mfa",
"effect": "deny"
},
{
"check": "c02:no-mfa",
"effect": "deny"
},
{
"check": "c02:forged-human-route",
"effect": "deny"
},
{
"check": "c02:wrong-tenant",
"effect": "deny"
},
{
"check": "c02:other-memo",
"effect": "deny"
},
{
"check": "c02:omitted-c01",
"effect": "deny"
},
{
"check": "c02:t03-memo",
"effect": "deny"
},
{
"check": "c02:changed-version",
"effect": "deny"
},
{
"check": "c02:changed-approval",
"effect": "deny"
},
{
"check": "c02:changed-digest",
"effect": "deny"
},
{
"check": "c02:consume",
"effect": "deny"
},
{
"check": "c03:read",
"effect": "allow"
},
{
"check": "c03:acknowledge",
"effect": "allow"
},
{
"check": "c03:accept",
"effect": "allow"
},
{
"check": "c03:return",
"effect": "allow"
},
{
"check": "c03:discuss",
"effect": "allow"
},
{
"check": "c03:decline",
"effect": "allow"
},
{
"check": "c03:wrong-group",
"effect": "deny"
},
{
"check": "c03:no-group",
"effect": "deny"
},
{
"check": "c03:service",
"effect": "deny"
},
{
"check": "c03:stale-mfa",
"effect": "deny"
},
{
"check": "c03:future-mfa",
"effect": "deny"
},
{
"check": "c03:no-mfa",
"effect": "deny"
},
{
"check": "c03:forged-human-route",
"effect": "deny"
},
{
"check": "c03:wrong-tenant",
"effect": "deny"
},
{
"check": "c03:other-memo",
"effect": "deny"
},
{
"check": "c03:omitted-c01",
"effect": "deny"
},
{
"check": "c03:t03-memo",
"effect": "deny"
},
{
"check": "c03:changed-version",
"effect": "deny"
},
{
"check": "c03:changed-approval",
"effect": "deny"
},
{
"check": "c03:changed-digest",
"effect": "deny"
},
{
"check": "c03:consume",
"effect": "deny"
},
{
"check": "c04:read",
"effect": "allow"
},
{
"check": "c04:acknowledge",
"effect": "allow"
},
{
"check": "c04:accept",
"effect": "allow"
},
{
"check": "c04:return",
"effect": "allow"
},
{
"check": "c04:discuss",
"effect": "allow"
},
{
"check": "c04:decline",
"effect": "allow"
},
{
"check": "c04:wrong-group",
"effect": "deny"
},
{
"check": "c04:no-group",
"effect": "deny"
},
{
"check": "c04:service",
"effect": "deny"
},
{
"check": "c04:stale-mfa",
"effect": "deny"
},
{
"check": "c04:future-mfa",
"effect": "deny"
},
{
"check": "c04:no-mfa",
"effect": "deny"
},
{
"check": "c04:forged-human-route",
"effect": "deny"
},
{
"check": "c04:wrong-tenant",
"effect": "deny"
},
{
"check": "c04:other-memo",
"effect": "deny"
},
{
"check": "c04:omitted-c01",
"effect": "deny"
},
{
"check": "c04:t03-memo",
"effect": "deny"
},
{
"check": "c04:changed-version",
"effect": "deny"
},
{
"check": "c04:changed-approval",
"effect": "deny"
},
{
"check": "c04:changed-digest",
"effect": "deny"
},
{
"check": "c04:consume",
"effect": "deny"
},
{
"check": "d01:read",
"effect": "allow"
},
{
"check": "d01:acknowledge",
"effect": "allow"
},
{
"check": "d01:accept",
"effect": "allow"
},
{
"check": "d01:return",
"effect": "allow"
},
{
"check": "d01:discuss",
"effect": "allow"
},
{
"check": "d01:decline",
"effect": "allow"
},
{
"check": "d01:wrong-group",
"effect": "deny"
},
{
"check": "d01:no-group",
"effect": "deny"
},
{
"check": "d01:service",
"effect": "deny"
},
{
"check": "d01:stale-mfa",
"effect": "deny"
},
{
"check": "d01:future-mfa",
"effect": "deny"
},
{
"check": "d01:no-mfa",
"effect": "deny"
},
{
"check": "d01:forged-human-route",
"effect": "deny"
},
{
"check": "d01:wrong-tenant",
"effect": "deny"
},
{
"check": "d01:other-memo",
"effect": "deny"
},
{
"check": "d01:omitted-c01",
"effect": "deny"
},
{
"check": "d01:t03-memo",
"effect": "deny"
},
{
"check": "d01:changed-version",
"effect": "deny"
},
{
"check": "d01:changed-approval",
"effect": "deny"
},
{
"check": "d01:changed-digest",
"effect": "deny"
},
{
"check": "d01:consume",
"effect": "deny"
},
{
"check": "d02:read",
"effect": "allow"
},
{
"check": "d02:acknowledge",
"effect": "allow"
},
{
"check": "d02:accept",
"effect": "allow"
},
{
"check": "d02:return",
"effect": "allow"
},
{
"check": "d02:discuss",
"effect": "allow"
},
{
"check": "d02:decline",
"effect": "allow"
},
{
"check": "d02:wrong-group",
"effect": "deny"
},
{
"check": "d02:no-group",
"effect": "deny"
},
{
"check": "d02:service",
"effect": "deny"
},
{
"check": "d02:stale-mfa",
"effect": "deny"
},
{
"check": "d02:future-mfa",
"effect": "deny"
},
{
"check": "d02:no-mfa",
"effect": "deny"
},
{
"check": "d02:forged-human-route",
"effect": "deny"
},
{
"check": "d02:wrong-tenant",
"effect": "deny"
},
{
"check": "d02:other-memo",
"effect": "deny"
},
{
"check": "d02:omitted-c01",
"effect": "deny"
},
{
"check": "d02:t03-memo",
"effect": "deny"
},
{
"check": "d02:changed-version",
"effect": "deny"
},
{
"check": "d02:changed-approval",
"effect": "deny"
},
{
"check": "d02:changed-digest",
"effect": "deny"
},
{
"check": "d02:consume",
"effect": "deny"
},
{
"check": "d03:read",
"effect": "allow"
},
{
"check": "d03:acknowledge",
"effect": "allow"
},
{
"check": "d03:accept",
"effect": "allow"
},
{
"check": "d03:return",
"effect": "allow"
},
{
"check": "d03:discuss",
"effect": "allow"
},
{
"check": "d03:decline",
"effect": "allow"
},
{
"check": "d03:wrong-group",
"effect": "deny"
},
{
"check": "d03:no-group",
"effect": "deny"
},
{
"check": "d03:service",
"effect": "deny"
},
{
"check": "d03:stale-mfa",
"effect": "deny"
},
{
"check": "d03:future-mfa",
"effect": "deny"
},
{
"check": "d03:no-mfa",
"effect": "deny"
},
{
"check": "d03:forged-human-route",
"effect": "deny"
},
{
"check": "d03:wrong-tenant",
"effect": "deny"
},
{
"check": "d03:other-memo",
"effect": "deny"
},
{
"check": "d03:omitted-c01",
"effect": "deny"
},
{
"check": "d03:t03-memo",
"effect": "deny"
},
{
"check": "d03:changed-version",
"effect": "deny"
},
{
"check": "d03:changed-approval",
"effect": "deny"
},
{
"check": "d03:changed-digest",
"effect": "deny"
},
{
"check": "d03:consume",
"effect": "deny"
},
{
"check": "d04:read",
"effect": "allow"
},
{
"check": "d04:acknowledge",
"effect": "allow"
},
{
"check": "d04:accept",
"effect": "allow"
},
{
"check": "d04:return",
"effect": "allow"
},
{
"check": "d04:discuss",
"effect": "allow"
},
{
"check": "d04:decline",
"effect": "allow"
},
{
"check": "d04:wrong-group",
"effect": "deny"
},
{
"check": "d04:no-group",
"effect": "deny"
},
{
"check": "d04:service",
"effect": "deny"
},
{
"check": "d04:stale-mfa",
"effect": "deny"
},
{
"check": "d04:future-mfa",
"effect": "deny"
},
{
"check": "d04:no-mfa",
"effect": "deny"
},
{
"check": "d04:forged-human-route",
"effect": "deny"
},
{
"check": "d04:wrong-tenant",
"effect": "deny"
},
{
"check": "d04:other-memo",
"effect": "deny"
},
{
"check": "d04:omitted-c01",
"effect": "deny"
},
{
"check": "d04:t03-memo",
"effect": "deny"
},
{
"check": "d04:changed-version",
"effect": "deny"
},
{
"check": "d04:changed-approval",
"effect": "deny"
},
{
"check": "d04:changed-digest",
"effect": "deny"
},
{
"check": "d04:consume",
"effect": "deny"
},
{
"check": "b01:read",
"effect": "allow"
},
{
"check": "b01:acknowledge",
"effect": "allow"
},
{
"check": "b01:accept",
"effect": "allow"
},
{
"check": "b01:return",
"effect": "allow"
},
{
"check": "b01:discuss",
"effect": "allow"
},
{
"check": "b01:decline",
"effect": "allow"
},
{
"check": "b01:wrong-group",
"effect": "deny"
},
{
"check": "b01:no-group",
"effect": "deny"
},
{
"check": "b01:service",
"effect": "deny"
},
{
"check": "b01:stale-mfa",
"effect": "deny"
},
{
"check": "b01:future-mfa",
"effect": "deny"
},
{
"check": "b01:no-mfa",
"effect": "deny"
},
{
"check": "b01:forged-human-route",
"effect": "deny"
},
{
"check": "b01:wrong-tenant",
"effect": "deny"
},
{
"check": "b01:other-memo",
"effect": "deny"
},
{
"check": "b01:omitted-c01",
"effect": "deny"
},
{
"check": "b01:t03-memo",
"effect": "deny"
},
{
"check": "b01:changed-version",
"effect": "deny"
},
{
"check": "b01:changed-approval",
"effect": "deny"
},
{
"check": "b01:changed-digest",
"effect": "deny"
},
{
"check": "b01:consume",
"effect": "deny"
}
]
}

View file

@ -2,7 +2,7 @@
id: informed-decision.compact-sitting id: informed-decision.compact-sitting
name: Compact sitting exact-record human review name: Compact sitting exact-record human review
namespace: informed-decision:decision-memo namespace: informed-decision:decision-memo
version: v1 version: v2
status: ready status: ready
package: flexauth.informed_decision.compact_sitting package: flexauth.informed_decision.compact_sitting
allow_ttl: 30s allow_ttl: 30s
@ -19,6 +19,10 @@ activation:
# Compact sitting review mandate # Compact sitting review mandate
This is a new exact-record package for seven 2026-09-14 sitting memos. This is a new exact-record package for seven 2026-09-14 sitting memos.
v2 (2026-09-21) adds exactly one record, `memo:infd-20260921-b01` (the
SECRETS-WP-0009-T03 spend envelope), with native pins from informed-decision
`docs/evidence/2026-09-21-budget-approval-create.json`. The seven v1 records
and the identity bar are unchanged.
It is not an expansion of `examples/informed-decision-t03` / FLEX-WP-0027. It is not an expansion of `examples/informed-decision-t03` / FLEX-WP-0027.
`memo:infd-20260914-c01` is omitted (create-client still undecided). `memo:infd-20260914-c01` is omitted (create-client still undecided).
@ -62,6 +66,10 @@ records := {
"memo:infd-20260914-d04": { "memo:infd-20260914-d04": {
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5", "approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4" "binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4"
},
"memo:infd-20260921-b01": {
"approval_id": "ba5ce2d8-8b6d-40be-af89-2e8c147029a3",
"binding_digest": "sha256:e9eaf454e94871ec2060855fcfbd327bcaec873d2c61cae031bec9f95a34bcae"
} }
} }

View file

@ -117,5 +117,22 @@
} }
}, },
"memo_version": 1 "memo_version": 1
},
"memo:infd-20260921-b01": {
"approval_id": "ba5ce2d8-8b6d-40be-af89-2e8c147029a3",
"binding_digest": "sha256:e9eaf454e94871ec2060855fcfbd327bcaec873d2c61cae031bec9f95a34bcae",
"label": "b01",
"binding": {
"action": "accept",
"actor": "informed-decision",
"principal": "helixforge-factory",
"purpose": "Accept the spend envelope for metered Glas runs on the Anthropic key",
"target": {
"id": "spend-envelope:hfact-glas-anthropic-2026-09",
"type": "spend-envelope",
"system": "rein-aharness"
}
},
"memo_version": 1
} }
} }

View file

@ -8,6 +8,7 @@ p.add_argument('--receipt', type=Path, required=True)
args = p.parse_args() args = p.parse_args()
r = Path(__file__).resolve().parents[1] / 'examples/informed-decision-sitting' r = Path(__file__).resolve().parents[1] / 'examples/informed-decision-sitting'
records = json.loads((r / 'records.json').read_text()) records = json.loads((r / 'records.json').read_text())
version = next(l.split(':', 1)[1].strip() for l in (r / 'policy.md').read_text().splitlines() if l.startswith('version:'))
results = [] results = []
with tempfile.TemporaryDirectory() as temp: with tempfile.TemporaryDirectory() as temp:
request_path = Path(temp) / 'request.json' request_path = Path(temp) / 'request.json'
@ -57,7 +58,7 @@ with tempfile.TemporaryDirectory() as temp:
'approval_id': record['approval_id'], 'approval_id': record['approval_id'],
'approval_binding_digest': record['binding_digest'], 'approval_binding_digest': record['binding_digest'],
}, },
'policy_version': 'v1', 'policy_version': version,
} }
label = record['label'] label = record['label']
for action in ['read', 'acknowledge', 'accept', 'return', 'discuss', 'decline']: for action in ['read', 'acknowledge', 'accept', 'return', 'discuss', 'decline']: