Compile compact sitting review package without widening T03.

Seven exact-record pins from the 2026-09-15 sitting-create receipt.
c01 is omitted. Identity bar matches T03. 147 local evaluator checks
pass. Deploy waits on a CI image that contains the new package.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6

examples/informed-decision-sitting/policy.md

@@ -0,0 +1,108 @@
+---
+id: informed-decision.compact-sitting
+name: Compact sitting exact-record human review
+namespace: informed-decision:decision-memo
+version: v1
+status: ready
+package: flexauth.informed_decision.compact_sitting
+allow_ttl: 30s
+actions: [read, acknowledge, accept, return, discuss, decline]
+owner: flex-auth
+fixtures: [fixtures.json]
+caring:
+  profile: caring-0.4.0-rc2
+  enforce: false
+activation:
+  mode: local
+---
+
+# Compact sitting review mandate
+
+This is a new exact-record package for seven 2026-09-14 sitting memos.
+It is not an expansion of `examples/informed-decision-t03` / FLEX-WP-0027.
+`memo:infd-20260914-c01` is omitted (create-client still undecided).
+
+The identity bar matches T03: authenticated informed-decision caller,
+`net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
+memo content or presentation state. TokenReview must admit
+`system:serviceaccount:informed-decision:review` before this package is
+served. Membership tenant provenance may follow the accepted registration
+route; it does not assert directory membership in tenant:platform.
+Only a real human uses accept. This package neither issues nor consumes
+approval. Native pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`.
+
+```rego
+import rego.v1
+
+records := {
+  "memo:infd-20260914-c02": {
+    "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
+    "binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
+  },
+  "memo:infd-20260914-c03": {
+    "approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
+    "binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844"
+  },
+  "memo:infd-20260914-c04": {
+    "approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
+    "binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192"
+  },
+  "memo:infd-20260914-d01": {
+    "approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
+    "binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15"
+  },
+  "memo:infd-20260914-d02": {
+    "approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
+    "binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f"
+  },
+  "memo:infd-20260914-d03": {
+    "approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
+    "binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425"
+  },
+  "memo:infd-20260914-d04": {
+    "approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
+    "binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4"
+  }
+}
+
+decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if {
+  input.tenant == "tenant:platform"
+  input.subject.tenant == "tenant:platform"
+  input.subject.type == "human"
+  is_string(input.subject.id)
+  input.subject.id != ""
+  input.subject.attributes.principal_type_source == "authentication-derived"
+  input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
+  "net-kingdom-admins" in input.subject.attributes.groups
+  assurance := input.subject.attributes.assurance
+  assurance.level == "aal2"
+  assurance.mfa == true
+  assurance.source == "key-cape"
+  assurance.methods == ["pwd", "otp"]
+  is_number(assurance.at)
+  assurance.at > 0
+  age := time.now_ns() / 1000000000 - assurance.at
+  age >= -30
+  age <= 900
+  input.resource.tenant == "tenant:platform"
+  input.resource.system == "informed-decision"
+  input.resource.type == "decision-memo"
+  record := records[input.resource.id]
+  input.context.memo_version == 1
+  input.context.approval_id == record.approval_id
+  input.context.approval_binding_digest == record.binding_digest
+  input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
+} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if {
+  true
+}
+```
+
+```rego test
+package flexauth.informed_decision.compact_sitting_test
+import rego.v1
+import data.flexauth.informed_decision.compact_sitting
+
+test_unknown_request_denied if {
+  compact_sitting.decision.effect == "deny" with input as {}
+}
+```