Compile compact sitting review package without widening T03.

Seven exact-record pins from the 2026-09-15 sitting-create receipt.
c01 is omitted. Identity bar matches T03. 147 local evaluator checks
pass. Deploy waits on a CI image that contains the new package.

Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6

workplans/FLEX-WP-0028-compact-sitting-review.md

@@ -0,0 +1,50 @@
+---
+id: FLEX-WP-0028
+type: workplan
+title: "Admit scoped human review for the seven compact sitting memos"
+domain: infotech
+repo: flex-auth
+status: active
+flavor: implementation
+owner: grok
+topic_slug: netkingdom
+created: "2026-09-15"
+updated: "2026-09-15"
+related_workplans:
+  - FLEX-WP-0027
+  - INFD-WP-0002
+---
+
+Opened from informed-decision inbox `f266bf8c-072e-4a80-9a6b-ff89ee422d6b`.
+Do not widen `examples/informed-decision-t03` / FLEX-WP-0027.
+
+## Compile the seven-record sitting mandate
+
+```task
+id: FLEX-WP-0028-T01
+status: done
+priority: high
+```
+
+Pins from `docs/evidence/2026-09-15-sitting-approval-creates.json`.
+`examples/informed-decision-sitting` binds the seven native approval ids and
+digests. `memo:infd-20260914-c01` is omitted. Same identity bar as T03.
+147 evaluator checks pass (42 allow / 105 deny), including omitted c01, T03
+memo ids, consume, and identity refusals. T03's 57 checks still pass.
+Reproduce with `python3 tools/exercise_sitting_review_policy.py --binary /path/to/flex-auth --receipt /tmp/sitting-checks.json`.
+Receipt: `docs/evidence/2026-09-15-sitting-review-policy.json`.
+
+## Deploy the isolated caller-bound policy
+
+```task
+id: FLEX-WP-0028-T02
+status: wait
+priority: high
+```
+
+Wait for CI to publish an image that contains `examples/informed-decision-sitting`,
+then pin `values/informed-decision-sitting.yaml` by digest and helm-upgrade a
+new release. Do not reuse the T03 image or change the T03 Deployment.
+TokenReview admits only `system:serviceaccount:informed-decision:review`.
+Native caller checks with synthetic identities are required before calling
+this admitted. Human bind stays with INFD-WP-0002.