Admit T03 version-two reviews while preserving current sitting records

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

Containerfile.t03-review

@@ -0,0 +1,2 @@
+FROM forgejo.coulomb.social/coulomb/flex-auth@sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c
+COPY examples/informed-decision-t03 /opt/flex-auth/examples/informed-decision-t03

docs/evidence/2026-09-16-t03-renewal-policy-checks.json

@@ -0,0 +1,385 @@
+{
+  "t03": {
+    "scope": "native caller and policy with synthetic subject claims; not real human approval",
+    "checks": [
+      {
+        "action": "apply",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "apply",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "verify",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "verify",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "exec",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "exec",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      }
+    ]
+  },
+  "preserved_sitting": {
+    "scope": "native caller and policy with synthetic subject claims; not real human approval",
+    "checks": [
+      {
+        "action": "memo:infd-20260914-c02",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-c02",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-c03",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-c03",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-c04",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-c04",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d01",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d01",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d02",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d02",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d03",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d03",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d04",
+        "case": "admitted-group",
+        "effect": "allow",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      },
+      {
+        "action": "memo:infd-20260914-d04",
+        "case": "unrelated-group",
+        "effect": "deny",
+        "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
+        "caller": "system:serviceaccount:informed-decision:review"
+      }
+    ]
+  },
+  "local": {
+    "scope": "local actual evaluator with synthetic identity; no live human approvals",
+    "checks": [
+      {
+        "check": "apply:read",
+        "effect": "allow"
+      },
+      {
+        "check": "apply:acknowledge",
+        "effect": "allow"
+      },
+      {
+        "check": "apply:accept",
+        "effect": "allow"
+      },
+      {
+        "check": "apply:return",
+        "effect": "allow"
+      },
+      {
+        "check": "apply:discuss",
+        "effect": "allow"
+      },
+      {
+        "check": "apply:decline",
+        "effect": "allow"
+      },
+      {
+        "check": "apply:wrong-group",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:no-group",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:service",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:stale-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:future-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:no-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:forged-human-route",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:wrong-tenant",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:other-memo",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:changed-version",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:changed-approval",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:changed-digest",
+        "effect": "deny"
+      },
+      {
+        "check": "apply:consume",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:read",
+        "effect": "allow"
+      },
+      {
+        "check": "verify:acknowledge",
+        "effect": "allow"
+      },
+      {
+        "check": "verify:accept",
+        "effect": "allow"
+      },
+      {
+        "check": "verify:return",
+        "effect": "allow"
+      },
+      {
+        "check": "verify:discuss",
+        "effect": "allow"
+      },
+      {
+        "check": "verify:decline",
+        "effect": "allow"
+      },
+      {
+        "check": "verify:wrong-group",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:no-group",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:service",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:stale-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:future-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:no-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:forged-human-route",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:wrong-tenant",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:other-memo",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:changed-version",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:changed-approval",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:changed-digest",
+        "effect": "deny"
+      },
+      {
+        "check": "verify:consume",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:read",
+        "effect": "allow"
+      },
+      {
+        "check": "exec:acknowledge",
+        "effect": "allow"
+      },
+      {
+        "check": "exec:accept",
+        "effect": "allow"
+      },
+      {
+        "check": "exec:return",
+        "effect": "allow"
+      },
+      {
+        "check": "exec:discuss",
+        "effect": "allow"
+      },
+      {
+        "check": "exec:decline",
+        "effect": "allow"
+      },
+      {
+        "check": "exec:wrong-group",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:no-group",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:service",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:stale-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:future-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:no-mfa",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:forged-human-route",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:wrong-tenant",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:other-memo",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:changed-version",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:changed-approval",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:changed-digest",
+        "effect": "deny"
+      },
+      {
+        "check": "exec:consume",
+        "effect": "deny"
+      }
+    ]
+  }
+}

examples/informed-decision-t03/policy.md

@@ -2,7 +2,7 @@
 id: informed-decision.t03-review
 name: T03 exact OpenRouter lifecycle human review
 namespace: informed-decision:decision-memo
-version: v1
+version: v2
 status: ready
 package: flexauth.informed_decision.t03_review
 allow_ttl: 30s
@@ -19,7 +19,10 @@ activation:
 # Operator-admitted T03 review mandate
 
 Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind
-permission for only these three exact T03 records. The authenticated
+permission for only the three exact T03 records. The seven already-admitted
+compact-sitting records are preserved verbatim at memo version 1 because the
+shared review service currently serves that mandate. T03 renewals require
+memo version 2; no existing approval or human entry is copied. The authenticated
 informed-decision caller imports signed KeyCape groups and MFA facts.
 No permission follows from memo content or presentation state. The independent
 caller binding must be enforced by TokenReview before this package is served.
@@ -32,16 +35,54 @@ import rego.v1
 
 records := {
   "memo:SECRETS-WP-0010-T03-apply": {
-    "approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
+    "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
-    "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5"
+    "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
+    "memo_version": 2
   },
   "memo:SECRETS-WP-0010-T03-verify": {
-    "approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
+    "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
-    "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2"
+    "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
+    "memo_version": 2
   },
   "memo:SECRETS-WP-0010-T03-exec": {
-    "approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
+    "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
-    "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8"
+    "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
+    "memo_version": 2
+  },
+  "memo:infd-20260914-c02": {
+    "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
+    "binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a",
+    "memo_version": 1
+  },
+  "memo:infd-20260914-c03": {
+    "approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
+    "binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844",
+    "memo_version": 1
+  },
+  "memo:infd-20260914-c04": {
+    "approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
+    "binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192",
+    "memo_version": 1
+  },
+  "memo:infd-20260914-d01": {
+    "approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
+    "binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15",
+    "memo_version": 1
+  },
+  "memo:infd-20260914-d02": {
+    "approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
+    "binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f",
+    "memo_version": 1
+  },
+  "memo:infd-20260914-d03": {
+    "approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
+    "binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425",
+    "memo_version": 1
+  },
+  "memo:infd-20260914-d04": {
+    "approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
+    "binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4",
+    "memo_version": 1
   }
 }
 
@@ -68,7 +109,7 @@ decision := {"effect": "allow", "reason": "operator_admitted_t03_review"} if {
   input.resource.system == "informed-decision"
   input.resource.type == "decision-memo"
   record := records[input.resource.id]
-  input.context.memo_version == 1
+  input.context.memo_version == record.memo_version
   input.context.approval_id == record.approval_id
   input.context.approval_binding_digest == record.binding_digest
   input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}

examples/informed-decision-t03/records.json

@@ -1,6 +1,6 @@
 {
   "memo:SECRETS-WP-0010-T03-apply": {
-    "approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
+    "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
     "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
     "action": "apply",
     "binding": {
@@ -24,10 +24,10 @@
         }
       }
     },
-    "memo_version": 1
+    "memo_version": 2
   },
   "memo:SECRETS-WP-0010-T03-verify": {
-    "approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
+    "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
     "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
     "action": "verify",
     "binding": {
@@ -53,10 +53,10 @@
         }
       }
     },
-    "memo_version": 1
+    "memo_version": 2
   },
   "memo:SECRETS-WP-0010-T03-exec": {
-    "approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
+    "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
     "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
     "action": "exec",
     "binding": {
@@ -82,6 +82,6 @@
         }
       }
     },
-    "memo_version": 1
+    "memo_version": 2
   }
 }

values/informed-decision-t03.yaml

@@ -2,7 +2,7 @@
 name: flex-auth-informed-decision-t03
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
-  digest: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c
+  digest: sha256:e9ade12f1ee3130b4e8d9796d993b2c7234ef51d4fa38981c949802c1422f824
 args:
   - serve
   - --addr