Operator-applied helm upgrade on railiance01 serves CI image main-ad7b7f5,
sha256:bd616cc2efcefa4951156f1fe2a3ead6c8ced76b2f60e0c38cd37ba82e35cbde. Its baked
package is byte-identical to the committed v3, and its own binary computes
package digest sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655,
matching FLEX-DEC-2026-017. The rendered change against revision 2 was one line,
the image; live values equalled this file. Rollout complete, one pod, no restarts.
Not verified: a live check through the enforced caller path, which only
informed-decision's service account can make. Its first real list call is that
check. Rollback is revision 2.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
list is a separate rule with exact-record scope over the union of the eight
sitting records and the three T03 records, each pinned by approval id, digest and
its own memo version, with a 12-hour MFA window. read and the five acts keep the
v2 rule unchanged — same eight records, same 900-second window — so a list allow
satisfies nothing else.
The operator chose exact-record scope over the consumer's preferred type-wide
scope: the PDP checks no recipient, so type-wide scope with a relaxed window would
have left the consumer's structural match — which the consumer itself says is
not an entitlement — as the only scope. The 12-hour bound replaces the requested
"no bound" so the PDP still states one. The KeyCape stale-timestamp defect is not
worked around; read stays strict.
417 evaluator checks: 168 v2 unchanged, 231 list, 18 proving no act widens to the
T03 records. Also fixes tools/exercise_t03_review_policy.py, which had been
failing since f85479c moved the T03 records to memo version 2 and it still sent
version 1. Test-only.
Not deployed: the pin serving the live review surface changes only with operator
confirmation.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
Admitting list is sound in principle — browsing your own outcomes should not
need binding-grade freshness — and holds independent of the KeyCape stale-MFA
defect that exposed it. read is not loosened to work around that defect.
Verified that the v2 sitting rule scopes by exact-record pinning, group and
fresh MFA, and does not check recipient. Option (A) would drop both PDP-side
scopes for list at once and rest the allow on a consumer check the consumer
itself says is not an entitlement. Recommends (B). Scope and freshness bound are
left to the operator, by the precedent of FLEX-WP-0027/0028.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
