tegwick
11453682cf
CI image 8007ede@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba now serves examples/informed-decision-sitting. T03 deployment is unchanged. Native caller checks pass with synthetic identities; human bind stays with INFD-WP-0002. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
55 lines
1.9 KiB
Markdown
55 lines
1.9 KiB
Markdown
---
|
|
id: FLEX-WP-0028
|
|
type: workplan
|
|
title: "Admit scoped human review for the seven compact sitting memos"
|
|
domain: infotech
|
|
repo: flex-auth
|
|
status: finished
|
|
flavor: implementation
|
|
owner: grok
|
|
topic_slug: netkingdom
|
|
created: "2026-09-15"
|
|
updated: "2026-09-15"
|
|
related_workplans:
|
|
- FLEX-WP-0027
|
|
- INFD-WP-0002
|
|
state_hub_workstream_id: "f7491b94-9f0e-5e5c-a03c-72e70d210807"
|
|
---
|
|
|
|
Opened from informed-decision inbox `f266bf8c-072e-4a80-9a6b-ff89ee422d6b`.
|
|
Do not widen `examples/informed-decision-t03` / FLEX-WP-0027.
|
|
|
|
## Compile the seven-record sitting mandate
|
|
|
|
```task
|
|
id: FLEX-WP-0028-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c9c28feb-d735-55a1-adc5-d229ab630f59"
|
|
```
|
|
|
|
Pins from `docs/evidence/2026-09-15-sitting-approval-creates.json`.
|
|
`examples/informed-decision-sitting` binds the seven native approval ids and
|
|
digests. `memo:infd-20260914-c01` is omitted. Same identity bar as T03.
|
|
147 evaluator checks pass (42 allow / 105 deny), including omitted c01, T03
|
|
memo ids, consume, and identity refusals. T03's 57 checks still pass.
|
|
Reproduce with `python3 tools/exercise_sitting_review_policy.py --binary /path/to/flex-auth --receipt /tmp/sitting-checks.json`.
|
|
Receipt: `docs/evidence/2026-09-15-sitting-review-policy.json`.
|
|
|
|
## Deploy the isolated caller-bound policy
|
|
|
|
```task
|
|
id: FLEX-WP-0028-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "2d9be9d6-b8a0-5018-b5f5-524e72fc6239"
|
|
```
|
|
|
|
Dedicated release revision 1 uses CI image of `8007ede`,
|
|
`sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba`.
|
|
Service `flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080`.
|
|
TokenReview admits only `system:serviceaccount:informed-decision:review`.
|
|
T03 Deployment image and generation unchanged. Six native caller checks pass
|
|
with synthetic identities (allow c02, deny wrong group / c01 / T03 memo /
|
|
consume, 401 without token). Human bind stays with INFD-WP-0002.
|
|
Receipt: `docs/evidence/2026-09-15-sitting-native-review-policy.json`.
|