flex-auth/workplans/FLEX-WP-0032-informed-decision-list-action.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	planning_priority	planning_order	related_workplans	created	updated	state_hub_workstream_id
FLEX-WP-0032	workplan	Admit a list action for the informed-decision overview without handing the scope to the consumer	infotech	flex-auth	finished	implementation	claude	netkingdom	P1	320	FLEX-WP-0027 FLEX-WP-0028	2026-09-21	2026-09-21	ab21b09f-2cb5-5d31-866d-11f02f13f3d8

FLEX-WP-0032 — list for the informed-decision decision overview

Opened from informed-decision intake INFD-IN-0008 (INFD-WP-0004-T02), hub message a7b9ef3b-f95c-4c50-bfc5-7628d16881f6. Full request: informed-decision/docs/flex-auth-request-list-action.md @ 98c8de0.

What is asked

A new action, list, on decision-memo resources of system informed-decision: the same identity bar as read minus the 900-second MFA freshness window, over the memos of both admitted packages, shipped as v3 of informed-decision.compact-sitting. A list allow shows only memo id, version and question, the live approval status, and the person's own responses. It never shows brief or packet and never enables an act. read and every act stay as in v2.

Why the request is sound in principle

Looking back at your own outcomes is a different act from binding a new one, and should not need binding-grade freshness. That holds on its own, independent of the KeyCape defect that exposed it (INFD-IN-0005: KeyCape copies the previous session's MFA timestamp even after an actual MFA, so at understates freshness). The bug is key-cape's to fix; read is not loosened to work around it. Loosening a binding bar to compensate for a claim defect would be the PDP silently absorbing an identity-layer fault.

What the PDP checks today — verified

The v2 sitting rule (examples/informed-decision-sitting/policy.md:76) scopes a decision with three things: exact-record pinning (memo id → approval id and binding digest), group net-kingdom-admins, and fresh AAL2 MFA. It does not check that the memo is addressed to the subject. Recipient scoping today comes from the operator's admission and the consumer's structural match.

The two scope options

• (A) resource-type-wide. Any decision-memo of informed-decision in tenant:platform. Removes exact-record pinning for list — and together with the dropped freshness window, removes both PDP-side scopes at once. The only thing between a group member and every memo's question and status would be consumer code; flex-auth would record allow for memos never admitted by anyone and not addressed to the subject. The consumer's own document says its structural match "is not an entitlement". A PDP cannot rest an allow on a check the consumer disclaims.
• (B) exact-record union. The eight sitting records plus the three T03 records, pinned by approval id and binding digest as today. The PDP keeps its own scope. Costs a package version per sitting — which is the property, not the cost: a new memo becomes listable when someone admitted it.

Recommendation: (B).

Open decisions (operator)

1. Scope — (A) or (B). Recommended (B), for the reason above.
2. Freshness for list — unbounded as asked, a longer bounded window, or decline. Unbounded means an MFA of any age satisfies list as long as the consumer presents a key-cape session; the PDP would state no bound at all.

Both are operator decisions by precedent: the reviewer identity bar on this surface was admitted by the operator (FLEX-WP-0027-T01, FLEX-WP-0028).

1. Record the decision

id: FLEX-WP-0032-T01
status: done
priority: high
state_hub_task_id: "f741d47e-50b9-5eb1-81d9-ffec847be77a"

Owner: operator decides; flex-auth records as a FLEX-DEC.

2026-09-21: done. Operator chose (B) exact-record and a 12-hour MFA window for list. Recorded as FLEX-DEC-2026-017.

2. Compile compact-sitting v3

id: FLEX-WP-0032-T02
status: done
priority: high
state_hub_task_id: "a24fc5cf-f663-5338-97da-169af7fb47fb"

Owner: flex-auth.

• New list rule; read and all five acts byte-identical in effect to v2.
• Under (B), per-record memo_version: the three T03 records are at version 2 (f85479c), the sitting records at 1. The v2 rule's global memo_version == 1 cannot be reused for the union.
• list never satisfies any act: a separate rule, not an extra action in the existing allow set.
• A version bump, per FLEX-DEC-2026-008: a widened bar must be visible to the consumer as a version change.

2026-09-21: done. v3, digest sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655. The v2 act rule is kept unchanged so its effect cannot drift; list is a separate else branch. T03 pins in examples/informed-decision-sitting/list_only_records.json, copied from the T03 package's records.

3. Fixtures and the exercise receipt

id: FLEX-WP-0032-T03
status: done
priority: high
state_hub_task_id: "984f11f4-6ec9-5f7d-840b-4dee2e121212"

Owner: flex-auth, with informed-decision's fixtures.

At minimum: stale MFA allowed for list, refused for read; no group refused; agent refused; principal_type_source other than authentication-derived refused; under (B), an unlisted memo refused and each T03 record listable at version 2 only. Every v2 check must still pass unchanged — the existing 147 sitting checks and T03's 57.

Gate: flex-auth validate, test-policy, and the exercise scripts green; a receipt in docs/evidence/.

2026-09-21: done. 417 checks (168 v2 unchanged, 231 list, 18 no-act-widening), receipt docs/evidence/2026-09-21-sitting-review-policy-v3.json; validate and three Rego tests green; T03's 57 pass.

Found on the way: tools/exercise_t03_review_policy.py had been failing since f85479c moved the T03 records to memo version 2 — it still sent version 1, so the reproduce command FLEX-WP-0027-T01 cites was broken. Fixed to read each record's own version. Test-only; no policy change.

4. Publish and hand back

id: FLEX-WP-0032-T04
status: done
priority: medium
state_hub_task_id: "2a296df6-1d39-5b3e-9312-8e791a6ccbd0"

Owner: flex-auth publishes the package, version and digest; informed-decision updates its admission input. Deploying the pin is a production change to a live human-review surface and is confirmed with the operator before it runs.

2026-09-21: done. Operator confirmed and applied the upgrade: release flex-auth-informed-decision-sitting revision 3 on railiance01, image main-ad7b7f5 = sha256:bd616cc2efcefa4951156f1fe2a3ead6c8ced76b2f60e0c38cd37ba82e35cbde.

Verified before rollout: the image's baked package is byte-identical to the committed v3; the image's own binary computes package digest sha256:dd40c80c5719851737178097cdee65afac108b54e19c07370e549b860f1a9655; live release values equalled the committed file; the rendered diff against revision 2 was exactly one line, the image digest. Verified after: rollout complete, one pod Running on bd616cc2…, zero restarts.

Not verified: a live /v1/check through the enforced caller path. The pin admits only informed-decision's service account, and minting its token to test as it is not ours to do. informed-decision's first real list call is that check, and a mismatch there is a finding. Rollback: helm rollback flex-auth-informed-decision-sitting 2 -n flex-auth.