informed-decision/workplans/INFD-WP-0004-comfortable-decision-review.md

---
id: INFD-WP-0004
type: workplan
title: "Comfortable decision review — a `list` action for the overview"
domain: infotech
repo: informed-decision
status: active
owner: claude
topic_slug: netkingdom
created: "2026-09-21"
updated: "2026-09-21"
related:
  - INFD-WP-0003
  - INFD-IN-0005
  - INFD-IN-0008
origin: demand
origin_ref: "founder 2026-09-21: 'We should be able to review comfortably though.'"
state_hub_workstream_id: "2a57162a-85ad-5fd6-87d5-1e89ae2e0782"
---

# Comfortable decision review

The `INFD-WP-0003` overview is live, but in production every row shows "The
permission service refused access", even after a fresh sign-in. Each row asks
Flex Auth for `read`. The served `informed-decision.compact-sitting` v2
package gates `read` with a bar designed for binding:

- The rule requires `assurance.at` to be at most 900 seconds old. KeyCape
  carries earlier authentication timestamps forward (`INFD-IN-0005`), so a
  browsing session rarely meets it.
- The package does not name the three `SECRETS-WP-0010-T03-*` memos at all.

The founder wants to be able to review decisions comfortably. The plan is to
split *seeing your decisions* from *reviewing one for binding*:

- Add a new consumer action, `list`, with limited disclosure. It has a
  comfortable identity bar, and flex-auth admits it.
- `read` and every act keep their strict bar.

## Establish why today's rows are refused

```task
id: INFD-WP-0004-T01
status: done
priority: high
state_hub_task_id: "513e91cf-6063-5a39-9f4d-af3976bb29a8"
```

Waiting on the operator's read-only query of the live `policy_observations`:
`auth_age_s`, groups, level and methods for the latest checks. If the age is
over 900, `INFD-IN-0005` is confirmed as the cause for the eight sitting memos.
If a group, level or method differs from the rule, that is a separate identity
regression and needs fixing regardless of `list`. Record the finding under
`docs/evidence/`.

**Finding (2026-09-21):** only freshness fails. `auth_age_at_check_s` was
1744 against 900, and groups, sources, level and methods all match. See
`docs/evidence/2026-09-21-overview-read-refusal.json`.

## Request the `list` policy from flex-auth

```task
id: INFD-WP-0004-T02
status: wait
priority: high
state_hub_task_id: "3d5f51ac-c226-5489-bfb6-d5829c70e6f6"
```

The request is drafted in `docs/flex-auth-request-list-action.md` and recorded
as `INFD-IN-0008`, owned by flex-auth. Sent 2026-09-21 to the flex-auth inbox
(message `a7b9ef3b-f95c-4c50-bfc5-7628d16881f6`); waiting on flex-auth. Done when flex-auth publishes a package, version
and digest that answers `list`, with fixtures.

## Consumer side: `list` action and limited-disclosure overview

```task
id: INFD-WP-0004-T03
status: done
priority: high
state_hub_task_id: "e13ef7d2-bac0-5e2b-930d-4368e77bf1cb"
```

- Add `list` to `policy.ACTIONS` and to `docs/flex-auth-review-contract.md`.
- The overview asks `list` per row instead of `read`. It renders only the memo
  id and version, the question, the live engine status, and the person's own
  responses (verb, version, time and submission state; no notes).
- The review page keeps `read`, and every act keeps its own action.
- Tests: `list` allowed while `read` is denied still shows the rows, and
  opening one is still refused; a `list` deny redacts the row; no brief,
  packet or notes leak on the home page.

This task can be built and tested against fixtures before T02 lands, but it
must not be deployed before T02. The live v2 package denies `list`, so
deploying early would change nothing visible.

**Done 2026-09-21:** the source is ready and not deployed. There are 436
tests. The fixture Flex Auth package adds `list`, and its re-derived pin has
digest `sha256:f45e366d…`. Chromium passes 13 of 13 through the real Flex Auth.

## Admit and roll out

```task
id: INFD-WP-0004-T04
status: wait
priority: high
state_hub_task_id: "65d6dd6e-208a-54ee-93c0-40b6ab1d8adf"
```

After T02, update `deploy/sitting-admission.json` with the new package,
version and digest. The operator then applies the configuration and the image
built from T03. Verify that the overview shows all eleven memos without a fresh
MFA, that opening a memo still enforces the strict `read` rule, and record the
rollout in `docs/evidence/`.