101 lines
3.4 KiB
Markdown
101 lines
3.4 KiB
Markdown
|
---
|
||
|
|
id: INFD-WP-0004
|
||
|
|
type: workplan
|
||
|
|
title: "Comfortable decision review — a `list` action for the overview"
|
||
|
|
domain: infotech
|
||
|
|
repo: informed-decision
|
||
|
|
status: active
|
||
|
|
owner: claude
|
||
|
|
topic_slug: netkingdom
|
||
|
|
created: "2026-09-21"
|
||
|
|
updated: "2026-09-21"
|
||
|
|
related:
|
||
|
|
- INFD-WP-0003
|
||
|
|
- INFD-IN-0005
|
||
|
|
- INFD-IN-0008
|
||
|
|
origin: demand
|
||
|
|
origin_ref: "founder 2026-09-21: 'We should be able to review comfortably though.'"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Comfortable decision review
|
||
|
|
|
||
|
|
The `INFD-WP-0003` overview is live, but in production every row shows "The
|
||
|
|
permission service refused access", even after a fresh sign-in. Each row asks
|
||
|
|
Flex Auth for `read`. The served `informed-decision.compact-sitting` v2
|
||
|
|
package gates `read` with a bar designed for binding:
|
||
|
|
|
||
|
|
- The rule requires `assurance.at` to be at most 900 seconds old. KeyCape
|
||
|
|
carries earlier authentication timestamps forward (`INFD-IN-0005`), so a
|
||
|
|
browsing session rarely meets it.
|
||
|
|
- The package does not name the three `SECRETS-WP-0010-T03-*` memos at all.
|
||
|
|
|
||
|
|
The founder wants to be able to review decisions comfortably. The plan is to
|
||
|
|
split *seeing your decisions* from *reviewing one for binding*:
|
||
|
|
|
||
|
|
- Add a new consumer action, `list`, with limited disclosure. It has a
|
||
|
|
comfortable identity bar, and flex-auth admits it.
|
||
|
|
- `read` and every act keep their strict bar.
|
||
|
|
|
||
|
|
## Establish why today's rows are refused
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: INFD-WP-0004-T01
|
||
|
|
status: wait
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
Waiting on the operator's read-only query of the live `policy_observations`:
|
||
|
|
`auth_age_s`, groups, level and methods for the latest checks. If the age is
|
||
|
|
over 900, `INFD-IN-0005` is confirmed as the cause for the eight sitting memos.
|
||
|
|
If a group, level or method differs from the rule, that is a separate identity
|
||
|
|
regression and needs fixing regardless of `list`. Record the finding under
|
||
|
|
`docs/evidence/`.
|
||
|
|
|
||
|
|
## Request the `list` policy from flex-auth
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: INFD-WP-0004-T02
|
||
|
|
status: progress
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
The request is drafted in `docs/flex-auth-request-list-action.md` and recorded
|
||
|
|
as `INFD-IN-0008`, owned by flex-auth. Send it to the flex-auth inbox once the
|
||
|
|
founder approves the draft. Done when flex-auth publishes a package, version
|
||
|
|
and digest that answers `list`, with fixtures.
|
||
|
|
|
||
|
|
## Consumer side: `list` action and limited-disclosure overview
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: INFD-WP-0004-T03
|
||
|
|
status: todo
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
- Add `list` to `policy.ACTIONS` and to `docs/flex-auth-review-contract.md`.
|
||
|
|
- The overview asks `list` per row instead of `read`. It renders only the memo
|
||
|
|
id and version, the question, the live engine status, and the person's own
|
||
|
|
responses (verb, version, time and submission state; no notes).
|
||
|
|
- The review page keeps `read`, and every act keeps its own action.
|
||
|
|
- Tests: `list` allowed while `read` is denied still shows the rows, and
|
||
|
|
opening one is still refused; a `list` deny redacts the row; no brief,
|
||
|
|
packet or notes leak on the home page.
|
||
|
|
|
||
|
|
This task can be built and tested against fixtures before T02 lands, but it
|
||
|
|
must not be deployed before T02. The live v2 package denies `list`, so
|
||
|
|
deploying early would change nothing visible.
|
||
|
|
|
||
|
|
## Admit and roll out
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: INFD-WP-0004-T04
|
||
|
|
status: wait
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
After T02, update `deploy/sitting-admission.json` with the new package,
|
||
|
|
version and digest. The operator then applies the configuration and the image
|
||
|
|
built from T03. Verify that the overview shows all eleven memos without a fresh
|
||
|
|
MFA, that opening a memo still enforces the strict `read` rule, and record the
|
||
|
|
rollout in `docs/evidence/`.
|