INFD-WP-0010-T02: release candidate for present_existing with compact-sitting v14

Candidate files: review policy pin v14 (sha256:8911458f...), the
nk-bind-executor present_existing registry row (daily limit 10), and an
8081 ingress peer for exactly sso + app.kubernetes.io/name=bounded-executor.
The state-hub row is unchanged and outcome_read stays off. The image pin
stays at the live f5588f49 because no owner-CI full-service image exists
yet; the founder runbook (deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md)
gates the release on it. Adds a side-effect-free present_existing probe
and release tests. Nothing applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

tools/present_existing_probe.py

@@ -0,0 +1,88 @@
+"""Build one synthetic present_existing intake envelope (INFD-WP-0010-T02 release check).
+
+The envelope pins an approval id the caller names and a deliberately wrong binding
+digest, so a successful approval read always ends in a 409 refusal and no memo is
+stored, no budget is spent and no approval is created, entered or consumed. It only
+prints JSON; posting it is a separate, founder-run step (see
+deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md). The content is synthetic and secret-free.
+"""
+
+import argparse
+from datetime import datetime, timezone
+import hashlib
+import json
+import sys
+
+ACTOR = "service:nk-bind-executor"
+SUBMITTER = "nk-bind-executor"
+PROFILE_ACTIONS = ["bounded-execution"]
+WRONG_DIGEST = "sha256:" + "0" * 64
+WORKLOAD = "http://informed-decision-workload.informed-decision.svc.cluster.local:8081/v1/memos"
+TOKEN_FILE = "/var/run/secrets/informed-decision-intake/token"
+
+# Runs inside the founder's probe pod (python from the service image). Prints status and the
+# refusal body only; never prints the token.
+POSTER = """import json, urllib.error, urllib.request
+token = open(%r).read().strip()
+request = urllib.request.Request(%r, data=ENVELOPE.encode(), method="POST",
+    headers={"Authorization": "Bearer " + token, "Content-Type": "application/json"})
+try:
+    response = urllib.request.urlopen(request, timeout=20)
+    print(response.status, response.read().decode()[:400])
+except urllib.error.HTTPError as error:
+    print(error.code, error.read().decode()[:400])
+""" % (TOKEN_FILE, WORKLOAD)
+
+
+def build(approval_id, stamp):
+    memo_id = "probe-" + stamp
+    item_id = memo_id + "-packet"
+    content = ("Synthetic release probe for the present_existing intake profile. "
+               "It is refused by design and must never be shown for review.\n")
+    packet_hash = "sha256:" + hashlib.sha256(content.encode()).hexdigest()
+    memo = {
+        "id": memo_id, "version": 1, "sealed": False, "locale": "en",
+        "question": "Synthetic release probe: is this refused before review?",
+        "requested_act": "approve", "binding_level": "organizational", "step_kind": "approve",
+        "brief": "Synthetic present_existing release probe; never bound.",
+        "binding": {"justification": None, "terms": None,
+                    "principal": {"id": "pending-human-session", "kind": "person", "role": "reviewer",
+                                  "display_name": "Named reviewer in net-kingdom-admins", "identifiers": []},
+                    "target": {"environment": "prod", "id": "probe:" + memo_id, "kind": "bounded-execution",
+                               "label": "synthetic release probe", "requires_new_bind": False}},
+        "packet": [{"item_id": item_id, "label": item_id, "hash": packet_hash}],
+        "highlights": [],
+        "approval_id": approval_id, "approval_binding_digest": WRONG_DIGEST,
+    }
+    return {
+        "kind": "informed-decision.memo-intake", "version": 1,
+        "idempotency_key": memo_id, "memo_class": "bounded-execution",
+        "review_group": "net-kingdom-admins", "drafted_by": "informed-decision-release-probe",
+        "approval_intent": {"action": "bounded-execution", "principal": "admin",
+                            "purpose": "Synthetic present_existing release probe",
+                            "target": {"admission_id": "PROBE-" + stamp, "admission_digest": WRONG_DIGEST}},
+        "memo": memo,
+        "packet": [{"item_id": item_id, "media_type": "text/plain", "content": content}],
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--approval-id", required=True, help="existing approval UUID, or a random UUID")
+    parser.add_argument("--program", action="store_true",
+                        help="print a self-contained python program that posts the envelope (for `python -`)")
+    parser.add_argument("--stamp", default=datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S"))
+    args = parser.parse_args()
+    envelope = build(args.approval_id, args.stamp)
+    # Offline self-check against the same validator intake uses.
+    from informed_decision.intake import PresentExisting, SubmitterGrant, validate_submission
+    validate_submission(envelope, submitter_id=SUBMITTER,
+                        grant=SubmitterGrant(SUBMITTER, frozenset({"bounded-execution"}),
+                                             frozenset({"net-kingdom-admins"})),
+                        present_existing=PresentExisting(ACTOR, frozenset(PROFILE_ACTIONS)))
+    raw = json.dumps(envelope, separators=(",", ":"))
+    sys.stdout.write("ENVELOPE = %r\n%s" % (raw, POSTER) if args.program else raw + "\n")
+
+
+if __name__ == "__main__":
+    main()