Document the decision overview and finish INFD-WP-0003 (T04)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 359683@bnt-lap001
Assistant-Session: eebdc939-7a9b-4e50-9d39-c8437e8a14ec

SCOPE.md

@@ -38,6 +38,11 @@ actual Flex Auth, Approval Engine and Audit Core with synthetic identity/custody
 - `policy.py` / `review.py` / `ui.py` — fresh entitlement before rendering and
   actions, exact response pins, immutable observations, required highlights,
   accept/return/discuss/decline and visible original/unresolved entry state;
+- the **decision overview** on the signed-in home page (`INFD-WP-0003`):
+  the reviewer's memos grouped as open, accepted, declined, returned, closed,
+  needing attention or not available. Each row has its own PDP read and a live
+  get-by-id engine status. The overview records nothing and never presents
+  or binds;
 - `runtime.py` — explicit owner configuration, rotating credential-file readers,
   30-second audit draining, heartbeat/reconciliation and delivery readiness.
 - `Containerfile`, `container.py`, `requirements.lock` and deployment renderer —

docs/protected-browser-review.md

@@ -54,7 +54,7 @@ old evidence and submission records.
 
 | Route | Behavior |
 | --- | --- |
-| `GET /` | Sign-in or named memo identifier form; no approvals inbox |
+| `GET /` | Sign-in, then the reviewer's decision overview (below) and the memo identifier form |
 | `GET /review?memo_id=...` | Entitled current memo; existing intent retrieves its original view |
 | `GET /presentations/<id>` | Entitled historical presentation and current submission result |
 | `GET /presentations/<id>/packet/<index>` | Fresh read permission and full attachment bytes |
@@ -76,6 +76,42 @@ inline scripts, framing and caching remain prohibited. There is no telemetry
 or client-side token storage. The reverse proxy must still omit auth queries,
 bearer headers and cookies from its logs.
 
+## Decision overview
+
+Added under `INFD-WP-0003`. After sign-in, `GET /` lists the memos this
+repository holds that name the signed-in person as the person bound
+(`binding.principal`, kind `person`). The latest version of each memo is placed
+in one group:
+
+| Group | Condition |
+| --- | --- |
+| Needs attention | the accepted entry is `in_flight` or `unresolved` and needs operator recovery |
+| Open for you | no decision recorded on the latest version, or a prepared accept not yet submitted, and the approval is `requested`/`approved` or its status is unknown |
+| Accepted | Approval Engine confirmed the entry. The row shows `approved_at` and the live status |
+| Declined | the latest response on the latest version is `decline` |
+| Returned or in discussion | the latest response on the latest version is `return` or `discuss`. A revised version moves the memo back to Open |
+| Closed without your response | the approval is `expired`, `revoked`, `superseded` or `consumed` and you recorded no decision |
+| Not available | the permission check refused or failed. Only the memo id and a bounded reason are shown |
+
+Each row links to `/review?memo_id=...`. It also lists the person's earlier
+responses on every version.
+
+The overview is not an inbox and not approval state:
+
+- **It checks permission per row.** Each row gets its own fresh Flex Auth
+  `read` decision before its question is shown. It is the same check the
+  review uses, and each decision is stored as a policy observation. A refused
+  row does not call Approval Engine.
+- **It reads Approval Engine by id only.** The overview looks up the approval
+  id the memo already carries. It never polls for work. The status is shown
+  live and never stored. An unavailable engine, or an act digest that no longer
+  matches, degrades only that row.
+- **It records nothing.** It creates no presentation, acknowledgment or
+  disposition. Binding still happens only on the review page, which runs its
+  own checks again.
+- **It shows little memo content.** A row shows only the question, the memo id
+  and version, and the status. The brief and packet appear only on the review.
+
 ## Owner configuration and audit readiness
 
 Set `INFD_REVIEW_CONFIG` to an absolute, owned, regular 0600 JSON file. Its

workplans/INFD-WP-0003-my-decisions-overview.md

@@ -4,7 +4,7 @@ type: workplan
 title: "My decisions overview — pending memos and the outcome of past dispositions"
 domain: infotech
 repo: informed-decision
-status: active
+status: finished
 owner: claude
 topic_slug: netkingdom
 created: "2026-09-21"
@@ -111,10 +111,19 @@ or `test_review_component.py`, plus one Chromium check in
 
 ```task
 id: INFD-WP-0003-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "6c38b102-943d-5bde-96ac-3e15e2e8e8ab"
 ```
 
 Update `docs/protected-browser-review.md` and `SCOPE.md` with the overview and
 the boundary argument above.
+
+## Outcome — 2026-09-21
+
+All four tasks are done. After sign-in, `GET /` shows the grouped overview
+above the memo identifier form. There are 432 automated tests with actual
+Approval Engine, Audit Core and Flex Auth, and 13 Chromium checks.
+
+There are no actionable residuals. Deployment of the surface stays with
+`INFD-WP-0001-T08` and the deployment packet. It is not new work from this plan.