diff --git a/SCOPE.md b/SCOPE.md index 66398d9..9250077 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -38,6 +38,11 @@ actual Flex Auth, Approval Engine and Audit Core with synthetic identity/custody - `policy.py` / `review.py` / `ui.py` — fresh entitlement before rendering and actions, exact response pins, immutable observations, required highlights, accept/return/discuss/decline and visible original/unresolved entry state; +- the **decision overview** on the signed-in home page (`INFD-WP-0003`): + the reviewer's memos grouped as open, accepted, declined, returned, closed, + needing attention or not available. Each row has its own PDP read and a live + get-by-id engine status. The overview records nothing and never presents + or binds; - `runtime.py` — explicit owner configuration, rotating credential-file readers, 30-second audit draining, heartbeat/reconciliation and delivery readiness. - `Containerfile`, `container.py`, `requirements.lock` and deployment renderer — diff --git a/docs/protected-browser-review.md b/docs/protected-browser-review.md index 42cfb3b..a1f4673 100644 --- a/docs/protected-browser-review.md +++ b/docs/protected-browser-review.md @@ -54,7 +54,7 @@ old evidence and submission records. | Route | Behavior | | --- | --- | -| `GET /` | Sign-in or named memo identifier form; no approvals inbox | +| `GET /` | Sign-in, then the reviewer's decision overview (below) and the memo identifier form | | `GET /review?memo_id=...` | Entitled current memo; existing intent retrieves its original view | | `GET /presentations/` | Entitled historical presentation and current submission result | | `GET /presentations//packet/` | Fresh read permission and full attachment bytes | @@ -76,6 +76,42 @@ inline scripts, framing and caching remain prohibited. There is no telemetry or client-side token storage. The reverse proxy must still omit auth queries, bearer headers and cookies from its logs. +## Decision overview + +Added under `INFD-WP-0003`. After sign-in, `GET /` lists the memos this +repository holds that name the signed-in person as the person bound +(`binding.principal`, kind `person`). The latest version of each memo is placed +in one group: + +| Group | Condition | +| --- | --- | +| Needs attention | the accepted entry is `in_flight` or `unresolved` and needs operator recovery | +| Open for you | no decision recorded on the latest version, or a prepared accept not yet submitted, and the approval is `requested`/`approved` or its status is unknown | +| Accepted | Approval Engine confirmed the entry. The row shows `approved_at` and the live status | +| Declined | the latest response on the latest version is `decline` | +| Returned or in discussion | the latest response on the latest version is `return` or `discuss`. A revised version moves the memo back to Open | +| Closed without your response | the approval is `expired`, `revoked`, `superseded` or `consumed` and you recorded no decision | +| Not available | the permission check refused or failed. Only the memo id and a bounded reason are shown | + +Each row links to `/review?memo_id=...`. It also lists the person's earlier +responses on every version. + +The overview is not an inbox and not approval state: + +- **It checks permission per row.** Each row gets its own fresh Flex Auth + `read` decision before its question is shown. It is the same check the + review uses, and each decision is stored as a policy observation. A refused + row does not call Approval Engine. +- **It reads Approval Engine by id only.** The overview looks up the approval + id the memo already carries. It never polls for work. The status is shown + live and never stored. An unavailable engine, or an act digest that no longer + matches, degrades only that row. +- **It records nothing.** It creates no presentation, acknowledgment or + disposition. Binding still happens only on the review page, which runs its + own checks again. +- **It shows little memo content.** A row shows only the question, the memo id + and version, and the status. The brief and packet appear only on the review. + ## Owner configuration and audit readiness Set `INFD_REVIEW_CONFIG` to an absolute, owned, regular 0600 JSON file. Its diff --git a/workplans/INFD-WP-0003-my-decisions-overview.md b/workplans/INFD-WP-0003-my-decisions-overview.md index af0f9e7..1e80ce6 100644 --- a/workplans/INFD-WP-0003-my-decisions-overview.md +++ b/workplans/INFD-WP-0003-my-decisions-overview.md @@ -4,7 +4,7 @@ type: workplan title: "My decisions overview — pending memos and the outcome of past dispositions" domain: infotech repo: informed-decision -status: active +status: finished owner: claude topic_slug: netkingdom created: "2026-09-21" @@ -111,10 +111,19 @@ or `test_review_component.py`, plus one Chromium check in ```task id: INFD-WP-0003-T04 -status: todo +status: done priority: medium state_hub_task_id: "6c38b102-943d-5bde-96ac-3e15e2e8e8ab" ``` Update `docs/protected-browser-review.md` and `SCOPE.md` with the overview and the boundary argument above. + +## Outcome — 2026-09-21 + +All four tasks are done. After sign-in, `GET /` shows the grouped overview +above the memo identifier form. There are 432 automated tests with actual +Approval Engine, Audit Core and Flex Auth, and 13 Chromium checks. + +There are no actionable residuals. Deployment of the surface stays with +`INFD-WP-0001-T08` and the deployment packet. It is not new work from this plan.