Record p01 approval creation and tested v7 admission candidate

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae

docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch

@@ -0,0 +1,59 @@
+--- a/examples/informed-decision-sitting/policy.md
++++ b/examples/informed-decision-sitting/policy.md
+@@ -2,7 +2,7 @@
+ id: informed-decision.compact-sitting
+ name: Compact sitting exact-record human review
+ namespace: informed-decision:decision-memo
+-version: v6
++version: v7
+ status: ready
+ package: flexauth.informed_decision.compact_sitting
+ allow_ttl: 30s
+@@ -59,6 +59,11 @@
+ still require the authenticated human and fresh MFA. Ordinary worker approvals
+ retain their native control type and require exact-ID consumer configuration.
+ 
++v7 (2026-10-03, INFD-WP-ADHOC-2026-10-03-T02) adds the exact
++`memo:infd-20261003-p01` delivery-proof acceptance record. Native pins come
++from informed-decision `docs/evidence/2026-10-03-provisioning-window-approval-create.json`.
++Existing records and identity requirements are preserved.
++
+ The identity bar matches T03: authenticated informed-decision caller,
+ `net-kingdom-admins`, fresh KeyCape AAL2 MFA. No permission follows from
+ memo content or presentation state. TokenReview must admit
+@@ -72,6 +77,10 @@
+ import rego.v1
+ 
+ records := {
++  "memo:infd-20261003-p01": {
++    "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
++    "binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
++  },
+   "memo:infd-20260914-c02": {
+     "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
+     "binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
+--- a/examples/informed-decision-sitting/records.json
++++ b/examples/informed-decision-sitting/records.json
+@@ -338,5 +338,22 @@
+       }
+     },
+     "memo_version": 1
++  },
++  "memo:infd-20261003-p01": {
++    "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
++    "binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
++    "label": "p01",
++    "binding": {
++      "action": "accept",
++      "actor": "informed-decision",
++      "principal": "railiance-platform",
++      "purpose": "Accept the 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader",
++      "target": {
++        "id": "ccr:CCR-2026-0019-delivery-proof",
++        "type": "credential-lane",
++        "system": "railiance-platform"
++      }
++    },
++    "memo_version": 1
+   }
+ }

docs/evidence/2026-10-03-provisioning-window-admission-candidate.json

@@ -0,0 +1,11 @@
+{
+  "scope": "offline evaluator with synthetic identity; no live admission or human approval",
+  "memo_id": "infd-20261003-p01",
+  "approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
+  "binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
+  "policy_version": "v7",
+  "policy_package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7",
+  "old_records": 16,
+  "new_records": 17,
+  "read_effect": "allow"
+}

docs/evidence/2026-10-03-provisioning-window-approval-create.json

@@ -0,0 +1,41 @@
+{
+  "observed_at": "2026-10-03T17:08:08.076377+00:00",
+  "status": "created",
+  "phase": "seven_unapproved_requests_created",
+  "requests": [
+    {
+      "memo_id": "infd-20261003-p01",
+      "approval": {
+        "binding": {
+          "action": "accept",
+          "actor": "informed-decision",
+          "digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
+          "human_control": true,
+          "pdp_digest": null,
+          "pdp_path": false,
+          "principal": "railiance-platform",
+          "purpose": "Accept the 2026-09-13 scoped delivery proof for the CCR-2026-0019 secrets-engine approval-client reader",
+          "target": {
+            "id": "ccr:CCR-2026-0019-delivery-proof",
+            "system": "railiance-platform",
+            "type": "credential-lane"
+          }
+        },
+        "created_at": "2026-10-03T17:08:12+00:00",
+        "entries": [],
+        "id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
+        "required_count": 1,
+        "status": "requested",
+        "superseded_by": null,
+        "updated_at": "2026-10-03T17:08:12+00:00",
+        "validity": {
+          "expires_at": "2026-10-04T17:08:09.951582+00:00",
+          "not_before": "2026-10-03T17:08:09.951582+00:00"
+        }
+      }
+    }
+  ],
+  "credential_values_emitted": false,
+  "human_entries_created": false,
+  "skipped": []
+}