Connect policy-gated browser review and audit runtime

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/fixtures/review-policy/fixtures.json

@@ -0,0 +1,58 @@
+[
+  {
+    "id": "synthetic-allow",
+    "request": {
+      "id": "fixture-pin",
+      "tenant": "tenant:platform",
+      "subject": {
+        "id": "human-fixture",
+        "type": "human",
+        "tenant": "tenant:platform"
+      },
+      "action": "read",
+      "resource": {
+        "id": "memo:memo-1",
+        "type": "decision-memo",
+        "system": "informed-decision",
+        "tenant": "tenant:platform"
+      },
+      "context": {
+        "memo_version": 1,
+        "approval_id": "fixture",
+        "approval_binding_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      },
+      "policy_version": "v1"
+    },
+    "expect": {
+      "effect": "allow"
+    }
+  },
+  {
+    "id": "synthetic-refusal",
+    "request": {
+      "id": "fixture-pin",
+      "tenant": "tenant:platform",
+      "subject": {
+        "id": "human-fixture",
+        "type": "human",
+        "tenant": "tenant:platform"
+      },
+      "action": "consume",
+      "resource": {
+        "id": "memo:memo-1",
+        "type": "decision-memo",
+        "system": "informed-decision",
+        "tenant": "tenant:platform"
+      },
+      "context": {
+        "memo_version": 1,
+        "approval_id": "fixture",
+        "approval_binding_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      },
+      "policy_version": "v1"
+    },
+    "expect": {
+      "effect": "deny"
+    }
+  }
+]

tests/fixtures/review-policy/pin.json

@@ -0,0 +1,6 @@
+{
+  "package": "informed-decision.fixture",
+  "version": "v1",
+  "package_digest": "sha256:bf39cd7fb33c3db6ba5adb3c036911216e35ef03c1168034e38fe741df67653a",
+  "fixture_only": true
+}

tests/fixtures/review-policy/policy.md

@@ -0,0 +1,50 @@
+---
+id: informed-decision.fixture
+name: Synthetic review API contract fixture
+namespace: informed-decision:decision-memo
+version: v1
+status: ready
+package: flexauth.informed_decision.fixture
+allow_ttl: 60s
+actions: [read, acknowledge, accept, return, discuss, decline]
+owner: fixture-only
+fixtures: [fixtures.json]
+caring:
+  profile: caring-0.4.0-rc2
+  enforce: false
+activation:
+  mode: local
+---
+
+# Synthetic component fixture, never a production policy
+
+Only the locally signed human-fixture and memo:memo-1 can exercise this test.
+No production approver, group, mandate or permission is established here.
+No presentation claim, view hash, acknowledgment or local outcome is input.
+
+```rego
+import rego.v1
+
+decision := {"effect": "allow", "reason": "synthetic_review_fixture"} if {
+  input.tenant == "tenant:platform"
+  input.subject.id == "human-fixture"
+  input.subject.type == "human"
+  input.resource.system == "informed-decision"
+  input.resource.type == "decision-memo"
+  input.resource.id == "memo:memo-1"
+  input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
+  input.context.approval_id == "fixture"
+} else := {"effect": "deny", "reason": "fixture_scope_refused"} if {
+  true
+}
+```
+
+```rego test
+package flexauth.informed_decision.fixture_test
+import rego.v1
+import data.flexauth.informed_decision.fixture
+
+test_unknown_request_denied if {
+  fixture.decision.effect == "deny" with input as {}
+}
+```

tests/fixtures/review-policy/registry.json

@@ -0,0 +1,18 @@
+{
+  "subjects": [
+    {
+      "id": "human-fixture",
+      "type": "Human",
+      "display_name": "Synthetic browser reviewer",
+      "organization_relation": "ServiceProvider",
+      "roles": [
+        "Operator"
+      ],
+      "groups": [],
+      "tenant": "tenant:platform",
+      "metadata": {
+        "source": "synthetic-contract-fixture"
+      }
+    }
+  ]
+}