Open INFD-WP-0004 and draft the flex-auth list-action request (INFD-IN-0008)

The live overview is refused on every row: compact-sitting v2 gates read
with a 900 s MFA window and does not name the T03 memos. Propose a
limited-disclosure list action with a comfortable bar; read and every act
stay strict.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 359683@bnt-lap001
Assistant-Session: eebdc939-7a9b-4e50-9d39-c8437e8a14ec

workplans/INFD-WP-0004-comfortable-decision-review.md

@@ -0,0 +1,100 @@
+---
+id: INFD-WP-0004
+type: workplan
+title: "Comfortable decision review — a `list` action for the overview"
+domain: infotech
+repo: informed-decision
+status: active
+owner: claude
+topic_slug: netkingdom
+created: "2026-09-21"
+updated: "2026-09-21"
+related:
+  - INFD-WP-0003
+  - INFD-IN-0005
+  - INFD-IN-0008
+origin: demand
+origin_ref: "founder 2026-09-21: 'We should be able to review comfortably though.'"
+---
+
+# Comfortable decision review
+
+The `INFD-WP-0003` overview is live, but in production every row shows "The
+permission service refused access", even after a fresh sign-in. Each row asks
+Flex Auth for `read`. The served `informed-decision.compact-sitting` v2
+package gates `read` with a bar designed for binding:
+
+- The rule requires `assurance.at` to be at most 900 seconds old. KeyCape
+  carries earlier authentication timestamps forward (`INFD-IN-0005`), so a
+  browsing session rarely meets it.
+- The package does not name the three `SECRETS-WP-0010-T03-*` memos at all.
+
+The founder wants to be able to review decisions comfortably. The plan is to
+split *seeing your decisions* from *reviewing one for binding*:
+
+- Add a new consumer action, `list`, with limited disclosure. It has a
+  comfortable identity bar, and flex-auth admits it.
+- `read` and every act keep their strict bar.
+
+## Establish why today's rows are refused
+
+```task
+id: INFD-WP-0004-T01
+status: wait
+priority: high
+```
+
+Waiting on the operator's read-only query of the live `policy_observations`:
+`auth_age_s`, groups, level and methods for the latest checks. If the age is
+over 900, `INFD-IN-0005` is confirmed as the cause for the eight sitting memos.
+If a group, level or method differs from the rule, that is a separate identity
+regression and needs fixing regardless of `list`. Record the finding under
+`docs/evidence/`.
+
+## Request the `list` policy from flex-auth
+
+```task
+id: INFD-WP-0004-T02
+status: progress
+priority: high
+```
+
+The request is drafted in `docs/flex-auth-request-list-action.md` and recorded
+as `INFD-IN-0008`, owned by flex-auth. Send it to the flex-auth inbox once the
+founder approves the draft. Done when flex-auth publishes a package, version
+and digest that answers `list`, with fixtures.
+
+## Consumer side: `list` action and limited-disclosure overview
+
+```task
+id: INFD-WP-0004-T03
+status: todo
+priority: high
+```
+
+- Add `list` to `policy.ACTIONS` and to `docs/flex-auth-review-contract.md`.
+- The overview asks `list` per row instead of `read`. It renders only the memo
+  id and version, the question, the live engine status, and the person's own
+  responses (verb, version, time and submission state; no notes).
+- The review page keeps `read`, and every act keeps its own action.
+- Tests: `list` allowed while `read` is denied still shows the rows, and
+  opening one is still refused; a `list` deny redacts the row; no brief,
+  packet or notes leak on the home page.
+
+This task can be built and tested against fixtures before T02 lands, but it
+must not be deployed before T02. The live v2 package denies `list`, so
+deploying early would change nothing visible.
+
+## Admit and roll out
+
+```task
+id: INFD-WP-0004-T04
+status: wait
+priority: high
+```
+
+After T02, update `deploy/sitting-admission.json` with the new package,
+version and digest. The operator then applies the configuration and the image
+built from T03. Verify that the overview shows all eleven memos without a fresh
+MFA, that opening a memo still enforces the strict `read` rule, and record the
+rollout in `docs/evidence/`.