Establish INTENT, Stage 1 GOAL, and founding workplan

Claim ownership of the browser-facing approver UI that approval-engine
deliberately does not contain. approval-engine's INTENT names an approvals
inbox under Non-Goals, and docs/keycape-service-registrations.md records that
the human approver client's client_id and callback URI "must come from its
owner once it exists" — leaving key-cape's KEY-WP-0013-T02 blocked on an
unassigned component.

- INTENT.md: Decision Memo concept, the binding/awareness split and the two
  hashes, ownership and non-ownership against the named estate repositories,
  and a provisional PEP-shaped layer placement flagged for a gate-house ruling
  rather than asserted.
- GOAL.md: Stage 1 is the L3 approval approver surface — the narrowest real
  consumer with a live blocking dependency — plus the written answer to who
  owns the approver UI.
- workplans/INFD-WP-0001: founding documents, the gate-house layer/ownership
  ruling, the four specs (PRD, UseCaseCatalog, ArchitectureBlueprint,
  EvidenceModel), schema and canonicalizer promotion out of history/ with the
  isolation vectors under test, the key-cape client registration, and a
  walking skeleton that includes return and discuss.

history/ is preserved unmodified as provenance.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568

history/20260909-initial-exploration/vectors/login-awareness.json

@@ -0,0 +1,63 @@
+{
+  "memo_id": "01K4LOGIN00000000000000001",
+  "memo_version": 1,
+  "locale": "en",
+  "ui_release": "informed-decision@0.4.0",
+  "proposed_hat": {
+    "id": "hat:finance-controller",
+    "label": "Finance Controller",
+    "kind": "access_profile",
+    "elevates": false,
+    "permissions_preview": ["invoice.read", "invoice.export"],
+    "scope_id": "tenant:acme"
+  },
+  "proposed_hat_source": "last_used",
+  "available_hats": [
+    {
+      "id": "hat:finance-controller",
+      "label": "Finance Controller",
+      "kind": "access_profile",
+      "elevates": false,
+      "permissions_preview": ["invoice.read", "invoice.export"],
+      "scope_id": "tenant:acme"
+    },
+    {
+      "id": "hat:auditor-readonly",
+      "label": "Auditor (read-only)",
+      "kind": "perspective",
+      "elevates": false,
+      "permissions_preview": ["invoice.read"],
+      "scope_id": "tenant:acme"
+    },
+    {
+      "id": "hat:payroll-admin",
+      "label": "Payroll Admin",
+      "kind": "role",
+      "elevates": true,
+      "permissions_preview": ["payroll.run", "employee.export-all"],
+      "scope_id": "tenant:acme"
+    }
+  ],
+  "available_scopes": [
+    {
+      "kind": "tenant",
+      "id": "tenant:acme",
+      "label": "ACME Corp",
+      "environment": "prod",
+      "requires_new_bind": true
+    },
+    {
+      "kind": "tenant",
+      "id": "tenant:beta",
+      "label": "Beta GmbH",
+      "environment": "prod",
+      "requires_new_bind": true
+    }
+  ],
+  "last_session": {
+    "ended_at": "2026-09-08T16:12:00Z",
+    "hat_id": "hat:finance-controller",
+    "scope_id": "tenant:acme"
+  },
+  "situation_note": "Last session Tuesday 18:12 CEST as Finance Controller in ACME. Payroll Admin is an elevating hat and needs its own bind."
+}