Makes true what was already told to approval-engine: DoD-3 read
"reconstructable from a view_hash", which assumed the hash could ride into the
approval entry. It cannot — POST /entries discards its request body by design so
that record holds no caller-supplied data. Adopted their arrangement rather than
asking for a field, and recorded the consequence honestly: an auditor holding
only the approval object cannot reach the presentation without this surface's
record or audit-core.
Two invariants added to GOAL: approved is never rendered as permission to act,
and entitlement to view is access-engine's — a 200 from approval-engine is not
permission to see the approval.
T02 notes record that approval-engine found two real defects in the T03/T04
drafts, that their open questions A and B are now with key-cape because both
change an implemented registration, and that R3 remains open with an offer to
withdraw it if approval-engine considers it settled by its claim contract.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
fix-consistency surfaced that GOAL.md's `repo_flavor: project` was wrong.
project-repository-flavor_v0.1.md reserves the prj- flavor for bounded
cross-repo coordination efforts and says durable products use INTENT.md and an
ordinary category. informed-decision is a durable product, so the C-35
"prj- flavor forbids shipping both INTENT.md and GOAL.md" contradiction was
self-inflicted rather than a real conflict.
- .repo-classification.yaml: category product, domain infotech.
- GOAL.md: drop repo_flavor/project_status, add a flavor note explaining that
GOAL.md is retained as the stage statement alongside a stable INTENT.md.
- SCOPE.md: honestly empty — states that nothing is implemented and that
INFD-WP-0001-T06 rewrites it after the gate-house ruling and the specs.
- AGENTS.md: shared State Hub / session / workplan boilerplate, plus the hard
rules for this repository — never decide, never own approval state, never
invent identity, never let awareness enter view_hash, never let an agent
bind, never fork the schema, fail closed.
- INFD-WP-0001: T01 records both corrections; T06 now rewrites SCOPE.md.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
Claim ownership of the browser-facing approver UI that approval-engine
deliberately does not contain. approval-engine's INTENT names an approvals
inbox under Non-Goals, and docs/keycape-service-registrations.md records that
the human approver client's client_id and callback URI "must come from its
owner once it exists" — leaving key-cape's KEY-WP-0013-T02 blocked on an
unassigned component.
- INTENT.md: Decision Memo concept, the binding/awareness split and the two
hashes, ownership and non-ownership against the named estate repositories,
and a provisional PEP-shaped layer placement flagged for a gate-house ruling
rather than asserted.
- GOAL.md: Stage 1 is the L3 approval approver surface — the narrowest real
consumer with a live blocking dependency — plus the written answer to who
owns the approver UI.
- workplans/INFD-WP-0001: founding documents, the gate-house layer/ownership
ruling, the four specs (PRD, UseCaseCatalog, ArchitectureBlueprint,
EvidenceModel), schema and canonicalizer promotion out of history/ with the
isolation vectors under test, the key-cape client registration, and a
walking skeleton that includes return and discuss.
history/ is preserved unmodified as provenance.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
