informed-decision/workplans/ADHOC-2026-10-03.md

id	type	title	domain	repo	status	owner	created	updated	related	state_hub_workstream_id
INFD-WP-ADHOC-2026-10-03	workplan	Provisioning-window sitting draft for hub decision D1	infotech	informed-decision	blocked	claude	2026-10-03	2026-10-03	CUST-WP-0075	e7923574-d226-53db-befb-dd7dcba817bb

Draft the provisioning-window sitting

id: INFD-WP-ADHOC-2026-10-03-T01
status: done
priority: high
state_hub_task_id: "8aa74d26-6a65-5881-8572-c5bde1069b96"

Dispatched by the-custodian under CUST-WP-0075. The founder wants hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1, attended OpenBao provisioning window) approved through informed-decision. Batch: docs/batches/2026-10-03-provisioning-window/ (generator tools/prepare_provisioning_window_batch.py, operator steps in its OPERATOR.md). Five candidate lanes were read against owner source. One memo, infd-20261003-p01 (RPF-WP-0035-T06, acceptance of the CCR-2026-0019 scoped delivery proof), was drafted. MASON-WP-0007-T05, RPF-WP-0035-T02, RPF-WP-0035-T08 and RAPPCOREHUB-WP-0003-T04 were excluded with reasons in the batch index. Unsigned; no approval created, nothing submitted.

Circulate and bind the sitting

id: INFD-WP-ADHOC-2026-10-03-T02
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
blocking_reason: "p01 is loaded, but repeated browser read attempts retain KeyCape MFA time 17:08:08 UTC and fail the 900-second policy limit. Obtain genuinely fresh password/OTP authentication; if fresh OTP still emits the old time, KeyCape owns the correction (INFD-IN-0005). Then founder reviews, acknowledges and chooses a disposition."
priority: high
state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"

Agents do not create the approval, admit the record, or bind. After the human disposition, record the receipt under docs/evidence/ and update sitting.json.

Coaching progress — 2026-10-03

A1 dry run passed. Founder completed A3 at 17:08 UTC. Receipt docs/evidence/2026-10-03-provisioning-window-approval-create.json records one requested human-control approval with no entries: 706f4205-aaa7-44f6-be30-d0f57664d69c, carrying the native digest sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4. Binding fields match the reviewed intent. Validity ends 2026-10-04 17:08 UTC.

A4 preparation: docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch adds only p01 to the policy and record manifest, advances v6 to v7, and preserves all 16 existing act records. It is a candidate for access-engine; no owner files or live policy were changed. Policy publication/deployment, load and human answer remain outstanding. This memo alone does not resolve hub decision D1.

Offline candidate validation: 795 actual-evaluator checks passed, including p01 and all existing records. The harness's 12-hour-boundary timestamp was refreshed per list record in the temporary validation copy to avoid wall-clock aging during the run; the policy MFA limits were unchanged. Embedded policy validation/tests also passed. Candidate package digest: sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7. Evidence: docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json and docs/evidence/2026-10-03-provisioning-window-admission-candidate.json.

A4 publication: founder applied the tested patch. Access-engine committed and synced it as f946c7b; CI published image sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d. Published-image evaluation confirms v7 and the expected package digest. Deployment values are pinned in access-engine commit 20ea612. docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md records the concrete policy/review rollout candidate, namespace-scoped preflight and rollback. Live rollout awaits founder approval. Load and human disposition remain open.

A4 live rollout completed on founder instruction "deploy v7": ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Helm revision 8 is deployed; authenticated workload live checks permit exact p01 and refuse wrong group, unknown memo, changed digest and absent caller token. Review Deployment references informed-decision-runtime-b800648bd80b; public health/readiness return 200 and sign-in redirects to KeyCape (303). deploy/sitting-admission.json now declares the deployed v7 pin. Evidence: docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json and docs/evidence/2026-10-03-provisioning-window-review-readiness.json. A5 load and A6 human disposition remain outstanding; no presentation or human act was performed by the rollout or probes.

A5 preparation: the existing live presentation records identify one historical KeyCape reviewer subject, uid=platform-root,ou=people,dc=netkingdom,dc=local. Pinned memo/packet copies for this recipient are prepared under the sitting's bound/ directory. A temporary offline-store load passed with no presentations or dispositions. Live store inspection confirms p01 is not yet loaded. The approved rollout covered policy and review configuration; live memo loading remains a separate pending step.

A5 live load completed on founder instruction "load p01": ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. The loaded memo and packet match the prepared copies, including native approval pin and packet digest. It is addressed to the verified historical KeyCape subject. Load verification found zero p01 presentations/dispositions; the loader performed no human act. Public health/readiness remain 200. Evidence: docs/evidence/2026-10-03-provisioning-window-p01-load.json. Only A6 remains: founder signs in with fresh MFA, reads the full packet, acknowledges the required highlight, and chooses a disposition. Plan remains blocked on that human act; hub decision D1 remains unresolved.

A6 refusal diagnosis: read at 18:27:49 UTC still carried exactly the same KeyCape assurance.at=1791047288 (17:08:08 UTC), age 4,781 seconds. Exact identity, group, memo and native approval pins match v7; the 900-second MFA limit refuses this request. The latest attempt has not supplied fresh evidence; the founder confirms account-portal logout followed by password and OTP login in the same browser. That did not propagate fresh assurance into this review request. Do not infer a new review authentication from portal login. KeyCape's /account/logout confirmation clears its session and routes through upstream Authelia sign-out; informed-decision sign-out alone is local. Complete that browser flow, then start a new review login with password and OTP. If the verified timestamp remains old after that, KeyCape must correct the authentication-time contract under existing intake INFD-IN-0005 and prove it with a completed browser journey. Retain all policy freshness limits. Evidence: docs/evidence/2026-10-03-provisioning-window-review-refusal.json. INFD-WP-0006 implements an explicit fresh-authentication request from review sign-in; its narrow image rollout and native browser proof remain blocked.