tegwick
40654505c4
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 272244@bnt-lap001 Assistant-Session: c8962fa7-b290-47df-865f-403ddb6c77e9
55 lines
2.5 KiB
Markdown
55 lines
2.5 KiB
Markdown
# Budget sitting — operator packet (SECRETS-WP-0009-T03)
|
|
|
|
Review group: `net-kingdom-admins`.
|
|
Surface: https://decisions.coulomb.social/
|
|
Contract: `docs/specs/CompactSignoffBatches.md`.
|
|
Generator: `tools/prepare_budget_batch.py` (re-running rewrites the same bytes).
|
|
|
|
An agent may draft, order, and record evidence. It may not `accept` / `decline` / `seal`.
|
|
|
|
## One unsigned memo
|
|
|
|
| n | memo_id | Blocking record |
|
|
| --: | --- | --- |
|
|
| 1 | `infd-20260921-b01` | SECRETS-WP-0009-T03 spend envelope (`authority_ref` for HFACT-WP-0001 SpendPolicy) |
|
|
|
|
Required acknowledgement: the EUR 100 monthly limit is recorded, not enforced.
|
|
|
|
## Steps
|
|
|
|
1. **Create the native approval (attended).** Same contained reader as the
|
|
2026-09-14 sitting, with the batch selected explicitly:
|
|
|
|
```bash
|
|
tools/create_sitting_approvals.sh --sitting 2026-09-21 \
|
|
--receipt 2026-09-21-budget-approval-create.json --expect 1
|
|
```
|
|
|
|
Check first without credentials:
|
|
`.venv/bin/python -B tools/create_sitting_approvals.py --dry-run --sitting 2026-09-21 --receipt 2026-09-21-budget-approval-create.json --expect 1`.
|
|
The receipt at `docs/evidence/2026-09-21-budget-approval-create.json` gives
|
|
`approval_id` and the engine-computed binding digest.
|
|
|
|
2. **Flex Auth admission as a visible version change.** In
|
|
`flex-auth/examples/informed-decision-sitting/policy.md`: `version: v1` → `v2`,
|
|
add `"memo:infd-20260921-b01"` to `records` with the receipt's `approval_id`,
|
|
`binding_digest`, `label: "b01"`, the binding from
|
|
`approval-create-intents.json`, `memo_version: 1`; mirror it in `records.json`.
|
|
Keep all seven v1 records. Do not add the record before step 1: an empty
|
|
approval id must never be a policy value. Build the image in CI, bump
|
|
`values/informed-decision-sitting.yaml` digest, deploy.
|
|
|
|
3. **Point Informed Decision at v2.** `deploy/sitting-admission.json`:
|
|
`version: v2`, new `package_digest`. Roll out the review service.
|
|
|
|
4. **Load and sit.** Attach the live KeyCape subject, load the memo
|
|
(`tools/load_sitting_memos.py`), and the human accepts at the surface.
|
|
The accepted approval id is recorded as `authority_ref` in the SpendPolicy.
|
|
|
|
## Outcome — 2026-09-21
|
|
|
|
Operator applied the review cutover to compact-sitting v2 and loaded `b01`.
|
|
Accepted by the named human at 19:51:29 UTC under fresh AAL2 MFA; the required
|
|
highlight was acknowledged first; the Approval Engine entry is `confirmed`.
|
|
Receipt: `docs/evidence/2026-09-21-budget-sitting-accept.json`.
|
|
The seven 2026-09-14 sitting memos are reviewable again under the same package.
|