informed-decision/workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	related	state_hub_workstream_id
INFD-WP-0010	workplan	Present existing approvals, proportionate C1 confirm and hub write-back	infotech	informed-decision	active	claude-code	netkingdom	2026-10-31	2026-11-01	implementation		NK-WP-0056 INFD-WP-0005 APPROVAL-WP-0007 STATE-WP-0096 STATE-WP-0101	d1363acf-35c2-56ce-be1b-ecebd15b5253

INFD-WP-0010: present existing approvals, proportionate decisions

Owner answer to net-kingdom's decision services alignment review (2026-10-31): see docs/decision-services-alignment-answer.md. Founder direction: informed-decision is the one human-facing decision surface. It should be light for simple decisions and complete for risky ones, and its split with approval-engine should be explicit: approval-engine holds the object, created by the actor who uses it, and informed-decision presents it and records the human's act.

Founder decisions, 2026-11-01

Relayed by the net-kingdom coordinator on 2026-11-01 (quoted as relayed):

1. gate-house GH-DEC-2026-026 accepted as drafted. Decision classes C0–C3; a decision is at least C2 when anyone relies on it as authority for an act its standing mandate doesn't cover; C3 reserved; the actor that files a C2 approval may never approve it; agents never approve at C1+. Unblocks: S4's doctrine dependency (T03) and the founder's answer on class cuts. Consequences here: informed-decision still does not decide a class (the poser declares it, gate-house owns the doctrine); a C1 confirm is never authority for an unmandated act, because such reliance makes the decision C2 by definition, so a C1 confirm needs no approval object; only human dispositions bind (already enforced: agent and service actors cannot resolve). S1 already satisfies "filer never approves": the executor files the approval as service:nk-bind-executor and only a human enters it.
2. State Hub write-back is a pull. State Hub's existing STATE-WP-0096 dispatch worker fetches decision outcomes from informed-decision; informed-decision gets no hub credential. state-hub needs an outcome read returning informed-decision.decision-outcome v1 (fields: state-hub docs/decision-services-alignment-answer.md §5.2). informed-decision's hub write-back is switched on once STATE-WP-0101 lands. Unblocks / re-scopes: S3 (T04 re-scoped to the outcome read; T05 enablement; T06 retirement of the push path). INFD_HUB_WRITEBACK (push) stays off: it has no credential to use under this decision.
3. access-engine (review policy for requester service:nk-bind-executor) and key-cape (approval:read for informed-decision-sitting-requester) are being asked by separate workers. Affects T02 and T03; nothing changes here until they answer.

S1: present_existing intake profile

id: INFD-WP-0010-T01
status: done
priority: high
state_hub_task_id: "6e5fe18d-c59f-5abd-ab2d-4e0b738743a9"

A registered submitter's profile present_existing (approval_actor, actions) lets it pose a memo that pins an approval it created itself. Intake GETs the approval and verifies: status requested, no entries, human_control, actor == profile actor, digest == memo, binding == intent, required_count 1, not expired, one memo per approval. It never creates, enters or consumes. The recorded requester flows to review and to the access-engine context. Existing submitters are unchanged.

Done 2026-10-31 (local): code in intake.py, intake_service.py, intake_approval.py, requester.py, store.py; tests in tests/test_intake_present_existing.py. Not deployed.

S1 live enablement for nk-bind-executor

id: INFD-WP-0010-T02
status: wait
priority: high
depends_on: [INFD-WP-0010-T01]
state_hub_task_id: "6c522bcb-5581-5062-a1e4-7e2af6dabcfd"

Waiting on owners outside this repository:

• access-engine: a compact-sitting version that admits approval_requester service:nk-bind-executor for submitter nk-bind-executor and class bounded-execution, at aal2 (v13 requires informed-decision);
• key-cape: approval:read on informed-decision-sitting-requester;
• net-kingdom: an executor projected token with audience informed-decision-intake, and a NetworkPolicy to the private listener.

Then here: the policy pin, a registry row, a release, and a native proof with synthetic BEA content. Optional: for bounded-execution, require a packet item whose digest equals target.admission_digest, once the admission digest's canonical form is confirmed.

Done when: a founder aal2 accept of an executor-created approval is recorded, and the executor consumes it.

S4: C1 single-screen confirm

id: INFD-WP-0010-T03
status: wait
priority: medium
state_hub_task_id: "0b3750f5-47c3-5874-bebb-7ebab385a3df"

A lighter memo profile with one question, one packet item, one required highlight and options. It needs a fresh aal1 session and creates no approval object. It records view_hash and disposition and resolves the served hub decision (through T04's outcome read).

Blockers after the 2026-11-01 founder decisions: the gate-house doctrine (GH-DEC-2026-026) and the class cuts are settled. The only remaining external blocker is access-engine policy work: a review-policy action for a confirm without an approval object (today review refuses missing_act_binding), at aal1 for C1. The C1 profile's own design (how the poser declares the class at intake, and refusing C2+ on this profile) is in-repo work for when the task starts. Not started by decision: implement after access-engine answers.

Done when: a C1 decision is confirmed in the browser and resolves its hub decision with evidence. No approval object is created.

S3: decision outcome read for State Hub's pull (re-scoped 2026-11-01)

id: INFD-WP-0010-T04
status: done
priority: medium
state_hub_task_id: "8c649193-f274-5463-9897-7010a5bb4a9d"

Re-scoped by founder decision 2 (2026-11-01): the hub fetches, so informed-decision provides a read of the outcome of its own memos to the hub's existing intake identity, instead of pushing.

GET /v1/memos/{memo_id}/outcome on the private workload listener (same TokenReview, audience informed-decision-intake). Admitted only for a submitter row with outcome_read: true (reviewed deployment data; never combined with present_existing), and only for memos that submitter posed (others: 404, no existence oracle). The memo must serve a hub decision with resolves: on-answer. Responses: 202 pending (no terminal human answer yet, or an accept whose approval entry is not yet confirmed); 200 the informed-decision.decision-outcome v1 record; 409 approval_entry_unresolved, assurance_unrecorded, memo_does_not_resolve. Read-only, spends no budget, writes nothing.

Done 2026-11-01 (local): informed_decision/outcome.py, routing in intake_service.py / workload.py, issuer wiring in requester.py; tests in tests/test_decision_outcome.py. Not deployed.

S3 enablement: hub write-back on via the pull

id: INFD-WP-0010-T05
status: wait
priority: medium
depends_on: [INFD-WP-0010-T04]

Waits on state-hub STATE-WP-0101 (decision columns, resolve-evidence route, worker pull). Then here: set outcome_read: true on the system:serviceaccount:state-hub:state-hub row of intake-submitters.json and ship a release (founder runs). The worker's egress to the private listener (8081) already exists.

Done when: a served C1/C2 hub decision is resolved in production from an outcome record this service returned.

S3 cleanup: retire the push write-back

id: INFD-WP-0010-T06
status: wait
priority: low
depends_on: [INFD-WP-0010-T05]

Once T05 is live, remove the push path (hub_writeback.py, the hub-resolution delivery kind and INFD_HUB_WRITEBACK), keeping already-queued rows readable. It must never be switched on under decision 2.

Done when: no code path in informed-decision can write to State Hub's decision routes.