informed-decision/docs/evidence/2026-10-11-purpose-provider-probe

Provider-derived lifecycle denial mechanism probe — SOURCE ONLY

Work item INFD-WP-ADHOC-2026-10-11-T06. This newly prepared probe has not been run against the estate and changes neither the posted frozen112/helper bundle nor its decision memo. Ten synthetic source tests pass; they access no actual provider, runtime configuration, caller token, native DB or data.

Truthful contract and scope

Actual Access Engine examples/informed-decision-lifecycle/policy.md atv2 supports collection listing as lifecycle.search, not lifecycle.list. It admits only net-kingdom-admins KeyCape AAL2 humans or separately TokenReview-authenticated system:serviceaccount:state-hub:state-hub. The actual Informed Decision consumer ServiceAccount is review; its independent PDP caller uses the existing projected flex-auth token. This probe submits its own truthful subject system:serviceaccount:informed-decision:review, type service, tenant platform, empty attributes. It claims no authentication_audience, workload_uid, human assurance, roles, groups or imported tenant provenance. It does not impersonate StateHub or a human to turn an expected denial into allowance.

The request is fixed lifecycle.search of the decision collection, with no content query/DB retrieval, record mutation or approval/act effect. Only one POST/v1/check is sent; that provider may retain ordinary decision telemetry, so the probe is not globally side-effect free. Installed PolicyClient must accept a canonical, properly bound/pinned genuine DENY; ALLOW, caller refusal, unavailability, malformed binding/purpose, wrong pin or identity are failure, not completed proof. This establishes provider-derived denial/binding consumption and transformation refusals. It cannot establish an authorized native lifecycle request, real human MFA, provider-emitted advisory behavior, complete emission or T04 completion.

Source and custody gates for future execution

Root must freshly verify the existing native Pod/deployment/SA chain at namespace informed-decision, expected serviceAccountName review, admitted UID/template, immutable candidate763c and runtimeConfigMap6c/policyv2 pins. The script refuses UID/GID other than10001, optimized interpreter, wrong installed module9d7 hash/ root ownership/mode0644, wrong private runtime config ownership/mode0600/size, or any lifecycle config/pin/token-path drift. It reads only the existing private /run/informed-decision/private/runtime.json and fixed projected policy caller file INSIDE the Pod. Root must never export/decode/print that credential, read Secret objects or substitute browser/requester custody.

The actual response remains solely in Pod memory. Ten deep-copied local transport fixtures alter only binding.purpose to readback, enforcement, unknown, null, false, zero, list, object, true or whitespace. They require invalid_decision and no retained decision_json. All original other fields remain unchanged; the captured response itself remains unchanged. No second provider request is sent, and these transformed copies are explicitly labelled fixtures. A test result must never imply the real provider actually emitted an advisory decision.

No Store, Runtime, admin, dispatcher, lifecycle service or delivery worker is constructed. The probe creates no SQLite record, queries no native DB, starts no listener and changes no runtime image/config/credentials. Child exceptions, provider bodies, request identity details, headers/config/token bytes and paths are withheld; only a closed fixed boolean/count/version/effect metadata receipt may reach the coordinator. Failure prints one fixed refusal and exits1.

Authority assessment

The posted packet at owner commitbc6494 is unaccepted. Its frozen helper and 20 documents distinguish actual-provider acceptance as a later T04 gate, but this additional exact source and its one native provider call are not part of that hash-bound execution bundle. Do not treat owner technical review, public source publication, a PENDING template or generic installed verification as approval to execute this new probe. Root must retain a separately scoped exact founder go naming probe digest, Pod/SA/caller/readonly action, telemetry effect, expected denial/ten transformed fixtures and receipt limits before execution. If executing after an earlier packet acceptance, record this as separate exact verification authorization; never mutate accepted memo bytes or backfill it. The owner can prepare this reversible source without that future live authority.

A successful real invocation gives a bounded provider-derived denial mechanism receipt only. T04 still needs actual authorized native lifecycle/binding preservation through an already authenticated admitted caller or real human, with existing subject/assurance evidence. If that evidence/route is unavailable, report the gate, preserve truthful denial and do not invent claims or score it closed. This preparation creates no new grant, credential route or native allow.