informed-decision/docs/batches/2026-10-14-three-attempts/OPERATOR.md

Three-attempt spend sitting — operator packet

Memo infd-20261014-b01 (REINAH-WP-0008-T07): up to three metered Glas attempts, EUR 10 in total and EUR 5 per attempt, observed-usage settlement, until 2026-10-31. Drafted in ee6a65b. Not created, admitted or loaded. An agent may not create the approval, bind an identity, accept, decline or seal.

Why the owner sees nothing (2026-10-15)

No hub decision exists for this memo, and the hub has nothing to resolve. The memo appears only when a review record exists on decisions.coulomb.social. On 2026-10-15 none existed: no native approval had been created, no Flex Auth record admitted it and no review store had loaded it.

File checks passed on 2026-10-15 without credentials or network access:

• tools/create_sitting_approvals.py --dry-run --sitting 2026-10-14-three-attempts --expect 1 --receipt <unused> listed exactly one postable intent, infd-20261014-b01, with nothing skipped.
• The packet digest matches the memo (sha256:cd6da37f6ee41fd5ade7e282622d3d08788683ffc1ecadaabe527d321ecfe839).

Owner path, following the 2026-09-27 precedent infd-20260927-b02

1. Create the approval (attended). Open a Warden attended-login shell, so that HOME is under .warden-attended-login and BAO_TOKEN and VAULT_TOKEN are unset. Forward approval-engine to 127.0.0.1:18281, then run:

   ~/informed-decision/tools/create_sitting_approvals.sh \
     --sitting 2026-10-14-three-attempts --expect 1 \
     --receipt 2026-10-15-three-attempt-budget-create.json
   

   The receipt lands in docs/evidence/ with status: created and an approval id. The approval's validity window starts at create time. The 2026-09-27 approval was valid for 24 hours, so finish steps 2–4 promptly.

2. Admit the exact record in Flex Auth (production policy rollout). Add the memo:

   • memo:infd-20261014-b01
   • approval_id, taken from the receipt
   • binding_digest, taken from the receipt
   • the five-field binding

   to ~/access-engine/examples/informed-decision-sitting/records.json and to the mandate set that the deployed compact-sitting package is built from. Then roll the new package digest out through the owning Helm/Argo workflow, and update deploy/sitting-admission.json. Without this step the review page refuses the memo.

3. Bind and load. Write the bound copy using the live KeyCape subject (for 2026-09-27 this was uid=platform-root,ou=people,dc=netkingdom,dc=local):

   cd ~/informed-decision && .venv/bin/python -B tools/attach_compact_bindings.py \
     --principal '<live KeyCape subject>' \
     --receipt docs/evidence/2026-10-15-three-attempt-budget-create.json \
     --sitting 2026-10-14-three-attempts --batches budget
   

   Then load docs/batches/2026-10-14-three-attempts/bound into the live review store with tools/load_sitting_memos.py --db <live store> --bound <dir>, using the store's own custody path.

4. Accept (human only). Go to https://decisions.coulomb.social/review?memo_id=infd-20261014-b01, signed in as the platform reviewer with fresh MFA.

5. Record the acceptance receipt in docs/evidence/. Rein then uses the approval id as authority_ref for owner renew (REINAH-WP-0008-T07 step 4).

Alternative: the lifecycle intake path

This is the normal path since 2026-10-05 (deploy/lifecycle/README.md). It needs no per-record Flex Auth rollout. A trusted in-cluster workload (system:serviceaccount:state-hub:state-hub) registers, publishes and requests review, and then explicitly enqueues the envelope in the State Hub memo dispatcher. The 2026-10-05 dependency-roots sitting is the precedent.

The intake admits only class decision-record. The resulting review approval binds the review record, not the five-field spend-envelope binding above, so the owner must agree that it is valid spend authority before this path is used.

Queued 2026-10-15 (lifecycle intake path)

The owner chose the intake path and agreed that the review-record approval is valid spend authority. Workspace draft 2ccb4bda-e318-51d2-a8dd-709db768494f was published to net-kingdom-admins; the review request review-e2d2e98f-4701-45b0-abc1-4fe9f00bd1a8 was queued by the owner in the State Hub memo dispatcher. Approval intent: accept by helixforge-factory. The scope id carries a leading space (" spend-envelope:hfact-glas-tool-proof-20261014-three-attempts"); intake accepts it and no rein-aharness check compares it. The packet digest is sha256:066036f3… (same text as the drafted packet, CRLF line endings). The compact-sitting approval create above was not used. Not accepted yet; the accepted approval id becomes authority_ref for owner renew. BROWSER-FILL.md is the fill sheet used for the workspace entry.