informed-decision/workplans/ADHOC-2026-10-03.md

id	type	title	domain	repo	status	owner	created	updated	related	state_hub_workstream_id
INFD-WP-ADHOC-2026-10-03	workplan	Provisioning-window sitting draft for hub decision D1	infotech	informed-decision	blocked	claude	2026-10-03	2026-10-03	CUST-WP-0075	e7923574-d226-53db-befb-dd7dcba817bb

Draft the provisioning-window sitting

id: INFD-WP-ADHOC-2026-10-03-T01
status: done
priority: high
state_hub_task_id: "8aa74d26-6a65-5881-8572-c5bde1069b96"

Dispatched by the-custodian under CUST-WP-0075. The founder wants hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1, attended OpenBao provisioning window) approved through informed-decision. Batch: docs/batches/2026-10-03-provisioning-window/ (generator tools/prepare_provisioning_window_batch.py, operator steps in its OPERATOR.md). Five candidate lanes were read against owner source. One memo, infd-20261003-p01 (RPF-WP-0035-T06, acceptance of the CCR-2026-0019 scoped delivery proof), was drafted. MASON-WP-0007-T05, RPF-WP-0035-T02, RPF-WP-0035-T08 and RAPPCOREHUB-WP-0003-T04 were excluded with reasons in the batch index. Unsigned; no approval created, nothing submitted.

Circulate and bind the sitting

id: INFD-WP-ADHOC-2026-10-03-T02
status: wait
needs_human: true
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
blocking_reason: "Approval creation and v7 policy/review rollout complete; remaining: load p01 for the verified human recipient, then founder disposition at decisions.coulomb.social."
priority: high
state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"

Agents do not create the approval, admit the record, or bind. After the human disposition, record the receipt under docs/evidence/ and update sitting.json.

Coaching progress — 2026-10-03

A1 dry run passed. Founder completed A3 at 17:08 UTC. Receipt docs/evidence/2026-10-03-provisioning-window-approval-create.json records one requested human-control approval with no entries: 706f4205-aaa7-44f6-be30-d0f57664d69c, carrying the native digest sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4. Binding fields match the reviewed intent. Validity ends 2026-10-04 17:08 UTC.

A4 preparation: docs/batches/2026-10-03-provisioning-window/access-engine-v7.patch adds only p01 to the policy and record manifest, advances v6 to v7, and preserves all 16 existing act records. It is a candidate for access-engine; no owner files or live policy were changed. Policy publication/deployment, load and human answer remain outstanding. This memo alone does not resolve hub decision D1.

Offline candidate validation: 795 actual-evaluator checks passed, including p01 and all existing records. The harness's 12-hour-boundary timestamp was refreshed per list record in the temporary validation copy to avoid wall-clock aging during the run; the policy MFA limits were unchanged. Embedded policy validation/tests also passed. Candidate package digest: sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7. Evidence: docs/evidence/2026-10-03-provisioning-window-policy-candidate-checks.json and docs/evidence/2026-10-03-provisioning-window-admission-candidate.json.

A4 publication: founder applied the tested patch. Access-engine committed and synced it as f946c7b; CI published image sha256:f6fa2062f7095e66c7a91f20cd130914b5481d46d9d909339e028f7ecdf0065d. Published-image evaluation confirms v7 and the expected package digest. Deployment values are pinned in access-engine commit 20ea612. docs/batches/2026-10-03-provisioning-window/DEPLOY-v7.md records the concrete policy/review rollout candidate, namespace-scoped preflight and rollback. Live rollout awaits founder approval. Load and human disposition remain open.

A4 live rollout completed on founder instruction "deploy v7": ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Helm revision 8 is deployed; authenticated workload live checks permit exact p01 and refuse wrong group, unknown memo, changed digest and absent caller token. Review Deployment references informed-decision-runtime-b800648bd80b; public health/readiness return 200 and sign-in redirects to KeyCape (303). deploy/sitting-admission.json now declares the deployed v7 pin. Evidence: docs/evidence/2026-10-03-provisioning-window-live-policy-checks.json and docs/evidence/2026-10-03-provisioning-window-review-readiness.json. A5 load and A6 human disposition remain outstanding; no presentation or human act was performed by the rollout or probes.

A5 preparation: the existing live presentation records identify one historical KeyCape reviewer subject, uid=platform-root,ou=people,dc=netkingdom,dc=local. Pinned memo/packet copies for this recipient are prepared under the sitting's bound/ directory. A temporary offline-store load passed with no presentations or dispositions. Live store inspection confirms p01 is not yet loaded. The approved rollout covered policy and review configuration; live memo loading remains a separate pending step.