informed-decision/workplans/INFD-WP-0004-comfortable-decision-review.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	origin	origin_ref	state_hub_workstream_id
INFD-WP-0004	workplan	Comfortable decision review — a `list` action for the overview	infotech	informed-decision	active	claude	netkingdom	2026-09-21	2026-09-21	INFD-WP-0003 INFD-IN-0005 INFD-IN-0008	demand	founder 2026-09-21: 'We should be able to review comfortably though.'	2a57162a-85ad-5fd6-87d5-1e89ae2e0782

Comfortable decision review

The INFD-WP-0003 overview is live, but in production every row shows "The permission service refused access", even after a fresh sign-in. Each row asks Flex Auth for read. The served informed-decision.compact-sitting v2 package gates read with a bar designed for binding:

• The rule requires assurance.at to be at most 900 seconds old. KeyCape carries earlier authentication timestamps forward (INFD-IN-0005), so a browsing session rarely meets it.
• The package does not name the three SECRETS-WP-0010-T03-* memos at all.

The founder wants to be able to review decisions comfortably. The plan is to split seeing your decisions from reviewing one for binding:

• Add a new consumer action, list, with limited disclosure. It has a comfortable identity bar, and flex-auth admits it.
• read and every act keep their strict bar.

Establish why today's rows are refused

id: INFD-WP-0004-T01
status: wait
priority: high
state_hub_task_id: "513e91cf-6063-5a39-9f4d-af3976bb29a8"

Waiting on the operator's read-only query of the live policy_observations: auth_age_s, groups, level and methods for the latest checks. If the age is over 900, INFD-IN-0005 is confirmed as the cause for the eight sitting memos. If a group, level or method differs from the rule, that is a separate identity regression and needs fixing regardless of list. Record the finding under docs/evidence/.

Request the list policy from flex-auth

id: INFD-WP-0004-T02
status: progress
priority: high
state_hub_task_id: "3d5f51ac-c226-5489-bfb6-d5829c70e6f6"

The request is drafted in docs/flex-auth-request-list-action.md and recorded as INFD-IN-0008, owned by flex-auth. Send it to the flex-auth inbox once the founder approves the draft. Done when flex-auth publishes a package, version and digest that answers list, with fixtures.

Consumer side: list action and limited-disclosure overview

id: INFD-WP-0004-T03
status: todo
priority: high
state_hub_task_id: "e13ef7d2-bac0-5e2b-930d-4368e77bf1cb"

• Add list to policy.ACTIONS and to docs/flex-auth-review-contract.md.
• The overview asks list per row instead of read. It renders only the memo id and version, the question, the live engine status, and the person's own responses (verb, version, time and submission state; no notes).
• The review page keeps read, and every act keeps its own action.
• Tests: list allowed while read is denied still shows the rows, and opening one is still refused; a list deny redacts the row; no brief, packet or notes leak on the home page.

This task can be built and tested against fixtures before T02 lands, but it must not be deployed before T02. The live v2 package denies list, so deploying early would change nothing visible.

Admit and roll out

id: INFD-WP-0004-T04
status: wait
priority: high
state_hub_task_id: "65d6dd6e-208a-54ee-93c0-40b6ab1d8adf"

After T02, update deploy/sitting-admission.json with the new package, version and digest. The operator then applies the configuration and the image built from T03. Verify that the overview shows all eleven memos without a fresh MFA, that opening a memo still enforces the strict read rule, and record the rollout in docs/evidence/.