tegwick
f47805bece
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 359683@bnt-lap001 Assistant-Session: eebdc939-7a9b-4e50-9d39-c8437e8a14ec
105 lines
3.7 KiB
Markdown
105 lines
3.7 KiB
Markdown
---
|
|
id: INFD-WP-0004
|
|
type: workplan
|
|
title: "Comfortable decision review — a `list` action for the overview"
|
|
domain: infotech
|
|
repo: informed-decision
|
|
status: active
|
|
owner: claude
|
|
topic_slug: netkingdom
|
|
created: "2026-09-21"
|
|
updated: "2026-09-21"
|
|
related:
|
|
- INFD-WP-0003
|
|
- INFD-IN-0005
|
|
- INFD-IN-0008
|
|
origin: demand
|
|
origin_ref: "founder 2026-09-21: 'We should be able to review comfortably though.'"
|
|
state_hub_workstream_id: "2a57162a-85ad-5fd6-87d5-1e89ae2e0782"
|
|
---
|
|
|
|
# Comfortable decision review
|
|
|
|
The `INFD-WP-0003` overview is live, but in production every row shows "The
|
|
permission service refused access", even after a fresh sign-in. Each row asks
|
|
Flex Auth for `read`. The served `informed-decision.compact-sitting` v2
|
|
package gates `read` with a bar designed for binding:
|
|
|
|
- The rule requires `assurance.at` to be at most 900 seconds old. KeyCape
|
|
carries earlier authentication timestamps forward (`INFD-IN-0005`), so a
|
|
browsing session rarely meets it.
|
|
- The package does not name the three `SECRETS-WP-0010-T03-*` memos at all.
|
|
|
|
The founder wants to be able to review decisions comfortably. The plan is to
|
|
split *seeing your decisions* from *reviewing one for binding*:
|
|
|
|
- Add a new consumer action, `list`, with limited disclosure. It has a
|
|
comfortable identity bar, and flex-auth admits it.
|
|
- `read` and every act keep their strict bar.
|
|
|
|
## Establish why today's rows are refused
|
|
|
|
```task
|
|
id: INFD-WP-0004-T01
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "513e91cf-6063-5a39-9f4d-af3976bb29a8"
|
|
```
|
|
|
|
Waiting on the operator's read-only query of the live `policy_observations`:
|
|
`auth_age_s`, groups, level and methods for the latest checks. If the age is
|
|
over 900, `INFD-IN-0005` is confirmed as the cause for the eight sitting memos.
|
|
If a group, level or method differs from the rule, that is a separate identity
|
|
regression and needs fixing regardless of `list`. Record the finding under
|
|
`docs/evidence/`.
|
|
|
|
## Request the `list` policy from flex-auth
|
|
|
|
```task
|
|
id: INFD-WP-0004-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "3d5f51ac-c226-5489-bfb6-d5829c70e6f6"
|
|
```
|
|
|
|
The request is drafted in `docs/flex-auth-request-list-action.md` and recorded
|
|
as `INFD-IN-0008`, owned by flex-auth. Send it to the flex-auth inbox once the
|
|
founder approves the draft. Done when flex-auth publishes a package, version
|
|
and digest that answers `list`, with fixtures.
|
|
|
|
## Consumer side: `list` action and limited-disclosure overview
|
|
|
|
```task
|
|
id: INFD-WP-0004-T03
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "e13ef7d2-bac0-5e2b-930d-4368e77bf1cb"
|
|
```
|
|
|
|
- Add `list` to `policy.ACTIONS` and to `docs/flex-auth-review-contract.md`.
|
|
- The overview asks `list` per row instead of `read`. It renders only the memo
|
|
id and version, the question, the live engine status, and the person's own
|
|
responses (verb, version, time and submission state; no notes).
|
|
- The review page keeps `read`, and every act keeps its own action.
|
|
- Tests: `list` allowed while `read` is denied still shows the rows, and
|
|
opening one is still refused; a `list` deny redacts the row; no brief,
|
|
packet or notes leak on the home page.
|
|
|
|
This task can be built and tested against fixtures before T02 lands, but it
|
|
must not be deployed before T02. The live v2 package denies `list`, so
|
|
deploying early would change nothing visible.
|
|
|
|
## Admit and roll out
|
|
|
|
```task
|
|
id: INFD-WP-0004-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "65d6dd6e-208a-54ee-93c0-40b6ab1d8adf"
|
|
```
|
|
|
|
After T02, update `deploy/sitting-admission.json` with the new package,
|
|
version and digest. The operator then applies the configuration and the image
|
|
built from T03. Verify that the overview shows all eleven memos without a fresh
|
|
MFA, that opening a memo still enforces the strict `read` rule, and record the
|
|
rollout in `docs/evidence/`.
|