**Owner:** the-custodian, on behalf of the founder. **Started:** 2026-10-03.
**Purpose:** while the estate is in build mode (orientation §0), agents may fix, simplify or relax parts of the security layer. Every such relaxation, and every control known to be unarmed, is listed here. At the production close-down the founder works this list, arms each item, and hands over the keys. After that, changes to the security system need elevated clearance.
Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothing; mark items armed with date and evidence.
| # | Control | Current state (build mode) | Re-arm at close-down | Owner | Added |
| 1 | Warden secret-fetch policy check (`check_fetch_policy`) | Misrouted to the ops-warden SSH signing pin; caller auth there binds only `ops-warden`, so every other owner gets 403. Bug reports: ops-warden `faf11061`, access-engine `b792c5d0`. access-engine built a separate pin `flex-auth-ops-warden-fetch` (package `ops-warden.secret.read` v1, allowed set generated from the routing catalog, deny by default, caller auth enforced; access-engine `02b15a7`). Deployed 2026-10-03 (access-engine `424f1e5`, release `flex-auth-ops-warden-fetch`, ClusterIP 10.43.151.3, tunnel `:19091`). Probes: allow ×2; deny `unknown_need`, `wrong_system`, `wrong_resource_type`; unbound system 403; no token 401. ops-warden routes fetch checks there (`7d4381e`, live `fetch_flex_auth_url` set). The gate is armed with a correct policy; its residuals are rows 5 and 6. | Fetch checks go to an evaluator with an explicit secret-read policy per owner system, deny by default, caller auth enforced; positive and negative evidence recorded. | ops-warden, access-engine | 2026-10-03 |
| 2 | informed-decision posing path | Each memo needs an attended requester login, a hand-edited exact-record admission package and a manual store load. Redesign specified in informed-decision `docs/specs/FrictionlessDecisionIntake.md`, workplan INFD-WP-0005 (`a973d36`; intake validation and hub write-back built and tested, nothing deployed). Its build-mode relaxations are rows 7–14; mark each live as it lands. | Attribute-based admission and workload-identity intake, with humans-only binding, MFA freshness, one question per memo and audit evidence verified. | informed-decision, access-engine, approval-engine | 2026-10-03 |
| 3 | State Hub qualifier sync (C-41) | `statehub fix-consistency` reports PASS without pushing wait qualifiers; the direct checker run works. Reported: state-hub `70d08f35`. | CLI path fixed and covered by a regression test; hub decision and gate data trusted again. | state-hub | 2026-10-03 |
| 4 | Provenance of `platform/workloads/tenant-engine/audit-core-sender` v1 | Value is correct (`already_identical`), but nothing records who first seeded it. | Audit-trail entry reconstructed or the secret rotated under a recorded lane. | railiance-platform, ops-mason | 2026-10-03 |
| 5 | Fetch-pin subject identity | `subject.id` is asserted by warden (its subject env, or `operator`). The caller binding proves ops-warden asked, not which human operator did. | Bind the subject to an attended human identity (KeyCape/NetKingdom claim) on fetch checks. | access-engine, ops-warden | 2026-10-03 |
| 6 | Fetch-pin lane set baked into the image | Any change to a secret lane in the catalog needs a regeneration (`tools/gen_ops_warden_fetch.py`) and an image rebuild. A new owner system also needs a binding redeploy. secrets-engine owns no lane and has no binding yet. | Lane changes flow through a reviewed regeneration pipeline, or the policy data is loaded at runtime with integrity checks. | access-engine | 2026-10-03 |
| 7 | informed-decision intake submitters (R1) | Posing is no longer operator-gated: any listed intake submitter can put a memo in front of the founder. Not yet live (INFD-WP-0005). | Submitter and memo-class lists are reviewed data with a signed regeneration path. | informed-decision, access-engine | 2026-10-03 |
| 8 | Posing via State Hub (R2) | Workstation agents pose through State Hub, whose API is unauthenticated on the loopback tunnel; `drafted_by` is asserted. Not yet live. | The hub authenticates its writers before forwarding; the forwarded submitter carries that identity. | state-hub | 2026-10-03 |
| 9 | Admission on carried context (R3) | The decision point decides on context the review service carries (approval requester, human_control, digest, submitter, class). Not yet live. | access-engine verifies a signed approval-engine claim and a signed intake receipt itself. | access-engine, approval-engine, informed-decision | 2026-10-03 |
| 10 | Requester client credential custody (R4) | The `informed-decision-sitting-requester` client credential moves from attended custody into workload custody (ESO into the review pod). Not yet live. | Rotation schedule, ESO read audit, sibling-path denial proof. | railiance-platform | 2026-10-03 |
| 11 | Admission data baked into the image (R5) | Admitted classes and submitters are baked into the access-engine image. Not yet live. | Runtime-loaded policy data with integrity checks, or a reviewed regeneration pipeline (as row 6). | access-engine | 2026-10-03 |
| 12 | Hub decision write-back (R6) | Answered memos resolve hub decisions through the unauthenticated hub API. Not yet live. | The hub requires the informed-decision workload identity on resolve and records it. | state-hub | 2026-10-03 |
| 13 | Approval create idempotency (R7) | No idempotency key on approval create; a crash can leave orphan draft approvals. Not yet live. | Idempotent approval create. | approval-engine | 2026-10-03 |
| 14 | Founder notification channel (R8) | The founder is notified only through the hub inbox. Not yet live. gate-house F3: any hub writer could send a fake memo notice. | An authenticated notification channel carrying only id and question. | informed-decision | 2026-10-03 |
| 15 | Posing volume (gate-house F2) | With posing ungated, a submitter can flood the founder with memos; habituation would turn the human control into theatre. A per-submitter volume cap is a SHOULD in build mode. | Per-submitter volume budget enforced (MUST). | informed-decision | 2026-10-03 |
| 16 | Intake doctrine conditions (gate-house C1–C6) | Draft ruling GH-DEC-2026-023 (gate-house `aac350d`, status proposed, awaiting the founder). C1–C6 apply now; R3 (row 9) is the main relaxation (F1), R2 (row 8) also covers C6, R5 (row 11) also covers C5. | Remove the `compact-sitting` exact-record branch once its memos are terminal; re-arm R3 with an access-engine approval-claim check and a signed intake receipt. | gate-house, informed-decision, access-engine | 2026-10-03 |
| 17 | Owner reviews and approval recording (canon `delegated-owner-review_v0.1`) | Owner reviews required by CCRs and similar records are written by each owner repo's worker agent from its INTENT.md, not by a human owner. The requesting agent records the founder's resolved hub decision (status, binding confirmations, admission markers) and commits. The founder still decides; `decided_by` is unauthenticated (rows 8, 12). | Reviews and recordings signed by authenticated agent workload identities; recording tooling verifies an authenticated human resolver; human owner review restored for red-lane records if wanted. | the-custodian | 2026-10-07 |
| 19 | Fresh informed-decision readback during a failed T05 rollout | Proposed only; no exception approved or used. The new INFD-WP-0009-T05/zlib-85091-r1 packet will request manual, supervised rollback to exact image763c/sourcec96 if the candidate makes informed-decision unavailable. Proposed limits: separately confirmed founder consent retained before release, exact same journal/source/Deployment/config/PVC, at most30minutes after release and before2026-10-12T23:59:59Z. Later revocation cannot be checked during the outage. No fallback on401/403, explicit revocation, conflicts or mismatches; no cached authority for backups or release. | Close this one-use entry with actual disposition and trial outcome. Preserve the ordinary fresh-authority gate; do not reuse the outage path after its window, for another trial or for customer production. A future standing recovery mechanism needs independently obtainable authority and its own review. | informed-decision, railiance-platform; Custodian tracks | 2026-10-11 |
