Close-down checklist: fetch gate deployed with correct policy; informed-decision intake relaxations R1-R8 as rows 7-14

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-close-down-checklist.md

@@ -7,10 +7,18 @@ Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothi
 
 | # | Control | Current state (build mode) | Re-arm at close-down | Owner | Added |
 |---|---------|---------------------------|----------------------|-------|-------|
-| 1 | Warden secret-fetch policy check (`check_fetch_policy`) | Misrouted to the ops-warden SSH signing pin; caller auth there binds only `ops-warden`, so every other owner gets 403. Bug reports: ops-warden `faf11061`, access-engine `b792c5d0`. access-engine built a separate pin `flex-auth-ops-warden-fetch` (package `ops-warden.secret.read` v1, allowed set generated from the routing catalog, deny by default, caller auth enforced; access-engine `02b15a7`). Not deployed (needs founder go, ADHOC-2026-10-03 T02). ops-warden still has to send fetch checks to `:19091`. | Fetch checks go to an evaluator with an explicit secret-read policy per owner system, deny by default, caller auth enforced; positive and negative evidence recorded. | ops-warden, access-engine | 2026-10-03 |
-| 2 | informed-decision posing path | Each memo needs an attended requester login, a hand-edited exact-record admission package and a manual store load. The redesign to agent-posed memos is wanted but not started (blocked by the harness). | Attribute-based admission and workload-identity intake, with humans-only binding, MFA freshness, one question per memo and audit evidence verified. | informed-decision, access-engine, approval-engine | 2026-10-03 |
+| 1 | Warden secret-fetch policy check (`check_fetch_policy`) | Misrouted to the ops-warden SSH signing pin; caller auth there binds only `ops-warden`, so every other owner gets 403. Bug reports: ops-warden `faf11061`, access-engine `b792c5d0`. access-engine built a separate pin `flex-auth-ops-warden-fetch` (package `ops-warden.secret.read` v1, allowed set generated from the routing catalog, deny by default, caller auth enforced; access-engine `02b15a7`). Deployed 2026-10-03 (access-engine `424f1e5`, release `flex-auth-ops-warden-fetch`, ClusterIP 10.43.151.3, tunnel `:19091`). Probes: allow ×2; deny `unknown_need`, `wrong_system`, `wrong_resource_type`; unbound system 403; no token 401. ops-warden routes fetch checks there (`7d4381e`, live `fetch_flex_auth_url` set). The gate is armed with a correct policy; its residuals are rows 5 and 6. | Fetch checks go to an evaluator with an explicit secret-read policy per owner system, deny by default, caller auth enforced; positive and negative evidence recorded. | ops-warden, access-engine | 2026-10-03 |
+| 2 | informed-decision posing path | Each memo needs an attended requester login, a hand-edited exact-record admission package and a manual store load. Redesign specified in informed-decision `docs/specs/FrictionlessDecisionIntake.md`, workplan INFD-WP-0005 (`a973d36`; intake validation and hub write-back built and tested, nothing deployed). Its build-mode relaxations are rows 7–14; mark each live as it lands. | Attribute-based admission and workload-identity intake, with humans-only binding, MFA freshness, one question per memo and audit evidence verified. | informed-decision, access-engine, approval-engine | 2026-10-03 |
 | 3 | State Hub qualifier sync (C-41) | `statehub fix-consistency` reports PASS without pushing wait qualifiers; the direct checker run works. Reported: state-hub `70d08f35`. | CLI path fixed and covered by a regression test; hub decision and gate data trusted again. | state-hub | 2026-10-03 |
 | 4 | Provenance of `platform/workloads/tenant-engine/audit-core-sender` v1 | Value is correct (`already_identical`), but nothing records who first seeded it. | Audit-trail entry reconstructed or the secret rotated under a recorded lane. | railiance-platform, ops-mason | 2026-10-03 |
 | 5 | Fetch-pin subject identity | `subject.id` is asserted by warden (its subject env, or `operator`). The caller binding proves ops-warden asked, not which human operator did. | Bind the subject to an attended human identity (KeyCape/NetKingdom claim) on fetch checks. | access-engine, ops-warden | 2026-10-03 |
 | 6 | Fetch-pin lane set baked into the image | Any change to a secret lane in the catalog needs a regeneration (`tools/gen_ops_warden_fetch.py`) and an image rebuild. A new owner system also needs a binding redeploy. secrets-engine owns no lane and has no binding yet. | Lane changes flow through a reviewed regeneration pipeline, or the policy data is loaded at runtime with integrity checks. | access-engine | 2026-10-03 |
+| 7 | informed-decision intake submitters (R1) | Posing is no longer operator-gated: any listed intake submitter can put a memo in front of the founder. Not yet live (INFD-WP-0005). | Submitter and memo-class lists are reviewed data with a signed regeneration path. | informed-decision, access-engine | 2026-10-03 |
+| 8 | Posing via State Hub (R2) | Workstation agents pose through State Hub, whose API is unauthenticated on the loopback tunnel; `drafted_by` is asserted. Not yet live. | The hub authenticates its writers before forwarding; the forwarded submitter carries that identity. | state-hub | 2026-10-03 |
+| 9 | Admission on carried context (R3) | The decision point decides on context the review service carries (approval requester, human_control, digest, submitter, class). Not yet live. | access-engine verifies a signed approval-engine claim and a signed intake receipt itself. | access-engine, approval-engine, informed-decision | 2026-10-03 |
+| 10 | Requester client credential custody (R4) | The `informed-decision-sitting-requester` client credential moves from attended custody into workload custody (ESO into the review pod). Not yet live. | Rotation schedule, ESO read audit, sibling-path denial proof. | railiance-platform | 2026-10-03 |
+| 11 | Admission data baked into the image (R5) | Admitted classes and submitters are baked into the access-engine image. Not yet live. | Runtime-loaded policy data with integrity checks, or a reviewed regeneration pipeline (as row 6). | access-engine | 2026-10-03 |
+| 12 | Hub decision write-back (R6) | Answered memos resolve hub decisions through the unauthenticated hub API. Not yet live. | The hub requires the informed-decision workload identity on resolve and records it. | state-hub | 2026-10-03 |
+| 13 | Approval create idempotency (R7) | No idempotency key on approval create; a crash can leave orphan draft approvals. Not yet live. | Idempotent approval create. | approval-engine | 2026-10-03 |
+| 14 | Founder notification channel (R8) | The founder is notified only through the hub inbox. Not yet live. | An authenticated notification channel carrying only id and question. | informed-decision | 2026-10-03 |