approval-engine/docs/flex-auth-handoff.md

# Handoff for `access-engine` / `FLEX-WP-0017`

`FLEX-WP-0017` T03 waited on a durable object that was not the State Hub
`/decisions/{uuid}` shape. That object is this engine.

## What exists

- Claim contract: [`approval-claim.md`](approval-claim.md)
- Introspection: `GET /v1/approvals/{id}/claim`
- Object: `POST /v1/approvals`, entries, revoke, supersede
- Consumption: `POST /v1/approvals/{id}/consume`, called by the PEP before the
  protected side effect under `GH-DEC-2026-003`
- Native `binding.digest` plus optional `binding.pdp_digest` for
  `NewDecisionBinding.request_digest`

T03 is unblocked on the **object**, not on a hub substitute. Validate the
claim before privileged production actions. Fail closed if this engine is
unreachable.

## Consumption contract

Gate House settled ordering in `GH-DEC-2026-003` and
`docs/contracts/approval-consumption.md`. The PEP presents the decision
binding's `request_digest` and consumes by CAS before the protected side
effect. A same-digest retry is idempotent success; a different digest conflicts;
there is no unconsume. `access-engine` remains read-only and never calls this
mutation.

Canon T-06 against this implementation: `tests/test_t06_replay.py` (wrong
target, wrong action, later time, revoked, superseded, same-digest retry, and
different-digest consume replay).