Enforce declared human controls at approval binding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/approval-claim.md

@@ -347,3 +347,26 @@ false, and the example set is what would have taught them — the failure
 
 `tests/test_examples.py` asserts the decorrelation, not merely that both values
 appear somewhere.
+
+
+### Declared human judgment — `binding.human_control`
+
+New producers always state this boolean. `true` records that the requester
+explicitly declared a human-in-the-loop or dual-control requirement at issue;
+`valid_now: true` then also requires the declared count of distinct verified
+human approvers. Non-human binds are refused before insertion. Undeclared objects
+remain useful for service approvals. Historical absence is undeclared, never
+proof of human judgment; a consumer needing the property must require exactly
+true, rather than infer it from an approver's name or from a valid generic claim.
+
+The declaration stays separate from the five act fields and does not change the
+native binding digest. It is inherited on supersession, emitted on audit events,
+and cannot be downgraded by linking an existing successor. The additive claim
+property stays within schema 0.1; old consumers that do not require this property
+retain their existing behavior. Consumer adoption of the new requirement and
+native issuer/deployment proof remain necessary before the factory human path.
+
+`claim.valid-human-control.json` shows a valid declared human control;
+`claim.valid.json` shows a valid ordinary approval. For an inconsistent persisted
+human-control object, `valid_now` is false with `human_control_unsatisfied` and
+consume refuses. Neither the declaration nor a claim is an authorization verdict.