Enforce declared human controls at approval binding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/evidence/2026-09-10-human-control.json

@@ -0,0 +1,47 @@
+{
+  "status": "source-tests-passed",
+  "ruling": "GH-DEC-2026-016",
+  "schema_version": 5,
+  "new_cases_failed_before": 22,
+  "new_cases_passed_after": 22,
+  "full_suite_passed": 152,
+  "tests": "tests/test_human_control.py",
+  "semantics": {
+    "create": "Records declared intent on an unapproved request; service/agent requesters remain permitted under approval:create",
+    "bind": "Verified human required before insertion/issuance for declared human controls",
+    "legacy": "False, no inference from existing human entries",
+    "supersession": "Declaration inherited; mismatched existing successor conflicts atomically",
+    "identity": "RS256/JWKS verifies principal_type; entry body cannot spoof it",
+    "issuer_contract_source": "f9812ab3b2bfe8f0817185f44071e612264ec3ee:src/internal/server/oidc/token.go",
+    "persistence_proof": "Temporary on-disk v4 database migrated to v5; preserved records/digests",
+    "outbox": "Human bind and issuance roll back together",
+    "act_digest": "Unchanged five-field digest"
+  },
+  "consumer_compatibility": {
+    "status": "passed",
+    "cases": [
+      {
+        "human_control": false,
+        "existing_consumer_accepts_additive_field": true
+      },
+      {
+        "human_control": true,
+        "existing_consumer_accepts_additive_field": true
+      }
+    ],
+    "native_calls": 0,
+    "human_control_required_by_existing_consumer": false,
+    "limit": "This proves wire compatibility only. The pilot requester/PEP must explicitly declare and require human_control; current consumer admission is not changed."
+  },
+  "native_issuer_proof": false,
+  "production_migration": false,
+  "factory_attempts": 0,
+  "residual_records": [
+    "APPROVAL-WP-0002-T01",
+    "APPROVAL-WP-0002-T03",
+    "APPROVAL-WP-0002-T05",
+    "SECRETS-WP-0009-T03",
+    "INFD-WP-0001-T08",
+    "HFACT-WP-0001-T01/T03/T04/T05"
+  ]
+}