Enforce declared human controls at approval binding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

schemas/approval_claim.schema.json

@@ -74,7 +74,8 @@
         "expired",
         "revoked",
         "superseded",
-        "consumed"
+        "consumed",
+        "human_control_unsatisfied"
       ]
     }
   },
@@ -152,6 +153,10 @@
         "pdp_path": {
           "type": "boolean",
           "description": "Whether this approval was declared at issue for the GH-DEC-2026-003 PDP consumption path. GH-DEC-2026-008 requires pdp_digest on that path, so this engine refuses to create a pdp_path approval without one; a true value therefore guarantees pdp_digest is non-null. A consumer on that path MUST require pdp_path true and MUST NOT infer path intent from a pdp_digest that merely happens to be present."
+        },
+        "human_control": {
+          "type": "boolean",
+          "description": "Declared at issue under GH-DEC-2026-016: this object discharges a human-in-the-loop or dual-control requirement. New producers always state it; absence in historical claims is undeclared, never proof of human control. True with valid_now means the required distinct approvers are verified human principals. It is separate from the five-field act digest. Consumers requiring human control must require exactly true; they must not infer it from approver identity or count."
         }
       }
     },