Finish approval engine spine

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2
This commit is contained in:
tegwick 2026-09-01 23:45:48 +02:00
parent e7c210bf56
commit c3f1dfbc07
18 changed files with 526 additions and 75 deletions

View file

@ -185,8 +185,10 @@ frontmatter and `layer.yaml`.
- Answer "is this approval valid for this exact binding, and has it been used?"
Never "may this actor do X".
- Do not implement consumption until `GH-WP-0002-T06` / `APPROVAL-WP-0001-T05`
settles the contract with `access-engine`.
- Consumption follows `GH-DEC-2026-003` and
`gate-house/docs/contracts/approval-consumption.md`: the PEP consumes by CAS
before the protected side effect; same-digest retries are idempotent,
different digests conflict, and there is no unconsume.
- The outbox is local. Do not emit synchronously to `audit-core` inside a
mutation transaction.
- Approval evidence is load-bearing. Atomicity covers crash, not compromise.