Finish approval engine spine

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e2e-805b-7042-a750-71f473bceea2

SCOPE.md

@@ -20,8 +20,8 @@ whether the action is permitted, does not author the policy that requires an
 approval, and does not archive the trail.
 
 The first cut is the spine that makes Canon `T-06 — Approval Replay` passable
-and unblocks `FLEX-WP-0017` T03/T05 — and nothing that has to guess a contract
-the other side has not assented to.
+and supplies the approval object and consumption mutation needed by protected
+systems. Consumption follows the assented `GH-DEC-2026-003` contract.
 
 ## In Scope
 
@@ -34,6 +34,8 @@ the other side has not assented to.
   `superseded / revoked / expired` as terminal exits from `valid`.
 - Atomic supersession and single consumption (compare-and-swap, never
   read-then-write).
+- A PEP-called consume mutation before the protected side effect, with
+  same-request idempotency, different-request conflict, and no unconsume.
 - Revocation that does not require the holder's cooperation and is effective
   at the next use.
 - A local transactional outbox in this engine's own store; no synchronous
@@ -64,9 +66,9 @@ the other side has not assented to.
 - A general state-machine service for other concepts.
 - PEP shape, unreachable-engine stance maps, Railiance `rail-*` / `rapp-*` /
   `reef-*` axes. An approval is not a workload (statute §20.1).
-- Consumption signaling relative to the decision, until `GH-WP-0002-T06`
-  settles it with `access-engine`. Guessing that contract is out of scope
-  even as a prototype.
+- Any consumption protocol other than `GH-DEC-2026-003`, including PDP
+  mutation, action-before-consume, unconsume, reserve/release, or inferring use
+  from a decision record.
 
 ## Relevant When
 
@@ -89,7 +91,8 @@ the other side has not assented to.
 - The need is a workflow inbox, a meeting, or a notification surface.
 - The need is graded readiness or a maturity ladder.
 - The work is mapping Railiance operational axes onto security objects.
-- Consumption ordering is being "solved" from this side alone.
+- A caller wants to consume without presenting the PDP decision binding's
+  canonical request digest.
 
 ## Current State
 
@@ -97,8 +100,8 @@ the other side has not assented to.
   outbox, WSGI introspection API, claim contract. Not a production deploy.
 - Layer declaration: INTENT frontmatter + `layer.yaml`. Cadence declared in
   `cadence.yaml`. No Tooling contacts.
-- Consumption is not a public API (`APPROVAL-WP-0001-T05` waits on
-  `GH-WP-0002-T06`).
+- Consumption is public at `POST /v1/approvals/{id}/consume` under
+  `GH-DEC-2026-003`; the endpoint is a lifecycle mutation, never a decision.
 - Taxonomy request-claim schema is still unassigned; the local claim yields.
 - Work: `APPROVAL-WP-0001`. Tests: `make test`.
 
@@ -158,8 +161,8 @@ type: api
 title: Approval object lifecycle
 description: >
   Create, collect authenticated entries with distinct-approver counting,
-  atomically supersede, and revoke without holder cooperation. No public
-  consume until consumption ordering is settled.
+  atomically supersede, consume with request-digest idempotency, and revoke
+  without holder cooperation.
 keywords: [approval, state-machine, cas, revocation, supersession]
 ```