tegwick 62233c7c52 Say what the tenant check is, and what view_hash is not ... gate-house (GH-DEC-2026-013) was right that our wording implied a fact about the person. The tenant comparison is store isolation — does this caller belong to the store this engine serves — and a registration- supplied claim satisfies that while satisfying no doctrine about the approver's own membership. Exact equality cannot see the difference, so state it, and note that provenance gets recorded on the entry the way v4 records principal_type once the claim carries it. Answer informed-decision's R3 in the claim contract: view_hash and binding.digest answer different questions and must not be merged. Three hashes, three questions. Recommend their binding document carry our digest rather than re-canonicalize the same five fields, so the act has one canonicalization and a mismatch is detectable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HyybaE7DUXrWYrhbnESCTe Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275879@bnt-lap001 Assistant-Session: eb464208-f821-41b2-bc5a-a6c33d92a8ad		2026-09-10 07:56:28 +02:00
..
APPROVAL-WP-0001-v07-alignment-and-engine-spine.md	Finish approval engine spine	2026-09-01 23:45:48 +02:00
APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md	Say what the tenant check is, and what view_hash is not	2026-09-10 07:56:28 +02:00