feat(authz): bind decisions to exact actions

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

schemas/action_authorization.schema.json

@@ -0,0 +1,66 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://flex-auth.netkingdom/schemas/action_authorization.schema.json",
+  "title": "ActionAuthorization",
+  "description": "Durable approval envelope for one exact authorization request. This is a storage/transport contract; live evaluation remains POST /v1/check.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "status", "request", "validity", "approvals", "decision"],
+  "properties": {
+    "schema_version": {"const": "0.1"},
+    "id": {"type": "string", "format": "uuid"},
+    "status": {
+      "enum": ["pending", "approved", "denied", "superseded", "expired", "revoked"]
+    },
+    "superseded_by": {
+      "type": ["string", "null"],
+      "format": "uuid"
+    },
+    "request": {"$ref": "https://flex-auth.netkingdom/schemas/check_request.schema.json"},
+    "validity": {"$ref": "#/$defs/validity"},
+    "approvals": {"$ref": "#/$defs/approvals"},
+    "decision": {"$ref": "https://flex-auth.netkingdom/schemas/decision_envelope.schema.json"},
+    "provenance": {"type": "object", "additionalProperties": true}
+  },
+  "allOf": [
+    {
+      "if": {"properties": {"status": {"const": "superseded"}}},
+      "then": {"required": ["superseded_by"]}
+    }
+  ],
+  "$defs": {
+    "validity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["expires_at"],
+      "properties": {
+        "not_before": {"type": "string", "format": "date-time"},
+        "expires_at": {"type": "string", "format": "date-time"}
+      }
+    },
+    "approvals": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["required_count", "entries"],
+      "properties": {
+        "required_count": {"type": "integer", "minimum": 1},
+        "entries": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {"$ref": "#/$defs/approval_entry"}
+        }
+      }
+    },
+    "approval_entry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["subject_id", "approved_at"],
+      "properties": {
+        "subject_id": {"type": "string", "minLength": 1},
+        "approved_at": {"type": "string", "format": "date-time"},
+        "assurance": {"type": "string", "minLength": 1},
+        "evidence_ref": {"type": "string", "minLength": 1}
+      }
+    }
+  }
+}