Record authenticated caller in the decision envelope.

FLEX-WP-0023-T04: provenance.caller is additive (mode required;
principal/audience/not_after when a token was reviewed). TokenReview
keeps the JWT exp. request_digest is unchanged because the caller is
not binding material.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

pkg/api/canonical.go

@@ -571,6 +571,18 @@ type DecisionProvenance struct {
 	DirectoryETag          string            `json:"directory_etag,omitempty"             yaml:"directory_etag,omitempty"`
 	InputClaimDigests      map[string]string `json:"input_claim_digests,omitempty"        yaml:"input_claim_digests,omitempty"`
 	DecisionTime           string            `json:"decision_time,omitempty"              yaml:"decision_time,omitempty"`
+	Caller                 *CallerProvenance `json:"caller,omitempty"                     yaml:"caller,omitempty"`
+}
+
+// CallerProvenance records how the request was authenticated to flex-auth.
+// It is not decision material: the same request from a different authenticated
+// caller must decide identically. Mode is required. Under disabled the object
+// is {"mode":"disabled"} with no principal (FLEX-DEC-2026-009).
+type CallerProvenance struct {
+	Mode      string `json:"mode"                 yaml:"mode"`
+	Principal string `json:"principal,omitempty" yaml:"principal,omitempty"`
+	Audience  string `json:"audience,omitempty"  yaml:"audience,omitempty"`
+	NotAfter  string `json:"not_after,omitempty" yaml:"not_after,omitempty"`
 }
 
 // CaringDecisionMetadata carries CARING descriptor and conformance details in