Record authenticated caller in the decision envelope.

FLEX-WP-0023-T04: provenance.caller is additive (mode required;
principal/audience/not_after when a token was reviewed). TokenReview
keeps the JWT exp. request_digest is unchanged because the caller is
not binding material.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

schemas/decision_envelope.schema.json

@@ -228,6 +228,39 @@
         "decision_time": {
           "type": "string",
           "minLength": 1
+        },
+        "caller": {
+          "$ref": "#/$defs/caller_provenance",
+          "description": "Authenticated caller of the PDP, not decision material. Additive: request_digest is unaffected because the caller is not in binding (FLEX-DEC-2026-009)."
+        }
+      }
+    },
+    "caller_provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "mode"
+      ],
+      "properties": {
+        "mode": {
+          "enum": [
+            "disabled",
+            "warn",
+            "enforce"
+          ]
+        },
+        "principal": {
+          "type": "string",
+          "minLength": 1
+        },
+        "audience": {
+          "type": "string",
+          "minLength": 1
+        },
+        "not_after": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Reviewed token exp, RFC3339 UTC. A principal recorded under warn was observed, not enforced."
         }
       }
     },