fix(contract): pin action authorization digest

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81

examples/caring/action_authorization.json

@@ -87,7 +87,7 @@
       "context": {
         "purpose": "contract-test"
       },
-      "request_digest": "sha256:15a07a9ca41df90f0a97568ecb3547bb9a75b8b04bb96a7197e86fe4589c1f45"
+      "request_digest": "sha256:73d5d7d5b3363f1a1db8f4c0e79c8f33dae5d77ffb97f21e449438bc0defa4c3"
     },
     "provenance": {
       "evaluator": "flex-auth/local",

pkg/api/canonical_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"reflect"
 	"testing"
 
 	"gopkg.in/yaml.v3"
@@ -105,6 +106,10 @@ func TestActionAuthorizationExampleParses(t *testing.T) {
 	if authorization.Approvals.RequiredCount != 2 || len(authorization.Approvals.Entries) != 2 {
 		t.Fatalf("Approvals = %+v; want two-person approval", authorization.Approvals)
 	}
+	wantBinding := api.NewDecisionBinding(authorization.Request)
+	if !reflect.DeepEqual(authorization.Decision.Binding, wantBinding) {
+		t.Fatalf("Decision.Binding = %+v; want canonical binding %+v", authorization.Decision.Binding, wantBinding)
+	}
 }
 
 func TestSchemaFilesAreJSON(t *testing.T) {

workplans/FLEX-WP-0017-action-bound-authorization-contract.md

@@ -47,6 +47,12 @@ Publish `schemas/action_authorization.schema.json` and
 `docs/action-bound-authorization-contract.md`, including exact target mapping,
 validity, distinct approvals, supersession, and fail-closed outage semantics.
 
+Corrective verification 2026-08-23: secrets-engine detected that the example's
+stored request digest predated its final request shape. The fixture now carries
+the digest produced by `NewDecisionBinding`, and the API test compares the full
+published binding to a freshly generated canonical binding so future fixture
+drift fails the suite.
+
 ## Add durable storage and authenticated approval evidence
 
 ```task