Publish approval_binding_digest: a claim cannot name the request carrying it

secrets-engine confirmed T03, and re-verifying against the regenerated
destroy fixture found something neither repository can fix alone: a
pdp_digest recorded at issue time can never equal the request_digest of a
request that carries the claim in its context, because the claim is part
of the context that is hashed. Embedding the claim changes the very
digest the claim would need to name.

Not fixture staleness. It holds for every dual-control request whose
claim travels in context -- the shape GH-DEC-2026-008 had just ruled
mandatory. Left unresolved that ruling was unimplementable for exactly
the case it was written for, and destroy would have been permanently
un-allowable in production, failing closed forever on a check that could
never pass.

flex-auth owns the canonical request digest, so the fix is ours.
binding.approval_binding_digest is the same material with
context.approval removed, emitted only when a claim was carried. An
approval issued against a claim-free Check records that Check's
request_digest; the claim-bearing request reproduces it here.

DELIBERATELY ADDITIVE, and the reason matters. The tempting fix is to
drop context.approval from request_digest entirely. That is wrong:
request_digest is the replay identity, and two requests differing only in
which approval was presented must not share one, because their decisions
differ -- one allows, the other denies dual_control_required. Collapsing
them would let an allow obtained with a valid claim be replayed against a
request carrying none. So request_digest still covers the claim and still
moves; approval_binding_digest deliberately does not, and is documented
as not a replay identity. The tests assert the two functions DISAGREE on
a claim-bearing request, which is approval-engine's formulation of how to
defend a distinction that looks like duplication.

The fixture now demonstrates the property rather than asserting it: its
claim's pdp_digest equals the envelope's approval_binding_digest with
pdp_path true, and changing the claim's contents moved request_digest
while leaving approval_binding_digest untouched. Two files a consumer can
diff.

Also picked up approval-engine's new required binding.pdp_path via the
cross-repo schema test added yesterday -- which is the test doing exactly
what it was built for, one day later.

T03 is done. secrets-engine's own digest-material defect, which our two
real envelopes caught, is recorded in the workplan.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTbVXpEiXA7mNJVpDnEPcB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 412054@bnt-lap001
Assistant-Session: 3968fae1-8d59-4209-9bd6-c22594b8ab19

.repo-manager/index.json

@@ -2,9 +2,9 @@
   "schema": "repo_manager.index.v1",
   "slug": "flex-auth",
   "repo_root": "/home/worsch/flex-auth",
-  "head_sha": "d144feb2e9b74df39a085ce752335c1169ffac9a",
-  "observed_at": "2026-09-05T23:29:23.679186Z",
-  "source_fingerprint": "8708283bc20e40a97e9193fcf6de5b81cb3174f0cac5af6665ecc62d6c716c7e",
+  "head_sha": "9f3e7e363a11f611e13d4d798dba575c56168521",
+  "observed_at": "2026-09-06T12:52:08.174834Z",
+  "source_fingerprint": "a19f5aa8b0f293bbd5d768adaa50c8afff5c0f0be3757e1b7af62ac791ab228f",
   "source_files": [
     ".repo-classification.yaml",
     "INTENT.md",
@@ -1220,7 +1220,7 @@
     {
       "kind": "workplan",
       "id": "FLEX-WP-0021",
-      "status": "proposed",
+      "status": "active",
       "title": "secrets-engine consumer policy package and cluster-local pin",
       "source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
       "uuid": "b01f655e-f71a-50ae-b110-178557f07c63",
@@ -1230,7 +1230,7 @@
     {
       "kind": "task",
       "id": "FLEX-WP-0021-T01",
-      "status": "todo",
+      "status": "done",
       "title": "1. Obtain the real action vocabulary from secrets-engine",
       "source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
       "uuid": "3c191808-6fe5-5a9b-9a68-a4ce4a672dbd",
@@ -1240,7 +1240,7 @@
     {
       "kind": "task",
       "id": "FLEX-WP-0021-T02",
-      "status": "todo",
+      "status": "done",
       "title": "2. Publish `secrets-engine.catalog-lane.lifecycle` v1",
       "source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
       "uuid": "38770813-dfcc-5711-bba3-0db50d3af135",
@@ -1250,7 +1250,7 @@
     {
       "kind": "task",
       "id": "FLEX-WP-0021-T03",
-      "status": "todo",
+      "status": "progress",
       "title": "3. Confirm the digest join against a real decision record",
       "source_path": "workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md",
       "uuid": "8f7e5cdd-777e-5f54-9b92-c72b79f65672",
@@ -1473,7 +1473,7 @@
       "status": "resolved",
       "title": "ActionAuthorization deferral accepted; G3 is closed and does not argue for ratifying it",
       "source_path": "decisions/decisions.md",
-      "uuid": null,
+      "uuid": "762e5d75-2377-4e1a-bcea-c57398ef636b",
       "parent_id": null,
       "extra": {
         "record": {
@@ -1497,7 +1497,41 @@
           "decided_by": "flex-auth (access-engine / PDP)",
           "rationale": "Accepted, and flex-auth argues against its own proposal. The composed ActionAuthorization object was never ratified; the approval-claim plus DecisionEnvelope split lands each check on the layer that owns it and drops none. approval-engine asked whether the open G3 finding (DecisionEnvelope carries no lifetime) argues for ratifying the composed object now. It does not, because G3 is already closed the other way: FLEX-WP-0019 added lifetime to the DecisionEnvelope itself, required on every allow by schema conditional, published 2026-09-02. The revisit trigger is spent, and it resolved by adding a field rather than by composition, so the decision now stands alone and needs no bundle. Separately, the provenance.authority == state-hub constant is flex-auth defect: it came from examples/caring/action_authorization.json, which contradicted our own ownership section. Corrected at source, with the schema and contract doc marked deferred-not-withdrawn so no other consumer builds a validator against them.",
           "created": "2026-09-05T23:29:20.156770Z",
-          "updated": "2026-09-05T23:29:20.156770Z"
+          "updated": "2026-09-05T23:29:20.156770Z",
+          "state_hub_decision_id": "762e5d75-2377-4e1a-bcea-c57398ef636b"
+        }
+      }
+    },
+    {
+      "kind": "decision",
+      "id": "FLEX-DEC-2026-007",
+      "status": "resolved",
+      "title": "A claim cannot name the request that carries it: publish approval_binding_digest",
+      "source_path": "decisions/decisions.md",
+      "uuid": null,
+      "parent_id": null,
+      "extra": {
+        "record": {
+          "id": "FLEX-DEC-2026-007",
+          "kind": "decision",
+          "title": "A claim cannot name the request that carries it: publish approval_binding_digest",
+          "status": "resolved",
+          "origin": "cross-repo",
+          "origin_ref": "secrets-engine T03 re-verification / GH-DEC-2026-008",
+          "owner": "flex-auth",
+          "affects": [
+            "flex-auth",
+            "secrets-engine",
+            "approval-engine",
+            "gate-house"
+          ],
+          "requested_dispositions": [
+            "resolve"
+          ],
+          "decided_by": "flex-auth (access-engine / PDP)",
+          "rationale": "secrets-engine found that an approval pdp_digest recorded at issue time can never equal the request_digest of a request that carries the claim inside its hashed context, because the claim is part of the context that is hashed. The circularity is structural, not a fixture defect, and it made GH-DEC-2026-008 unimplementable for exactly the dual-control case it was written for. flex-auth owns the canonical request digest, so the resolution is ours. Publishing binding.approval_binding_digest: the same digest computed with context.approval removed, present only when a claim was carried, stable across attaching the claim, and therefore nameable by a pdp_digest recorded at issue. Deliberately additive rather than a redefinition: request_digest keeps covering the claim and remains the replay identity, because two requests differing only in which approval was presented must not share a replay identity when one allows and the other denies dual_control_required. Tests assert the two functions disagree on a claim-bearing request and agree on a claim-free one.",
+          "created": "2026-09-06T12:52:06.960329Z",
+          "updated": "2026-09-06T12:52:06.960329Z"
         }
       }
     },
@@ -1578,15 +1612,15 @@
       "type": "repo.command.applied",
       "command": "repo.work.create_decision",
       "operation": "create",
-      "correlation_id": "ead04d14-441f-4ecd-8ee8-12ae0cd23362",
+      "correlation_id": "e76636be-b773-46de-9bef-eb962c96cf2b",
       "kind": "decision",
-      "id": "FLEX-DEC-2026-006",
+      "id": "FLEX-DEC-2026-007",
       "git_sha": null,
       "files_touched": [
         "decisions/decisions.md"
       ],
       "source": "repo-manager",
-      "emitted_at": "2026-09-05T23:29:23.679390Z"
+      "emitted_at": "2026-09-06T12:52:08.174961Z"
     }
   ]
 }