tegwick 1a920a5490 Confirm the approval-claim as the step-1 PEP artifact ... approval-engine raised APPROVAL-IN-0002: secrets-engine's PEP validator expects a flex-auth ActionAuthorization but fetches the approval-claim endpoint that GH-DEC-2026-003 names as step 1. Two objects on one path. GH-IN-0002 records the intake; GH-DEC-2026-005 resolves it. The claim is the step-1 artifact and always was — ActionAuthorization is unratified, has no valid_now field, and cannot be served from a step-1 call. The addition beyond confirmation is doctrine: a PEP validates each artifact against the layer that owns its data, and no PIP republishes the PDP's decision. The provenance.authority == "state-hub" requirement is struck; State Hub is a read model and holds no runtime approval authority. docs/contracts/approval-consumption.md carries the amendment at the sequence itself so implementers find it there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 425128@bnt-lap001 Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63		2026-09-06 01:29:28 +02:00
..
intakes.md	Confirm the approval-claim as the step-1 PEP artifact	2026-09-06 01:29:28 +02:00