Add lifecycle browser authoring and durable review handoff retrieval

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

docs/evidence/2026-10-05-lifecycle-authoring/README.md

@@ -0,0 +1,28 @@
+# Lifecycle authoring validation — 2026-10-05
+
+Source implementation evidence; this increment has not been deployed.
+
+The browser can prepare approval or discussion drafts, append immutable text
+supporting documents and required acknowledgments, compare revisions, publish,
+and download the retained review request for the admitted State Hub workload.
+The shared service also exposes exact-version handoff retrieval under the
+existing lifecycle events permission. Preparation does not create an approval;
+only a human can complete a disposition through the existing review surface.
+
+Validation:
+
+- Locked project environment, actual owner Flex Auth, Approval Engine, Audit Core
+  and State Hub sources: 669 passed, 1 skipped.
+- Final focused lifecycle UI/review/HTTP regression run: 50 passed, 2 skipped
+  (optional real-engine checks excluded from this focused run).
+- Chromium: 16 checks passed using real HTTPS and the actual lifecycle policy
+  package, with synthetic identity and TokenReview. This is fixture evidence,
+  not another native acceptance claim.
+- Desktop and mobile screenshots inspected; no viewport overflow observed.
+- Coverage includes replay, restart, stale revision refusal, protected export,
+  CSRF refusal, rejected documents without partial writes, and no approval entry
+  created by review-request preparation.
+
+The browser receipt includes the existing fixture human review's single entry;
+the new lifecycle preparation adds no entry. Fixture databases, TLS keys and
+session credentials are deliberately excluded from this directory.

docs/evidence/2026-10-05-lifecycle-authoring/browser-result.json

@@ -0,0 +1,154 @@
+{
+  "fixture_only": true,
+  "browser": "Chromium",
+  "checks_passed": 16,
+  "checks": [
+    "PKCE callback and secure browser session",
+    "Home overview lists the open memo addressed to the reviewer",
+    "Entitled page escapes memo and packet markup",
+    "Server refuses bypass of missing acknowledgments",
+    "Explicit acknowledgment unlocks the form",
+    "Complete attachment download stays behind entitlement",
+    "Return records a memo response without an engine entry",
+    "Mobile review fits the viewport",
+    "One actual approval entry, stable on browser reload",
+    "Audit receiver holds all commitments; unsigned decision gap retained",
+    "Browser creates an approval draft and immutable supporting document revision",
+    "Browser publication and durable handoff download use the actual lifecycle PDP",
+    "Prepared request creates no approval or human entry; lifecycle audit is delivered",
+    "Real workload caller refusal hides review content",
+    "Sign-out clears the session; all forms carry the exact origin",
+    "No page errors or injected script execution"
+  ],
+  "fixture_transport": "real HTTPS on ephemeral ports; synthetic issuer and TokenReview",
+  "native_human_login_proven": false,
+  "native_policy_admitted": false,
+  "factory_attempts": 0,
+  "paid_model_calls": 0,
+  "final_component_state": {
+    "entries": 1,
+    "intents": [
+      {
+        "disposition_id": "disp-2e416ff7-a0b8-4e6a-bf5f-fd90e65f9d18",
+        "approval_id": "fixture",
+        "subject": "human-fixture",
+        "state": "confirmed",
+        "attempt": "a693dad4-6d79-4ab3-b177-9a93de7bbdb9",
+        "approved_at": "2026-10-04T22:44:43+00:00",
+        "presentation_id": "pres-af92dcbd-51e7-4089-ba1e-76fdffcd9e8c",
+        "operation_id": "cc819583-73a7-4f24-8723-2aa4aaeb4280"
+      }
+    ],
+    "outbox_states": [
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered",
+      "delivered"
+    ],
+    "policy_outcomes": [
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "allow",
+      "caller_refused"
+    ],
+    "decision_attributable": [
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0
+    ],
+    "entry_posts": 1,
+    "consume_calls": 0,
+    "tokenreviews": 15
+  }
+}