Adopt canonical flex-auth credential checks

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

docs/credential-broker.md

@@ -213,12 +213,16 @@ The helper performs local catalog checks before any issuance:
 - actor type must be allowed by the grant.
 
 Optional flex-auth preflight is enabled with `--flex-auth-url` or `FLEX_AUTH_URL`.
-The helper posts non-secret request metadata to
-`/credential-grants/authorize` by default and accepts allow/deny responses using
-`allowed`, `decision`, or `status` fields plus optional `decision_id` and
-`reason`. Use `--require-flex-auth` when local preauthorization is not
-acceptable. Use `--decision-id` to carry an already-approved external decision
-without calling flex-auth again.
+The helper posts non-secret request metadata to canonical `POST /v1/check` by
+default. It maps the grant to a `credential-grant:<grant-id>` resource, action
+`issue`, and the bound actor subject. The helper parses `requested_ttl` locally
+and sends integer `context.requested_ttl_seconds`; flex-auth policy never has to
+infer duration units. Only a DecisionEnvelope with `effect: allow` succeeds;
+the helper also requires its decision id, evaluator provenance, and matching
+subject/resource binding. Every other or malformed response fails closed. Use
+`--require-flex-auth` when local preauthorization is not acceptable. Use
+`--decision-id` to carry an already-approved external decision without calling
+flex-auth again.
 
 ## State Hub Metadata