HITL decision shape and skill-promotion evidence

These are enforced runtime invariants, not positioning language.

Learned HITL autonomy

POST /api/company/hitl/should-pause derives hsm.hitl-decision-shape.v1 from the action kind, a server-derived risk band, and four bounded context fields: resource, scope, value_band, and policy_version. The response includes the normalized shape, its SHA-256 digest, risk band, and whether the shape is fully bound.

An autonomy preference is keyed by company, principal, action kind, and exact shape digest. A missing or incomplete shape always pauses. A learned auto preference therefore cannot authorize a different resource/scope/value band, a different policy revision, or a higher risk band.

POST /api/company/hitl/record-override accepts the original risk_score and the same safe context fields. The override event persists that score, derived band, normalized shape, digest, and binding status. Only fully bound shapes train preferences; three consecutive same-direction overrides are still required to flip a shape-specific preference. Detached signatures and WebAuthn ceremonies cover the score and normalized shape identity as well as the human decision.

Legacy preference rows remain visible as legacy-unbound, but never authorize autonomous proceed.

Trace-to-skill promotion

Approval through POST …/trace-skill-promotions/:promotion_id/verify is allowed only when all of the following evidence is present:

1. At least three successful public traces from distinct company tasks have proposals with the same skill slug and exact SHA-256 of proposed_body.
2. A fresh rerun succeeded and is bound to the exact same-company task, agent run, and public trace tuple recorded on the proposal.
3. regression_eval_run_id names a passed company_eval_runs row for that company with at least one task, the same skill slug, the exact proposed-body digest as skill_version, and non-empty scorer and dataset revisions.
4. The verifier has the existing owner/admin or explicitly delegated approval authority.

The promoted skill provenance and promotion ledger persist the body digest, evidence trace/task IDs, task count, rerun identity, and regression eval run. The legacy require_re_run_success request field remains accepted for wire compatibility but cannot disable the rerun gate.