# HITL decision shape and skill-promotion evidence

These are enforced runtime invariants, not positioning language.

## Learned HITL autonomy

`POST /api/company/hitl/should-pause` derives
`hsm.hitl-decision-shape.v1` from the action kind, a server-derived risk band,
and four bounded context fields: `resource`, `scope`, `value_band`, and
`policy_version`. The response includes the normalized shape, its SHA-256
digest, risk band, and whether the shape is fully bound.

An autonomy preference is keyed by company, principal, action kind, and exact
shape digest. A missing or incomplete shape always pauses. A learned `auto`
preference therefore cannot authorize a different resource/scope/value band,
a different policy revision, or a higher risk band.

`POST /api/company/hitl/record-override` accepts the original `risk_score` and
the same safe context fields. The override event persists that score, derived
band, normalized shape, digest, and binding status. Only fully bound shapes
train preferences; three consecutive same-direction overrides are still
required to flip a shape-specific preference. Detached signatures and WebAuthn
ceremonies cover the score and normalized shape identity as well as the human
decision.

Legacy preference rows remain visible as `legacy-unbound`, but never authorize
autonomous proceed.

## Trace-to-skill promotion

Approval through
`POST …/trace-skill-promotions/:promotion_id/verify` is allowed only when all
of the following evidence is present:

1. At least three successful public traces from distinct company tasks have
   proposals with the same skill slug and exact SHA-256 of `proposed_body`.
2. A fresh rerun succeeded and is bound to the exact same-company task, agent
   run, and public trace tuple recorded on the proposal.
3. `regression_eval_run_id` names a passed `company_eval_runs` row for that
   company with at least one task, the same skill slug, the exact proposed-body
   digest as `skill_version`, and non-empty scorer and dataset revisions.
4. The verifier has the existing owner/admin or explicitly delegated approval
   authority.

The promoted skill provenance and promotion ledger persist the body digest,
evidence trace/task IDs, task count, rerun identity, and regression eval run.
The legacy `require_re_run_success` request field remains accepted for wire
compatibility but cannot disable the rerun gate.