spike: define reviewer roles, final human dispositions, expiry, and segregation of duties

[veil-chow-fyaic]

Objective: define who may hold, request evidence, resolve a finding, override a rule, record HUMAN_CLEARED, record HUMAN_BLOCKED or CLOSED_NO_ACTION, and change policy/source activation.

Deliverables:

• Role and permission matrix
• Four-eyes and named-human requirements
• Clearance scope and maximum expiry
• Final block/no-action authority and audit behavior
• Change-triggered invalidation and rescreening
• Emergency access and complete audit behavior

Exit gate: no automated path, service identity, or AI agent can create a final human disposition; clearance is action/scope/version/time bound.

[veil-chow-fyaic]

#32 implements a conservative technical foundation without deciding deployment authority assignments:

• typed role/scope/operation matrix;
• named HUMAN plus reviewer authority for all final dispositions;
• service and agent denial regardless of forged scope/role;
• trusted state, clearance-eligibility, exact-decision, and configurable four-eyes seams;
• canonical actor identity for audit and submitter/reviewer comparison.

This issue should remain open for human deployment decisions: production role grants, maximum token and decision expiry, step-up and emergency access, canonical identity-directory assignments, where four-eyes is mandatory, source/policy segregation, and change-triggered invalidation/rescreening. Current code defaults fail closed and does not invent those values.