HMAC-SHA256 approval signature (v6.0.202, approval.signature). Must survive the UI round-trip untouched: with a configured approval secret, a replay missing it is denied fail-closed.
approval.signature
0.3.0-beta01