agent-approval-protocollisted

# Agent Approval Protocol `agent-approval-protocol` is the data contract that flows from a subagent, through the hook layer, to the orchestrator when a T3 command is blocked: the `sealed_payload` fields, the `approval_id` format, the `APPROVAL_REQUEST` shape, the status and event vocabularies, and how to confirm a grant is active. The tables below are the canonical schema -- relay them verbatim, do not author them. The orchestrator presents this contract to the user from a **trusted source**, never by dispatching a subagent to verify or derive it (it has no shell for that). Approvals are **in-loop and single-session**: the source is the subagent's same-turn relayed `approval_request` (there is no cross-turn or cross-session resurfacing of pendings -- no injected verified-pendings block). The **integrity boundary is grant activation**, not presentation: `verify_fingerprint` (`gaia/approvals/chain.py`) runs when the user selects the Approve label, so a tampered payload fails to form a grant regardless of how it was presented. See `Skill('orchestrator-present-approval')` for the presentation discipline. For the universal response envelope (`agent_state` states, `evidence_report`), see `agent-protocol`. For the deep mechanics -- fingerprint canonicalization, the hash chain, grant activation, reading a granted approval from Python -- see `reference.md`. **Build this payload the same way as the rest of the contract: `gaia contract` first, fence always.** Per `agent-protocol`, t