Clearance loop

ClearanceIntent (sandbox)

Product object for the local sandbox. Intents persist in Postgres and advance through sandbox states. Create returns a one-time client_secret (ci_secret_...) for the Element only. When sandbox simulated-owner is enabled, test environments can complete clearance via POST /v1/clearance-intents/{id}/simulate-approve (secret key) or POST /v1/element/session/approve (client secret). Live environments reject simulated approval.

Sandbox completion exercises the bounded product result shape without representing a production owner approval. The response includes a cryptographic_proof reference that clients should treat as opaque. Create accepts expires_in (seconds); after expires_at the intent becomes expired, emits clearance_intent.expired, and clears client_secret. Terminal success and cancellation also clear the secret. Pass Idempotency-Key for create replay: the same body returns the original pending payload, while a different body with the same key returns 409. See SDARC for the public guarantees.