Read pending-action status

Read the status of one human-in-the-loop pending action. Cross-key isolated — an unknown id and another consumer's id BOTH return the identical HITL_NOT_FOUND response (no existence disclosure across api_keys). Lazy expiry — a PENDING row past its 15-minute TTL is flipped to EXPIRED before the response is built. Gated on read:audit — observing your own pending actions is a forensic read.

Strong ETag. The 200 response carries an ETag header (sha256 of every consumer-visible field: id / action_type / status / created_at / expires_at / resolved_at / reject_reason). Clients comparing ETag across calls can detect 'same state' without parsing the body. True 304 Not Modified is NOT emitted on this route — mandates response-provenance fields on every /api/v1/* response and HTTP 1.1 forbids a 304 body, so the two contracts can't both be honoured by a bare 304. The 200 + ETag combination preserves the conditional-read benefit at the cost of bandwidth (the body is always sent).

HITL_ENFORCE flag. When HITL_ENFORCE is true / 1, the live /api/v1/actions/execute path stages a pending_action and returns 412 HITL_PENDING_APPROVAL for a binding write that arrives with no approval token — so this status surface returns the real row status for a minted id. Default (HITL_ENFORCE unset / empty / anything else) is the byte-for-byte unchanged path: NO pending rows are minted via the 412 branch, so this surface returns HITL_NOT_FOUND for every id.