feat: show Creator action history

tests/creator_commit/verify-remote.ps1

@@ -37,6 +37,12 @@ function Creator-Post([string]$url, [object]$body, [string]$token) {
     }
 }
 
+function Creator-Get([string]$url, [string]$token) {
+    $result = docker --context $DockerContext exec --env "CREATOR_TEST_SESSION=$token" $commitContainer sh -c 'wget -qO- --header="Authorization: Bearer $CREATOR_TEST_SESSION" "$1"' sh $url
+    if ($LASTEXITCODE -ne 0) { throw "Creator GET $url failed" }
+    return ($result -join "`n")
+}
+
 function Expect-CreatorStatus([string]$url, [object]$body, [string]$token, [int]$status) {
     $json = $body | ConvertTo-Json -Depth 10 -Compress
     $local = New-TemporaryFile
@@ -82,6 +88,13 @@ $action = Creator-Post http://localhost:8082/v1/creator/continuity/satisfy-deliv
 if ($action.State -ne "SUCCEEDED" -or -not $action.AuthorizedActionID -or -not $action.ActionIntentID -or -not $action.ActionAttemptID) {
     throw "Creator command response is incomplete"
 }
+$historyRaw = Creator-Get 'http://localhost:8082/v1/creator/authorized-actions?limit=50' $creatorSession
+$history = $historyRaw | ConvertFrom-Json
+$historyItem = @($history.Items | Where-Object { $_.AuthorizedActionID -eq $action.AuthorizedActionID })
+if ($historyItem.Count -ne 1 -or $historyItem[0].ActionAttemptID -ne $action.ActionAttemptID -or $historyItem[0].State -ne 'SUCCEEDED') {
+    throw "Creator action history does not contain the committed outcome"
+}
+if ($historyRaw -match 'EvidenceRef|GrantID') { throw "Creator action history exposed restricted envelope fields" }
 $updated = docker --context $DockerContext exec $continuityContainer wget -qO- "http://localhost:8081/v1/prospective-items/$prospective" | ConvertFrom-Json
 if ($updated.State -ne "SATISFIED" -or $updated.Revision -ne 2) { throw "Creator command did not satisfy item exactly once" }
 Expect-CreatorStatus http://localhost:8082/v1/creator/continuity/satisfy-delivered $command $creatorSession 409