approval-md 0.4.0 → 0.4.1

package/schema/fixtures/event/invalid/audit-reviewed-system-actor.json

@@ -7,7 +7,12 @@
   "actor": "system:daemon",
   "channel": "cli",
   "payload": {
-    "verdict": "ok"
+    "subject_seq": 15,
+    "subject_event": "audit.sampled",
+    "reviewed": true,
+    "sampled_subject_hash": "6c1d3f0b9a8e7d6c5b4a39281706f5e4d3c2b1a09f8e7d6c5b4a392817060504",
+    "verdict": "ok",
+    "verdict_source": "explicit"
   },
   "alg": "sha256/jcs",
   "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",

package/schema/fixtures/event/invalid/audit-sampled-no-policy-hash.json

@@ -0,0 +1,14 @@
+{
+  "seq": 15,
+  "ts": "2026-08-04T09:25:02Z",
+  "event": "audit.sampled",
+  "task": "task-049",
+  "action_key": "task-049:archive:2026-08-04",
+  "actor": "system:auditor",
+  "payload": {
+    "rate": 0.1
+  },
+  "alg": "sha256/jcs",
+  "prev": "07453feb30c2b0b1a2806398cdd17b38d98f9abf52b8a75ca42878c9101d8264",
+  "hash": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30"
+}

package/schema/fixtures/event/valid/audit-lock-reclaimed-implausible-created.json

@@ -0,0 +1,18 @@
+{
+  "seq": 216,
+  "ts": "2026-10-05T07:41:12.408Z",
+  "event": "audit.lock_reclaimed",
+  "actor": "system:log",
+  "payload": {
+    "lockfile": "events.jsonl.lock",
+    "reason": "holder-dead",
+    "holder": {
+      "pid": 48213,
+      "op": "append",
+      "created": null
+    }
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/valid/audit-lock-reclaimed-legacy.json

@@ -0,0 +1,14 @@
+{
+  "seq": 215,
+  "ts": "2026-10-05T07:52:03.010Z",
+  "event": "audit.lock_reclaimed",
+  "actor": "system:log",
+  "payload": {
+    "lockfile": "events.jsonl.lock",
+    "reason": "legacy-aged",
+    "age_ms": 612000
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/valid/audit-lock-reclaimed-unlock.json

@@ -0,0 +1,19 @@
+{
+  "seq": 216,
+  "ts": "2026-10-05T11:02:40.115Z",
+  "event": "audit.lock_reclaimed",
+  "actor": "human:carter",
+  "payload": {
+    "lockfile": "events.jsonl.lock",
+    "reason": "operator-cleared",
+    "age_ms": 4021877,
+    "holder": {
+      "pid": 31,
+      "op": "append",
+      "created": "2026-10-05T09:55:38.238Z"
+    }
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/valid/audit-lock-reclaimed.json

@@ -0,0 +1,19 @@
+{
+  "seq": 214,
+  "ts": "2026-10-05T07:41:12.408Z",
+  "event": "audit.lock_reclaimed",
+  "actor": "system:log",
+  "payload": {
+    "lockfile": "events.jsonl.lock",
+    "reason": "holder-dead",
+    "age_ms": 734211,
+    "holder": {
+      "pid": 48213,
+      "op": "append",
+      "created": "2026-10-05T07:28:58.197Z"
+    }
+  },
+  "alg": "sha256/jcs",
+  "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",
+  "hash": "2e9b7c1a4d6f08213b5c7e9a0d2f416385a7c9e1b3d5f70921a3c5e7092b4d6f"
+}

package/schema/fixtures/event/valid/audit-reviewed-reaction.json

@@ -7,7 +7,12 @@
   "actor": "human:carter",
   "channel": "cli",
   "payload": {
+    "subject_seq": 15,
+    "subject_event": "audit.sampled",
+    "reviewed": true,
+    "sampled_subject_hash": "6c1d3f0b9a8e7d6c5b4a39281706f5e4d3c2b1a09f8e7d6c5b4a392817060504",
     "verdict": "ok",
+    "verdict_source": "explicit",
     "reaction": "loved",
     "note": "exactly the archive I would have written by hand"
   },

package/schema/fixtures/event/valid/audit-reviewed.json

@@ -7,7 +7,12 @@
   "actor": "human:carter",
   "channel": "cli",
   "payload": {
-    "verdict": "ok"
+    "subject_seq": 15,
+    "subject_event": "audit.sampled",
+    "reviewed": true,
+    "sampled_subject_hash": "6c1d3f0b9a8e7d6c5b4a39281706f5e4d3c2b1a09f8e7d6c5b4a392817060504",
+    "verdict": "ok",
+    "verdict_source": "explicit"
   },
   "alg": "sha256/jcs",
   "prev": "7f625051c176f2f260a1f7e25c9a933717ebb49917a8788ac25ae7a4614ebb30",

package/schema/fixtures/event/valid/audit-sampled.json

@@ -6,7 +6,8 @@
   "action_key": "task-049:archive:2026-08-04",
   "actor": "system:auditor",
   "payload": {
-    "rate": 0.1
+    "rate": 0.1,
+    "policy_sha256": "3b1f0c9d8e7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c"
   },
   "alg": "sha256/jcs",
   "prev": "07453feb30c2b0b1a2806398cdd17b38d98f9abf52b8a75ca42878c9101d8264",

package/schema/fixtures/event/valid/daemon-identity.json

@@ -7,7 +7,8 @@
   "actor": "system:auditor",
   "daemon": "daemon-3f2a9c11",
   "payload": {
-    "rate": 0.1
+    "rate": 0.1,
+    "policy_sha256": "3b1f0c9d8e7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c"
   },
   "alg": "sha256/jcs",
   "prev": "07453feb30c2b0b1a2806398cdd17b38d98f9abf52b8a75ca42878c9101d8264",

package/schema/policy.schema.json

@@ -386,6 +386,58 @@
           "$ref": "#/$defs/promptRows",
           "description": "Visibility DOWN: the row never renders on this channel. Refused for the rows required for a decision — `action_key`, `class`, `command_breakdown`, `protected_path`, `policy_diff`, `policy_load` — and refused at policy load with the machine-readable keyword `prompt-row-required`, which fails the whole policy closed. `payload_hash` is NOT among them because the bound hash is stated inside the canonical block on every channel, so hiding the row removes a duplicate rather than the binding. Naming one row in both `always` and `hide` is refused rather than resolved by precedence: an author who wrote both believes one of them, and picking for them would be a guess.",
           "examples": [["provenance", "chain", "requested_ts"]]
+        },
+        "style": {
+          "type": "string",
+          "enum": ["technical", "minimal"],
+          "default": "technical",
+          "description": "SPEC.md §5.2/§10.3 (APRV-489): how this channel lays out a prompt. `technical`, the default and what an absent key means, is the card every earlier build sent, byte for byte. `minimal` is a short card in plain words: a headline the runtime computes from the class, the payload's own words quoted from the bound bytes, a deadline in plain words, and the whole technical card, canonical rendering included, collapsed inside the same message as the Approve and Deny buttons (SPEC.md §10.3, amended APRV-489). Only Telegram draws it in this release; on `web` and `cli` the key is validated and IGNORED, which shows more than was asked for and never less. A request the minimal card cannot draw honestly (an opaque payload without a `say` declaration naming every key, an attestation, a policy edit, a digest, a truncated payload, an abnormal health row, a card over the message limit) is sent as the technical card. Review cards never change. The enum is closed: an unknown style fails validation, which fails the policy closed to all-`manual`.",
+          "examples": ["minimal"]
+        },
+        "say": {
+          "type": "object",
+          "propertyNames": { "type": "string", "pattern": "^[a-z0-9][a-z0-9_-]*(?:\\.[a-z0-9][a-z0-9_-]*)*$" },
+          "additionalProperties": { "$ref": "#/$defs/promptSay" },
+          "description": "SPEC.md §5.2 (APRV-489): what the minimal card says about a class, keyed by EXACT class name (no wildcard: one friendly phrase must never stand for several classes). Operator text the approver attests, never agent text. Read only under `style: minimal`.",
+          "examples": [
+            {
+              "digest.share": {
+                "does": "share a note about you",
+                "quote": { "scope": "Shared with", "expires_at": "Until", "text": "Note", "digest_id": null },
+                "note": "none"
+              }
+            }
+          ]
+        }
+      }
+    },
+    "promptSay": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "SPEC.md §5.2 (APRV-489): one class's minimal-card declaration. `does` is required for a class core does not phrase itself and refused for one it does, or for a class the command classifier emits (checked at load). It is drawn only over an opaque payload: over a command, a file change or an email the runtime draws its own kind phrase.",
+      "properties": {
+        "does": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 120,
+          "description": "The plain-words verb phrase the headline completes: `Your agent wants to <does>`. Starts with a letter; no line break, sentence punctuation (. ! ? … : ;), markup or ⚠ (checked at load). Not allowed for a class core phrases itself or a class the command classifier emits (`prompt-say-kind`). Drawn only over an opaque payload: over a command, a file change or an email the runtime's kind phrase is drawn instead and the decision record notes `say_does_ignored`. The runtime chooses the entry by the exact class the log records."
+        },
+        "quote": {
+          "type": "object",
+          "propertyNames": { "type": "string", "minLength": 1, "maxLength": 64 },
+          "additionalProperties": {
+            "oneOf": [
+              { "type": "string", "maxLength": 24 },
+              { "type": "null" }
+            ]
+          },
+          "description": "The closed field set for an OPAQUE payload: every top-level key the payload may carry, mapped to the label its value is quoted under (`\"\"` for no label), or `~` for a key known and deliberately left off the simple card (the card then names it under the quotations). At least one key must be shown (checked at load). A payload carrying any key this map does not name is sent as the technical card. Ignored for command, file-change and email payloads, whose excerpt is built in."
+        },
+        "note": {
+          "type": "string",
+          "enum": ["summary", "none"],
+          "default": "summary",
+          "description": "Whether the agent's own summary is shown, labelled as the agent's and as not checked: `summary` (the default) or `none`."
         }
       }
     },