cfgit 0.1.0__py3-none-any.whl

cfg/approval/__init__.py

@@ -0,0 +1,5 @@
+# Copyright 2026 Mohammad Ausaf. Licensed under the Apache License, Version 2.0.
+"""ApprovalProvider implementations (SPEC §11). local (TTY) first, then slack/webhook."""
+from cfg.approval.base import ApprovalProvider, ApprovalState, Pending
+
+__all__ = ["ApprovalProvider", "ApprovalState", "Pending"]

cfg/approval/base.py

@@ -0,0 +1,29 @@
+# Copyright 2026 Mohammad Ausaf. Licensed under the Apache License, Version 2.0.
+"""ApprovalProvider — the real human-in-the-loop (SPEC §11).
+
+The keystone for "safe for agents AND safe for fat-fingers." A gated-env mutation
+NEVER completes from a caller-supplied flag; it completes only when a human resolves
+an approval OUT OF BAND (a different channel / a separate invocation). There is
+intentionally NO MCP tool that grants approval — an agent can observe status, never
+grant it (SPEC §5.18, §12).
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Literal, Protocol, runtime_checkable
+
+ApprovalState = Literal["pending", "approved", "denied", "expired"]
+
+
+@dataclass
+class Pending:
+    approval_id: str
+    state: ApprovalState  # "pending" on creation
+
+
+@runtime_checkable
+class ApprovalProvider(Protocol):
+    def request(self, *, action: dict, requester: str, env: str) -> Pending: ...
+    def status(self, approval_id: str) -> ApprovalState: ...
+    # resolution (approve/deny) happens OUT OF BAND, not through this caller.
+    # The id is single-use and bound to (action, plan_oid); a changed plan invalidates it.

cfg/cli/__init__.py

@@ -0,0 +1,2 @@
+# Copyright 2026 Mohammad Ausaf. Licensed under the Apache License, Version 2.0.
+"""Porcelain + plumbing CLI (SPEC §5). `cfg <verb>`; `--json` for scripts/agents."""