local-first · v0.1

Developer allow

Approval decision — MAY this validated request proceed? Fail-closed verification of capability, vault leases, policy, evidence, environment, and isolation. A token is issued only on authorize; it authorizes nothing to execute here — only the future Broker consumes it.

authorizeddevelopment0 evidence verified0 vault leasestoken issuedbinding: false#84b62c2e
requester:gabriel/gabriel-ai-os/sandboxed-agentpolicy seam:restricted-analystcapability:capperm:emb-a-reason

Verification reasons (fail-closed)

all_checks_passedpass
capability granted, policy compatible, evidence + vault leases verified, scope + environment valid

Approval token & lease (Broker readiness only)

ApprovalToken
idapptoken:appr-dev-allow
scope hashf8b8a241
stateissued
issued / expires (ordinal)100 → 105
single-use / executedtrue / false

The token is what the future Broker (V3) requires before any Provider (V4) executes. It is single-use, scope-bound, expiring, and unexecuted — it is not permission to execute here.

ApprovalLease
max seconds300
expires (ordinal)105
state / grantedplanned / false

Request inputs

execution reasonrun read-only reasoning
execution intent (M50)orch:orch-research
evidence supplied
vault leases supplied
requested lease / at ordinal300s @ 100