ADR 0286: a tool or verb marked in its manifest runs only on the operator's approval of that one call (issue 417)

Graduates research 039. The tool runner (and the controller for its own verbs) asks the operator through the existing operator-channel asks and runs the exact call once on the warrant, reusing the act digest and warrant check of ADR 0259 and the shown-in-shape form of ADRs 0274 and 0277, so risky agent calls stop resting on the agent's restraint. Amends to-be 46 and hands it off.
2026-10-10 22:00:27 +02:00
parent 8932e93a4b
commit 9b0c6741e7
9 changed files with 366 additions and 5 deletions
@@ -527,6 +527,10 @@ asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272.
  effect only on the operator's warrant, bound to the exact thing shown: a shared instruction section (ADR
  0274), a trusted setting's layer ([ADR 0277](../02-DECISIONS/0277-a-trusted-setting-is-proposed-through-a-verb-and-set-on-the-operators-warrant-and-a-modules-own-secret-is-asked-for-and-typed-at-the-desk.md)).
  A proposal changes nothing by itself; declined, expired or refused, it is discarded.
+- **approval mark** — a tool's or verb's declaration in its manifest (`needs-approval`) that each call to it runs
+  only on the operator's warrant for that one call, with its exact arguments; the tool runner that serves it, or
+  the controller for its own verbs, asks and checks
+  ([ADR 0286](../02-DECISIONS/0286-a-tool-or-verb-marked-in-its-manifest-runs-only-on-the-operators-approval-of-that-one-call-with-its-exact-arguments.md)).
 - **operator message / input** — what arrives on `intake`, once the router has checked the sender
  against its own list of the operator's identities: a **trusted** one is an operator message,
  addressed to an agent by `@name` or thread or else to the **responder** (`@mesh`, the router's own