Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

internal/conditions/plain.go

@@ -53,8 +53,19 @@ type Action struct {
 	Verb      string            `json:"verb"`
 	Machine   string            `json:"machine,omitempty"`
 	Arguments map[string]string `json:"arguments,omitempty"`
+	// Level is how much proof its answer needs (novox/hq ADR 0234 §8, ADR 0259): LevelAcknowledge for what
+	// any granted principal may already do, LevelApprove for what only the operator's proven word does.
+	// The controller asks for every action, and performs the one chosen on the warrant the router issues.
+	Level string `json:"level,omitempty"`
 }
 
+// The assurance levels an action's answer needs (novox/hq ADR 0234 §8): acknowledge, approve. Destroy is
+// not asked for by any condition: nothing carries its second proof yet.
+const (
+	LevelAcknowledge = "acknowledge"
+	LevelApprove     = "approve"
+)
+
 // The two verdicts an explanation opens with.
 const (
 	NothingToDo = "Nothing for you to do."
@@ -66,7 +77,7 @@ const (
 // only kind of answer a desk click performs until answers are authorised (novox/hq ADR 0258). Its cause
 // marks it as an answer, which the hand-act log does not count as a repair.
 func SilenceAction(key string) Action {
-	return Action{Label: "Silence for a week", Verb: "mesh-controller.conditions",
+	return Action{Label: "Silence for a week", Verb: "mesh-controller.conditions", Level: LevelAcknowledge,
 		Arguments: map[string]string{"silence": key, "for": "7d", "why": "", "cause": CauseOperatorAnswer}}
 }