4 Commits

Include renames

Author	SHA1	Message	Date
jochen	7289edb276	asks: the proof sees what the phone shows at a tap, and the question's outcome as its title (hq issue 372) ... The operator approved on Telegram and saw nothing: the tap was acknowledged with no words and the question kept its title. The proof now checks the toast says the approval was recorded, no earlier than the warrant; that the edited question opens with how it ended; and that the same answer tapped again is said as already recorded, not refused.	2026-10-10 14:12:45 +02:00
jschoubben	01a541cadf	asks: prove the reviewed flow — the controller's root-free word asked before an approval, the desk on its own account, a tap only on the words shown, the question saying who asks and what each answer does, and a rehearsal at the terminal for the live acceptance	2026-10-09 12:44:21 +02:00
jschoubben	8d24e7bbb5	asks: a granted publish is the control for every refusal the proof reads as the bus's	2026-10-09 11:24:17 +02:00
jschoubben	3a486014fc	Prove the operator's answers end to end before anybody uses them (hq ADR 0259) ... The bus the controller composes and raises, at its commit, for one machine; the mesh's runtime serving the router and the Telegram channel on their own credentials; a fake Bot API as the phone. It links the operator's account with the code shown on the desk, refuses an approval in the hour after a link, performs an approval exactly once with who and how in the warrant and the router's record, refuses a replayed tap and a redelivered warrant, tells the operator when another account answers, drops a tap from a group, does nothing on Decline and on expiry, offers no approval while an agent can become root where the channel runs, and has the bus refuse every forged warrant, ask and tap. live-acceptance.sh is the same after rollout, with a drill the operator approves on the phone.	2026-10-09 11:08:42 +02:00