Repository navigation
Real approval flow and kill switch - #1
Merged
Merged
Conversation
ESCALATE used to be "confirmed" by re-running the same command with --execute, which meant the proposer could confirm its own escalation. It now opens a pending approval that a different person must grant. Approval - Separate credential to decide (CHARTER_APPROVER_KEY plus an X-Charter-Approver identity). The agent key can propose and poll its own escalation status, and can never approve. - The proposing agent cannot approve its own proposal. - Approvals expire (CHARTER_APPROVAL_TTL_MINUTES, default 10). - On approval the proposal is evaluated again against current conditions (market, daily spend, drawdown, kill switch) and refused if it would now be vetoed. - The audit chain is verified before an approval is acted on. - An approval can be granted once, including under simultaneous requests. The approver is written into the audit log on the grant, the execution attempt, and the fill. - CLI: approvals, approve, reject. API: /approvals, /escalations. Kill switch - halt / resume / status, and /control endpoints. While engaged every proposal is vetoed, including an already-approved one that has not executed yet. Who, when, and why are logged. Both approval and kill-switch state are derived from the audit log rather than a separate store, so they cannot disagree with the record. Also: malformed JSON no longer returns an HTML stack trace with file paths; the dashboard shows the halted state and pending approvals; the rogue agent now tries to force an escalated trade and stays blocked. README gains Human approval, Kill switch, and an explicit Trust boundary section stating what this does and does not protect against. 48 new tests (95 total). Verified live on Binance Spot Testnet: an escalated trade cannot be forced with --execute, self-approval is refused, an approval fills once and cannot be replayed, and an approval attempted after the kill switch was engaged is blocked by the re-check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ESCALATE used to be confirmed by re-running the same command with --execute, so the proposer could confirm its own escalation. This replaces that with a real approval flow and adds a kill switch.
Approval
Kill switch
State for both is derived from the audit log, not a separate store.
Also: malformed JSON no longer returns an HTML stack trace with file paths, the dashboard shows halted state and pending approvals, and README gains an explicit Trust boundary section.
Testing: 48 new tests (95 total), all offline. Also run live against Binance Spot Testnet: an escalated trade cannot be forced with --execute, self-approval is refused, an approval fills once and cannot be replayed, and an approval attempted after the kill switch was engaged is blocked by the re-check.
Behaviour change to note: on this branch the ESCALATE step in the submission demo (re-running with --execute) no longer works. The v1.0-submission tag still pins the code the video shows.