Approvals: Human Gates & Revise

Eight sources, one inbox

An approval can originate from a checkpoint node, a phase gate, self-heal's structural repair path, an OpenClaw exec proposal, a package install request, a credential access prompt, a budget-limit trip, or an outbound-safety hold — eight genuinely different triggers, all landing in the same operator inbox, all following the same approval.requested / approval.resolved realtime contract. An operator never has to learn eight different review UIs for eight different reasons a run might be waiting on them.

Resolving one resumes the run deterministically

For the two sources that actually gate a live run — checkpoint and phase_gate — resolving the approval calls straight back into the engine through a resolution callback, so the run resumes from precisely where it paused rather than being manually re-triggered. A revise decision is distinct from a flat reject: it sends the proposal back with concrete feedback attached, giving the agent a real path to fix and re-propose instead of a dead end that just kills the attempt.

Agent ownership sync: review or bounded trust

Continuous synchronization from an external agent harness has its own durable review queue because source-file changes are knowledge changes, not ordinary workflow completions. The default manual_review mode stages memory, skills, identity drift, and deletions until the operator approves or rejects them.

auto_trusted is not unrestricted write access. It delegates only the categories enabled in that source's policy: memory must clear minAutoQuality, skills must be operator-owned rather than marketplace content, identity updates must be explicitly trusted, and deletions follow their own review/auto/ignore setting. Low-quality or untrusted content is quarantined and cannot auto-apply.

Continue