Documentation

Approval protocol

What an approval authorizes, and why it can only be spent once.

What’s in the card

An approval card states what broke, what was proposed, the risk of approving, the risk of waiting, and the confidence expressed in words. The numeric score and the full diff sit behind a technical-details toggle, because the card is written for the person accountable for the system, not necessarily for an engineer.

Single-use authorization

Each approval link carries a 32-byte nonce. Validation and consumption happen in one atomic statement, with expiry evaluated in the same predicate — split across two statements, both the single-use property and the expiry check were races. Previewing a card and consuming it are separate call paths, so a page refresh or a mail client prefetching the link cannot spend a valid approval.

This is enforced server-side. Nothing about it depends on which button a browser renders. The full account, including the defect this replaced, is in Binding human approval to an exact proposed change.

Approve or escalate

Approving merges the pull request — it does not deploy. Escalating hands the incident to an engineer with the full evidence, the root-cause hypothesis, and everything already attempted. Escalation and denial are both recorded outcomes, not failures.